The CCPS (Center for Chemical Process Safety) has published the May 2026 Process Safety Beacon Training After a Change. This Beacon describes a situation where instrumentation was changed, but there was no follow up training, or an update of the operating procedures. This was a near-miss situation — no one was injured.

The following is an analysis of the Beacon using the ‘top three’ of the 20 elements of process safety as defined by the CCPS.

PSM Elements

In this series of posts we evaluate incidents for process safety insights using the management elements defined by the Center for Chemical Process Safety (CCPS). The elements are:

1. Process Safety Culture

2. Compliance

3. Competence

4. Workforce Involvement

5. Stakeholder Outreach

6. Knowledge Management

7. Hazard Identification and Risk Management

8. Operating Procedures

9. Safe Work Practices

10. Asset Integrity / Reliability

11. Contractor Management

12. Training / Performance

13. Management of Change

14. Operational Readiness

15. Conduct of Operations

16. Emergency Management

17. Incident Investigation

18. Measurement and Metrics

19. Auditing

20. Management Review

The ‘Top Three’

Of the elements listed, the following are particularly pertinent to this incident.

Management of Change

This is the dominant element. The installation of vibration monitoring sensors was a physical and procedural change. Later, replacing the motor was also a change affecting the equipment configuration. The change process apparently did not ensure that the sensor remained part of the equipment package, that the affected procedures were updated, or that workers and contractors understood the new requirements.

Training and Performance Assurance

The Beacon’s title points directly to this issue. Workers responsible for operating, maintaining, inspecting, or replacing the equipment needed training after the vibration-monitoring system was installed. Training should have made clear that the sensor was now part of the equipment’s required configuration and had to be reinstalled or reconnected after motor work.

Operating Procedures

The motor replacement procedure apparently did not include instructions to remove, protect, reinstall, reconnect, and verify the vibration sensor. If procedures are not revised after a change, field personnel will often revert to the old task method, which is what appears to have happened here.

Secondary elements

Asset Integrity and Reliability

The vibration-monitoring system is part of the equipment reliability and early-warning strategy. If the sensor is not installed or functioning, the organization may falsely believe that critical rotating equipment is being monitored.

Operational Readiness

After equipment modification or replacement, there should have been a readiness check or inspection confirming that the motor, sensor, wiring, data signal, and alarm/monitoring display were all restored and functional.

This item is a close runner-up for the top three.

Contractor Management

The Beacon states that contractors may not have reinstalled the sensor or may not have had the updated procedure. If contractors perform maintenance on changed equipment, they must receive the same relevant technical information and procedural expectations as employees.

Process Safety Information / Knowledge Management

Drawings, equipment records, inspection checklists, maintenance instructions, and monitoring-system documentation should have reflected the installed sensor. Without updated information, the change becomes invisible to later workers.

Subscribe now

Last December we published the book Process Safety Management. Before that we published Plant Design and Operations. We are now working on the third book in this series: System Reliability: Decision Making in an Age of AI. An introduction to the series is provided here.

This new book is very much a work in progress. Nevertheless, we have releasing draft materials in order to encourage feedback and discussion. Please provide your comments.

Chapter 1

The first set of released materials will be four sections from Chapter 1: Boundaries and Outcome. There are four download modules:

• Chapter 1a

• Chapter 1b

• Chapter 1c

• Chapter 1d

The current Table of Contents for Chapter 1 is shown below.

Chapter 1 — Boundaries and Outcome
Overview
Book Structure
Book Series
Understanding Risk
Risk Management Strategy
Asymmetry
Benefits of Improved Availability
Optimum Reliability Investment
Production and Profitability
Reduced Maintenance and Downtime Costs
Customer Satisfaction and Public Relations
High Consequence Events
Leadership Benefits
Worked Examples
Pump System
Heat Exchanger
Concluding Transition

Overview of Chapter 1

Chapter 1 introduces a central idea of this book: that industrial performance is governed by two fundamentally different types of constraint. Safety and environmental protection define the boundaries within which a facility must operate. These boundaries are non-negotiable and reflect ethical, regulatory, and societal expectations. Within those constraints, the primary determinant of outcome is system availability — the ability of the facility to operate as intended, when required, and to recover quickly from disruption.

The chapter distinguishes between external factors that are largely beyond management control, such as market prices and input costs, and internal factors — reliability, maintenance, operations, and organizational effectiveness — that directly influence availability. It shows how these internal variables shape both production and cost, and therefore overall financial performance.

Although safety and availability both involve the management of risk, they are not the same type of problem. Safety decisions are constrained by ethical considerations and do not lend themselves to simple optimization. In contrast, availability can be analyzed, managed, and improved using economic and engineering principles.

The chapter concludes by outlining the structure of the book and introducing two worked examples that are used throughout to illustrate key concepts.

In other words:

Safety defines the boundaries.
System availability defines the outcome.

Subscribe now

This post is the sixth in a series to do with process safety and artificial intelligence. Previous posts are:

1. Artificial Intelligence in Process Safety Management

2. Artificial Intelligence and Process Safety: Helpful ― Not Authoritative

3. Artificial Intelligence and Process Safety: Understanding Paradox

4. Process Safety and AI: Who Will Pay?

5. Artificial Intelligence and Process Safety: Accountability Cannot Be Automated

In this post we start a series on the theme ‘The Process Safety Singularity’.

The word singularity is dramatic. It suggests black holes, time travel, and a future in which familiar rules no longer apply.

That is not the sense in which the word is used in this series.

In physics, a singularity is associated with a point at which current theories cease to provide a complete description of reality. For example, around a black hole, the known laws of physics, specifically general relativity, work well. But at the singularity itself, the theory reaches its limit. An Event Horizon — the boundary around a black hole beyond which nothing, not even light, can escape — marks the point of no return.

The singularity/event horizon image is useful for thinking about artificial intelligence and process safety, although ― like all analogies ― it should not be pushed too far.

Process Safety Singularities and Event Horizons

In the extreme, a process safety singularity would occur when AI takes over decision making, including decisions that involve ethical judgment, risk tolerance, and management accountability. A deliberately tongue-in-cheek definition for this type of horizon would be,

A process safety event horizon is the boundary beyond which no one — not senior managers, not process safety professionals, not operators, and not regulators — can understand or control how the process safety management program is designed, structured, or managed. Once crossed, the program is outside meaningful human control.

That is not the scenario being discussed in these posts. It is a warning image.

A more practical definition would be on the following lines,

A process safety singularity occurs when AI-enabled systems change the identification, interpretation, and management of process safety risk faster than the organization can understand, validate, or implement those changes.

Managers remain accountable. The challenge is whether that accountability can be exercised effectively when AI systems influence decisions in ways that are difficult to inspect, explain, or challenge.

This definition removes the science fiction flavor. AI does not have to become conscious. It does not have to replace engineers or operators. It does not have to seize control of the plant. The danger is not that AI becomes evil or conscious. The danger is that the organization no longer fully understands how its own risk judgments are being formed.

The more realistic concern is subtler: AI may become so deeply embedded in process safety work that it begins to shape the questions asked, the risks emphasized, the weak signals noticed, and the management priorities selected.

At that point, the organization has crossed an unremarkable but real event horizon. AI is now no longer merely helping people perform familiar tasks. It is changing the way they think.

The process safety singularity will probably not announce itself. It will not arrive as a dramatic corporate decision that says, “From this day forward, AI will manage process safety.” More likely, it will arrive through useful tools such as the following.

AI-assisted PHA preparation

• AI-generated incident summaries

• AI review of operating procedures

• AI comparison of audit findings

• AI screening of Management of Change records

• AI-assisted analysis of near misses

• AI-generated dashboards

• AI review of regulatory changes

• AI-supported risk models

• AI agents that monitor data streams and recommend action.

Each step will appear reasonable. Each tool may save time. Each application may improve consistency. Each recommendation may look helpful. Taken together they become a type of singularity.

Over time, the organization may cross a boundary. It may begin to rely on AI not merely to assist process safety work, but to frame the questions, select the priorities, identify the weak signals, interpret the evidence, and shape the management agenda.

However, this does not mean that AI cannot help us understand various process safety ‘event horizons’. It can encourage people to ‘think the unthinkable’. AI points to a boundary beyond which familiar methods of understanding and prediction may no longer be sufficient. That is the sense in which this series uses the term process safety singularity.

Three Potential Event Horizons

This series will examine three possible “singularities,” or threshold changes, in the way AI may affect process safety.

Systems Thinking

Most process safety programs are divided into management elements. AI may help organizations see interactions among those elements rather than treating them as separate compartments.

Dynamic Linkage of Real-Time Data with Risk Analysis

AI may move process safety from periodic review toward more continuous interpretation of operating conditions, regulatory changes, maintenance status, staffing changes, and other signals.

Development of Broader Risk Models

Traditional fault trees and related methods often focus on equipment and instrumentation failures. AI may help create models that also incorporate human factors, organizational decisions, staffing constraints, maintenance backlogs, procedural weaknesses, and management-system degradation.

Each of these thresholds is practical. None requires science fiction. Each represents a possible shift in how process safety is understood and managed.

Conclusion

The phrase ‘process safety singularity’ should not be understood as a prediction that AI will take over process safety management. Nor should it be read as a claim that AI will eliminate fires, explosions, toxic releases, equipment failures, or human error. The physical realities of process safety remain unchanged. Materials still burn, corrode, react, leak, and explode. People still make decisions under pressure. Organizations still face economic, regulatory, and operational constraints.

The singularity lies in the management of knowledge.

AI may allow process safety information to be connected, interpreted, and challenged at a speed and scale that traditional management systems cannot easily match. It may identify patterns across procedures, training records, MOC files, maintenance histories, incident reports, audit findings, and operating data. It may help an organization see connections that were always present but previously hidden by departmental boundaries, document systems, and periodic review cycles.

That is the opportunity.

The danger is that the same tools may begin to shape process safety judgment without the organization fully recognizing the shift. AI may start by helping people answer questions. Over time, it may influence which questions are asked, and which risks receive management attention.

Managers remain accountable for process safety. That principle does not change. What changes is the practical difficulty of exercising that accountability when AI systems influence decisions through complex, dynamic, and sometimes opaque forms of analysis.

At that point, the organization has crossed an event horizon. AI is no longer merely a productivity tool. It has become part of the process by which the organization understands risk.

The correct response is not to reject AI; the correct response is to govern it. Process safety professionals and managers should use AI to broaden inquiry, identify hidden connections, and challenge stale assumptions. But they must also insist on technical validation, operational reality checks, source transparency where possible, and clear human ownership of decisions.

This series will therefore examine three possible event horizons: the movement from element-based thinking to systems thinking; the dynamic linkage of real-time information with risk analysis; and the development of broader risk models that include not only equipment and instrumentation, but also human behavior, organizational decisions, and management-system degradation.

That is why the process safety singularity matters.

Subscribe now

This post is the fifth in a series to do with process safety and artificial intelligence. Previous posts are:

1. Artificial Intelligence in Process Safety Management

2. Artificial Intelligence and Process Safety: Helpful ― Not Authoritative

3. Artificial Intelligence and Process Safety: Understanding Paradox

4. Process Safety and AI: Who Will Pay?

This post discusses professional accountability.

Large Language Models (LLMs) are moving rapidly into areas that were once considered the exclusive domain of trained professionals. These models can review legal contracts, summarize medical records, identify accounting anomalies, draft engineering reports, and prepare regulatory filings. In many cases they can do so quickly, cheaply, and with a high level of fluency.

Not only can LLMs help professionals to become more productive, they can also help non-specialists ask better questions before seeking professional advice. For example, a process safety professional can submit a proposed employment contract to an LLM and receive valuable guidance as to whether they should sign that contract.

Opportunity and Danger

This situation creates both an opportunity and a danger.

The opportunity is clear. Professionals can use these tools to reduce repetitive work, improve consistency, identify omissions, and accelerate analysis. A lawyer can review hundreds of pages of contracts in minutes. A physician can use an LLM to organize patient histories and identify possible drug interactions. An accountant can detect patterns in financial data that would otherwise be overlooked. A process safety engineer can use one of these tools to prepare draft procedures, summarize incident reports, or identify common failure themes across multiple facilities.

Used properly, an LLM can improve the quality of professional work, and drastically reduce the effort needed to complete that work.

The danger arises when assistance is confused with responsibility.

A legal contract still requires a lawyer who understands the law, the client’s objectives, and the implications of the wording. A medical recommendation still requires a physician who understands the patient as a human being rather than as a collection of data fields. Financial statements still require accountants who are accountable for their integrity. Engineering decisions still require licensed professionals who understand both the technical details and the potential consequences of failure.

These distinctions matter because LLMs do not possess judgment in the professional sense of the term. LLMs are just pattern-recognition machines ― they do not think, they do not possess cognition. Nor do they understand ethics, liability, public welfare, or professional duty. They do not possess experience, accountability, or moral agency. They do not lose sleep over a failed design, a lost-time accident, or the pollution of the local waterways. They do not worry about the possibility of criminal prosecution. They merely generate statistically plausible responses based on patterns contained within training data.

The critical point is that responsibility remains with the human professional who accepts, modifies, rejects, or implements the findings and recommendations.

This principle is already embedded within many professional disciplines. A junior engineer may perform calculations, but a licensed engineer approves the final design. A paralegal may draft legal material, but an attorney signs the filing. A medical resident may prepare an assessment, but the attending physician remains accountable.

LLMs should be viewed in much the same way: they can provide highly capable assistance, but not authority. In fact, the more powerful these systems become, the more important professional responsibility may become. The risk is not merely that these systems make mistakes. The greater risk is that professionals gradually stop exercising independent judgment because the AI output appears confident, complete, and authoritative.

Professionalism requires more than technical competence. It requires accountability. And accountability cannot be automated.

At the end of the day, someone, not something has to sign off on the report that was issued or the recommendations that were made.

Process Safety Management

The same principles apply to process safety management. Many process safety activities already contain formal mechanisms that define accountability and professional responsibility. For example,

• A process safety audit may involve large amounts of data gathering, analysis, and report preparation. An LLM can provide invaluable assistance with this work. However, before the audit is submitted to senior management it must be certified by a human auditor.

• An LLM can help prepare or revise operating procedures by organizing information, improving formatting, and identifying inconsistencies. But, before the procedure is issued for use in the field, it requires approval and signature by an Operations Superintendent or equivalent authority who accepts responsibility for the instructions being issued.

• An LLM may assist with incident investigations by organizing timelines, summarizing witness statements, or identifying possible causal factors. Nevertheless, the final report for a lost-time incident must still be reviewed and signed by the lead investigator, who remains professionally accountable for the findings and recommendations.

• A HAZOP (Hazard and Operability) team can use an LLM to help identify deviations, summarize previous incidents, and evaluate safeguards. But the determination as to whether risk is acceptable remains the responsibility of the team leader and plant management.

• Mechanical integrity inspections increasingly use AI-based image recognition or predictive analytics. Yet the decision to continue operating equipment, defer repairs, or shut down a unit still requires engineering judgment backed by professional accountability.

Confidentiality

The use of LLMs creates a new potential problem: if information is provided to an internet-based system, it may enter the public domain depending on the permissions that were given to the LLM.

Increasingly, local LLMs will be used.

But we still come full circle ― if LLMs are used to write and analyze documents, where and when does the human expert fit into the cycle?

That is the topic of a future post.

Subscribe now

This post is the fourth in a series to do with process safety and artificial intelligence. Previous posts are:

1. Artificial Intelligence in Process Safety Management

2. Artificial Intelligence and Process Safety: Helpful ― Not Authoritative

3. Artificial Intelligence and Process Safety: Understanding Paradox

This post considers how the economics of Large Language Models (LLMs) may affect their use in process safety.

Most of the companies providing LLMs offer a multi-tier pricing strategy, including a free entry-level service. The rate for the first paid layer is typically $20/month. (There is very little public information to do with the paid/free ratio, but it is probably around 5%.)

Until now, the companies offering these models have justified their decision to offer a free option for the following reasons.

• It helps establish market presence.

• Users become part of the company’s ecosystem ― the brand becomes familiar. There is a non-financial cost to do with leaving that system.

• As the user needs more capability, he or she is likely to move to a paid level.

The problem with offering free and low cost options is that the company providing the LLM struggles to make a profit. For example, one report states that OpenAI reported $13.5 billion in losses for the first half of 2025, while generating only $4.3 billion in revenue.

For process safety professionals, these costs matter because LLMs are unlikely to remain a near-free utility. If they become embedded in HAZOP preparation, procedure writing, incident analysis, training, or mechanical integrity workflows, then access to high-capability models will become a budgeted professional tool, not a casual convenience.

Financial Reports

It must be stressed that many of the AI companies do not provide public information on their finances, so their reporting is hard to verify. Nevertheless, among the specialist AI companies, expenses appear to exceed revenues by a wide margin.

A further difficulty is that the reported revenue number may be misleading. Some of that ‘revenue’ comes from the provision of services and compute capacity to companies which are also suppliers to the LLM company.

If these companies were just garage-based startups then their lack of profitability would not matter too much. But the figures on both the revenue and expense side are huge.

On-Going Investment

The financial gap has, to this point, been covered by investors who hope to reap immense profits at some time in the future. However, in the year 2026, many of these investors are becoming restless. They would like the AI companies to make a profit sooner rather than later.

Given this background, it appears that the AI companies will be compelled to raise their fees, and they will have to phase out, or drastically reduce, their free offerings.

A simple back-of-the-envelope calculation suggests that they will have to increase the first-tier price to $100 per month ― assuming that such a price increase will not lead to a loss of customers ― a highly unlikely assumption.

The other approach that they could take is to charge ‘by the drink’, i.e., by the number of tokens used, for which there would be a monthly allowance. The difficulty with this metered approach from the customer point of view is that it is not known ahead of time how many tokens a particular prompt may use. Budgeting will become challenging.

Process Safety Implications

The implication for process safety work is straightforward. Organizations should no longer treat AI as a free or low-cost add-on to professional work. If LLMs are used for HAZOP preparation, incident investigation, procedure development, or training, then a cost for this service should be included in budgets. The days of unrestricted free or low-cost access to frontier AI models are probably coming to an end. This means that AI companies will increasingly focus on enterprise customers who can justify higher fees through productivity, risk reduction, and workflow integration.

Caution

There remain, however, two cautionary notes. First, most of the financial reporting from privately-held companies is not publicly verified. Estimates provided in articles such as this one are just that: estimates. (There has been continuing speculation that some leading AI companies may go public in the near future. If they do, their financial reporting will become more transparent.)

Second, financial projections generally assume that demand for ‘compute’ and energy will continue to rise exponentially. It is possible that new generations of AI hardware and software will be considerably more efficient, and therefore less demanding of resources. If so, costs may not be as high as previously anticipated.

Subscribe now

This post is the third in a series to do with the use of Artificial Intelligence (AI) and Large Language Models (LLMs) within the process safety management discipline. The first two posts are:

• Artificial Intelligence In Process Safety Management: A Structured Approach to Decision, Execution, and Analysis

• Artificial Intelligence and Process Safety: Helpful ― Not Authoritative

In this post we consider the role of paradox in Process Safety Management (PSM).

Proper Names

The following quotation is often attributed to Confucius.

The term Artificial Intelligence is not the ‘proper name’ for programs such as ChatGPT, DeepMind and Claude. Specifically, LLMs are not conscious minds; they are not intelligent. They do not possess understanding, judgment, intuition, or experience. LLMs are simply software systems trained to identify statistical relationships between tokens: words, symbols, and patterns contained within enormous data sets. They are powerful tools, but they are not conscious minds.

Attributing the term ‘intelligence’ to such systems is more than misleading ― it attributes a capability to them that does not exist. This means that professionals in all disciplines need to be very cautious about allowing AI to make decisions.

Paradox

This caution applies particularly to process safety because the discipline often involves something deeper than pattern recognition.

Process safety involves paradox.

For example, many incident reports identify the lack of clear, comprehensive operating procedures as being an important contributing factor to the incident in question. The resulting recommendation is that operating procedures should be thorough, complete, accurate and up to date. The procedures should also anticipate as many operating situations as possible.

The catch is that no written procedure can describe every possible operating condition, equipment failure, weather event, utility disruption, or human interaction. Real facilities are too complex.

Therefore, safe operation requires two apparently opposing behaviors:

• Strict procedural compliance,

• Intelligent adaptation when reality differs from the procedure, often during an emergency.

This is more than a balancing act. The very discipline that prevents unsafe improvisation can also become dangerous if it prevents intelligent response to conditions the procedure did not anticipate.

An experienced process safety professional understands this paradox, and can work within it. An LLM, on the other hand, may have trouble responding to this type of challenge because the situation will contain multiple valid but conflicting objectives that cannot be resolved through straightforward pattern matching.

In other words,

Can LLMs handle novel conditions?

LLMs do not reason about the world in the same way humans do. They do not possess direct experience, tacit operational understanding, or physical intuition. They generate responses based on statistical relationships learned during training. This means that they are strongest when the domain is well represented in training data, the problem resembles prior examples, and the structure of the problem is stable. They are weaker when conditions are genuinely novel, physical interactions are poorly represented, or the problem requires deep understanding of context and consequence.

Bhopal

Intuition

Experienced operators and engineers often recognize danger before they can fully articulate the reason for their concern. They have hunches based on anomalies such as,

• An unusual sound

• An unexpected trend

• A subtle operational inconsistency

• An interaction that ‘doesn’t feel right’.

This type of judgment is difficult to formalize because it often depends on tacit understanding accumulated over years of direct operational experience. Hence, it is very difficult to incorporate hunches and feelings into an LLM’s training.

More Paradoxes

Here are some more PSM paradoxes.

Too Much Data

• Modern facilities generate enormous quantities of data.

• More data should improve understanding.

• But excessive data can obscure critical signals.

• Important weak indicators become buried.

• Organizations become ‘data rich but insight poor’.

Knowledge

• The more organizations know about hazards, the more they realize how much uncertainty remains.

• They learn that rare interactions, abnormal conditions, organizational behavior, and human adaptation cannot be fully modeled.

• Hence increased expertise often produces greater humility rather than greater certainty.

• That characteristic sharply contrasts with many AI systems, which often generate responses with high apparent confidence regardless of actual uncertainty.

Conclusion

LLMs are invaluable tools for organizing information, identifying patterns, generating procedures, and reviewing large bodies of technical material. But process safety management also involves judgment under uncertainty, recognition of anomalies, and an understanding of paradoxical conditions. These capabilities remain deeply dependent on human experience and operational understanding.

Here is a final paradox: the safer a facility appears to become, the greater the risk that vigilance will decline. Long periods without incidents may create confidence, normalization, and complacency.

In other words,

Safety success can itself become a source of vulnerability.

Subscribe now

Like many process safety professionals I have been using Artificial Intelligence (AI) tools ― mostly Large Language Models (LLMs) ― to support my research and writing. Although AI tools are helpful (a word that crops up a lot in this post) we need to be aware of potential pitfalls, particularly when it comes to professional responsibility.

All professionals, regardless of their discipline, have to be sure of the quality and integrity of their work. But the information provided by AI systems cannot always be trusted. Not only may the information that they provide be inaccurate or misleading ― these systems may also ‘hallucinate’, i.e., generate false statements. (Strictly speaking, they do not lie because lying implies moral intent.)

So how can process safety professionals use AI without violating the principles of their discipline? After all, a mistake in an analysis or a report could lead to someone being injured or killed.

One response to this concern is that AI should be seen as a helpful tool, but not as ‘the answer’. Three AI roles are:

1. An idea generator

2. A drafting/editing assistant

3. An analytical support tool

This distinction aligns with the framework described in previous posts: Decision Strategy → Execution → Analysis/Reporting.

Here are examples:

• During a HAZOP, an AI tool may identify an overlooked cause for a hazardous condition. But the HAZOP team must then validate that cause.

• An LLM can collect a jumble of notes written by various people to do with starting a chemical reactor, and turn those notes into a coherent, readable operating procedure. But then operations management has to formally accept the new procedure (and train people in its use).

• An LLM can prepare a slide pack presentation to senior management regarding a lost-time incident. But the person making the presentation had better be sure that he or she can respond to challenging questions.

The keyword in all these situations is ‘helpful’. The AI system does not replace the professional, nor does it make decisions on its own. For AI to be effective, it still needs human instructions ― for example, to do with the structure of a slide pack presentation. Moreover, the process safety professional is always ― repeat always ― responsible for his or her analyses, reports, actions and recommendations. That responsibility cannot be delegated to a machine.

To summarize: a useful test is this.

Would I be willing to sign my name to this AI-generated analysis or report if I knew that it will be reviewed by an experienced investigator, regulator, or opposing expert after an incident?

If the answer to the above question is ‘No’ then the AI output should be used with caution. It may be useful. It may be interesting. It may be thought-provoking. It may point to issues that deserve further investigation. But it is not professional work.

Subscribe now

Here is the Abstract of a recently submitted paper for a process safety conference.

Artificial Intelligence (AI), particularly large language models (LLMs), is increasingly being used by process safety professionals. This paper addresses the challenge of how AI can be applied constructively without weakening professional judgment, accountability, or the ethical foundations of process safety management.

The paper proposes a practical three-part methodology for applying AI within the process safety management discipline. They are: Decision Strategy, Task Execution, and Analysis/Reporting.

At the Decision Strategy level, AI can help frame strategic questions, identify systemic weaknesses, and extract lessons from incident databases. It can address high-level issues such as, ‘What do we need to do to improve safety given our limited resources?’ or ‘Prepare a Safety in Design philosophy’.

At the Task Execution level, AI can structure activities such as HAZOP preparation, LOPA development, the writing of operating procedures, training program design, mechanical integrity planning, trend detection, and weak-signal identification. AI can help address design topics such as the development of a relief system strategy.

At the Analysis and Reporting level, AI can assist with incident analysis, regulatory submissions, the writing of technical reports, and the development of management presentations.

A key insight is that AI is most effective when embedded within a disciplined management system. It can improve organization, completeness, and communication, and it can generate insights and alternative perspectives. However, AI cannot replace professional judgment or accountability, particularly in matters involving acceptable risk and ethical decision-making.

AI is a powerful tool, it cannot replace professional judgment.

Subscribe now

BSEE (the United States Bureau of Safety and Environmental Enforcement) routinely publishes Safety Alerts. These reports describe accidents or near misses that occurred offshore.

In this series of posts we analyze these Alerts for the process safety lessons that they provide. In the U.S. offshore world the process safety standard is called SEMS: the Safety and Environmental Management Systems.

In this post we review Safety Alert Number 515. It describes three related incidents.

The Incidents (What Happened)

This Alert described three incidents to do with electrical safety. All three events were near misses in the sense that no one was injured. But they all involved small fires that could have become much worse. In one case, the response (the use of water on live equipment) could have led to electrocution.

The pictures reinforce the theme: damaged/melting electrical components, welding leads contacting combustible material, and a failed plug.

Themes

These three incidents have the following themes.

1. Temporary electrical equipment can be high-risk

The alert is not about fixed electrical distribution. It is about extension cords, plugs, welding leads, and portable powered tools. These items are often treated as routine consumables, but they can introduce ignition and shock hazards.

2. Inspection must be specific, not general

‘Inspect the cord’ is not enough. The alert calls out plug prongs, strain reliefs, terminations, grounding conductors, cord condition, receptacles, and separation of cords and welding leads.

Incident 3 is especially relevant: the cord and receptacle were acceptable, but the tubing bender plug had a loose prong that was missed during pre-job inspection.

3. Small fires are early-stage major incidents

Each incident was controlled quickly, but each had escalation potential. A small flame at a plug, a melting welding lead, or a loose plug prong should be treated as a precursor event, not a minor nuisance.

4. Emergency response can create a second hazard

Incident 1 is important because someone used water on potentially energized conductors. This created an electrocution hazard, and may spread the fire if the conductors remain energized.

5. Contractors and routine construction are a part of SEMS

These incidents were not exotic or highly unusual process events. They occurred during normal welding, construction, instrumentation, and electrical work. SEMS (BSEE’s Safety and Environmental Management System) applies to routine, temporary, contractor-supported work.

‘Top Three’ SEMS Elements

The SEMS system is built around seventeen management elements. With respect to these incidents, the ‘top three’ are as follows.

6. Safe Work Practices

This is the most relevant SEMS element. The incidents involve permit-to-work, job safety analysis, welding work, temporary power, electrical isolation, red-tagging defective equipment, and control of ignition sources. BSEE explicitly recommends following permit-to-work and JSA (Job Safety Analysis) requirements before work begins.

7. Training

This alert specifically recommends training personnel to recognize electrical hazards involving temporary equipment and incorporating the alerts into toolbox talks, electrical safety training, and refresher briefings.

8. Mechanical Integrity

Although ‘mechanical integrity’ generally refers to pressure vessels, piping, valves, and rotating equipment, here it applies to the physical condition of electrical cords, plugs, grounding conductors, prongs, strain reliefs, terminations, and welding leads. The failures were equipment-condition failures: damaged or defective temporary electrical equipment was either not inspected adequately or failed in service.

Conclusion

These incident reports are useful precisely because they were small. No one was injured, and the fires did not escalate. But that should not make them seem trivial. They show how ordinary temporary equipment can create ignition and shock hazards, how inspections can miss specific defects, and how an attempted response can introduce a new hazard.

In SEMS terms, the lesson is straightforward: routine work still requires disciplined safe work practices, competent personnel, and equipment that is fit for service.

Subscribe now

We have been analyzing the Safety Alerts from BSEE (Bureau of Safety and Environmental Enforcement) using the elements of SEMS (Safety and Environmental Management System).

The next Alert in this series is to do with Safety Alert Number 514 Verify Megger Testing.

We will not conduct a full SEMS analysis on this Alert because it does not provide many insights to do with management systems.

The Corrective Action from BSEE reads as follows:

To help prevent similar incidents in the future, the Bureau of Safety and Environmental Enforcement recommends that operator and contractor supervisors, where appropriate, consider the following:

• Follow the manufacturer’s instructions and the approved work pack for repairs.

• Verify test setup and results before restoring equipment to service.

• Use test equipment with the correct voltage rating for the job.

• Ensure workers understand unit prefixes (ohms, kilo-ohms, megaohms) and the magnitude differences. by which members of the workforce are consulted and participate in preparation.

Subscribe now

BSEE (the United States Bureau of Safety and Environmental Enforcement) routinely publishes Safety Alerts. These are reports describe accidents or near misses that occurred offshore.

In this series of posts we analyze these Alerts for the process safety lessons that they provide. In the U.S. offshore world the process safety standard is called SEMS: the Safety and Environmental Management Systems.

In this post we review Safety Alert Number 513 ― an incident in which an exterior walkway separated from temporary living quarters.

The Incident (What Happened)

Three workers were standing on an external third-floor walkway outside a room in temporary living quarters on an offshore platform when the walkway detached outward from the structure. Two workers were able to open the door and return inside the room. The third worker moved away from the detached section while remaining on the walkway. After confirming that all workers were safe, personnel secured the stairway and walkway with chain bindings to prevent dropped objects and further movement.

Themes

• Aging of temporary structures used beyond original design intent

• Structural degradation in marine environments

• Inadequate inspection criteria for welded connections

• Reliance on visual inspections for load-bearing structures

• Living quarters structural integrity and personnel safety

These themes are recurrent across offshore incidents involving facilities that transition from temporary to long-term service without corresponding changes in inspection and integrity management programs.

Immediate Causes and Contributing Factors

Immediate Cause

• Separation of the exterior walkway from the temporary living quarters due to failure at the welded connection points.

Contributing Factors

• Design not intended for long-term service: The living quarters were designed as a temporary structure but remained in service for 23 years.

• Inadequate inspections: Inspections relied on visual methods only and did not verify the condition of tab welds connecting the walkway to the living quarters.

• Insufficient structural support: The welded tabs at the connection points did not provide sufficient welded surface area for long-term structural support.

• Asymmetric support conditions: The stairway’s south side lacked support, potentially increasing stress on the walkway connections.

• Marine environment and aging: Corrosion and age-related fatigue affected the tab welds over time.

• Inspection management weaknesses: Inspection criteria were based on the original temporary classification and did not address corrosion, fatigue, or age-related deterioration.

Gaps in Available Information

The Safety Alert does not provide information on:

• Original design specifications and load calculations for the walkway and tab welds

• Material specifications and weld details (size, type, inspection class)

• Inspection frequency, inspection records, or acceptance criteria used over the 23-year period

• Whether any structural modifications or repairs were performed during service life

• Condition of adjacent structural members and secondary supports at the time of the incident

• Whether non-destructive testing had ever been performed on the living quarters or walkways

• Training or qualification requirements for personnel performing inspections

• Any prior indications of movement, cracking, or corrosion at the connection points

These gaps limit the ability to fully evaluate barrier performance and degradation mechanisms.

Regulations and Standards

Relevant regulations and standards associated with this incident include:

• 30 CFR 250 Subpart S – Safety and Environmental Management Systems

• API RP 2A – Planning, Designing, and Constructing Fixed Offshore Platforms

• API RP 2SIM – Structural Integrity Management of Fixed Offshore Structures

• API RP 2A-WSD / LRFD – Structural design and fatigue considerations

• AWS D1.1 – Structural Welding Code – Steel

• ISO 19901-6 – Offshore structures – Marine operations

These standards address structural design, fatigue, corrosion, inspection, and integrity management in offshore environments.

Elements Analysis (SEMS)

The following is an analysis of this Alert in the context of SEMS.

1. General

The incident highlights the risks associated with classifying structures as temporary without periodic reassessment when service life extends significantly beyond original intent.

2. Safety and Environmental Information

Structural information related to aging, corrosion susceptibility, and weld fatigue was not incorporated into inspection criteria.

3. Hazards Analysis

The hazard of structural failure of living quarters walkways was not adequately identified or re-evaluated over time as the structure aged.

4. Management of Change

Continued long-term use of a temporary living quarters structure constituted a change in service conditions that was not managed through a formal MOC process. A temporary change was covertly transformed into a permanent change.

5. Operating Procedures

Procedures governing inspection and maintenance did not address age-related degradation or structural support adequacy.

6. Safe Work Practices

Personnel were exposed to fall and dropped-object hazards due to compromised structural integrity of access walkways.

7. Training

The Alert does not indicate whether inspectors were trained to recognize structural degradation mechanisms beyond surface-level corrosion.

8. Mechanical Integrity

Mechanical integrity assurance was insufficient for load-bearing structural components, particularly welded connections in a marine environment.

9. Pre-startup Review

No evidence is provided that a pre-startup or re-commissioning review was conducted as the structure transitioned to long-term service.

10. Emergency Response and Control

Post-incident actions were effective in securing the area and preventing further movement or dropped objects.

11. Investigation of Incidents

The incident investigation identified design intent, inspection inadequacies, and environmental degradation as contributing factors.

12. Auditing

The incident suggests weaknesses in auditing inspection programs for temporary structures remaining in service.

13. Recordkeeping

Inspection records and documentation related to weld condition and structural integrity are not described.

14. Stop Work Authority

No information is provided on whether SWA was exercised prior to the incident based on observed conditions.

15. Ultimate Work Authority

The Alert does not address UWA decisions related to continued operation of aging temporary structures.

16. Employee Participation Plan

There is no information on worker involvement in identifying or reporting concerns related to the walkway condition.

17. Reporting Unsafe Working Conditions

The Alert does not indicate whether any prior concerns about the walkway or living quarters structure had been reported.

Priority SEMS Elements

These elements show the strongest linkage to the incident and offer the greatest potential risk reduction.

Mechanical Integrity

This element is central to the incident, as the failure involved load-bearing welded connections affected by corrosion and fatigue over time. Improved integrity assurance could directly reduce the risk of structural separation.

Management of Change

The prolonged use of a temporary structure represents a significant change in operating conditions. Formal MOC could have triggered reassessment of design assumptions, inspection criteria, and service life.

The following passage from the book Process Safety Management illustrates the challenges to do with temporary changes that do not ‘know’ that they are temporary.

Temporary Changes

Temporary changes have a built-in termination date or time. Changes of this type are often implemented to keep the operation running while a piece of equipment is repaired or replaced.

From a safety and operational point of view, whether a change is permanent or temporary is merely a semantic matter — the system itself does not know or care that a change is intended to be temporary. Therefore, the fact that a proposed change is defined as being temporary does not mean that it can be handled less rigorously than a permanent change. Yet, because of the short duration of many temporary changes, the personnel implementing them may be tempted to take short cuts, particularly if going through the MOC process takes longer than actually making the change itself. There is a temptation to take an attitude of, ‘Let’s just get on with it — why bother spending hours writing and reviewing an operation that will only take a few minutes to carry out? We don’t have time for all this bureaucracy.’

Although it is easy to reproach someone who takes this point of view, it has to be recognized that temporary changes often need to be implemented quickly in order to avoid more serious problems from developing. Indeed, many temporary changes are also emergency changes.

An example of a situation that can tempt personnel to take an unacceptable short cut is shown in Figure 14.2. A hazardous chemical is leaking to the atmosphere through a control valve’s packing. Operations management decides to run a hose bypass around the valve, and to control the flow rate using a manual valve. The leaking control valve can then be blocked in and repaired.

Figure 14.2
Example of Temporary Change

This repair activity may take no more than 30 minutes. Yet it is a new operation, so the system has changed and the Management of Change process needs to be followed, even though doing so could take hours, far longer than the change itself. The following are part of the management of this temporary change.

• Conduct a safety analysis — probably using some type of What-If method. The analysis should focus on the feasibility of controlling the flow of chemical using a manually-operated block valve.

• Write a temporary operating procedure.

• Train the operators in the new procedure.

• Prepare an emergency response plan in case the modification does not work properly.

• Make sure that the temporary hose is removed once the repair work is complete, that all valves are returned to their normal position, and that blinds are installed on the bypass block valves.

It is important to distinguish between true Temporary Changes and those changes that have occurred at least once before and that are repeated at infrequent intervals. Such changes are ‘Infrequent Repeat Changes’. If the change has been carried out before, and if it was properly managed, then, strictly speaking, it does not need to be put through the Management of Change system when it is carried out a second time.

This approach to the management of infrequent repeat change is only valid, however, if the change, when it was previously made, was properly controlled and documented. If the records are inadequate or incomplete then the Management of Change process will have to be implemented a second time. People may have memories as to what was done, but this is not sufficient; the information must be written down. Moreover, if the change has not been implemented for some time, there is a good chance that not all of the current personnel will have been trained to operate the facility in the new mode. Hence, in this situation, it is best to treat the change as if it is entirely new, and to train people again.

Hazards Analysis

A revalidated hazards analysis accounting for aging, environmental exposure, and altered service life could have identified the risk of walkway separation and informed preventive measures.

Economic Impact

Capital Impacts

• Repair or replacement of walkways, stairways, and welded connections

• Potential retrofit or replacement of temporary living quarters

• Engineering assessments and structural redesign costs

Operational Impacts

• Temporary loss of access to living quarters or reduced bed capacity

• Work stoppages during investigation and remediation

• Increased inspection and maintenance requirements

Industry-Level Impacts

• Higher lifecycle costs for temporary structures retained in long-term service

• Increased scrutiny of living quarters and access structures

• Potential revisions to inspection programs and integrity management practices

The Quiz

1. What event initiated Safety Alert 513?
A. Separation of an exterior walkway from living quarters
B. Failure of a crane walkway
C. Collapse of a stairway ladder
D. Failure of an exterior walkway handrail

2. How many workers were on the walkway at the time of the incident?
A. One
B. Two
C. Three
D. Four

3. What was the original design intent of the living quarters?
A. Permanent installation
B. Modular emergency shelter
C. Temporary housing
D. Floating accommodation unit

4. How long did the temporary living quarters remain in service?
A. 5 years
B. 10 years
C. 15 years
D. 23 years

5. What type of inspections were primarily used?
A. Ultrasonic testing
B. Radiographic testing
C. Visual inspections only
D. Acoustic emission testing

6. Which structural component was specifically identified as degraded?
A. Bolted flange connections
B. Tab welds connecting the walkway
C. Handrail posts
D. Deck plating

7. Which environmental factor contributed to the degradation?
A. High temperatures
B. Sand erosion
C. Marine corrosion
D. Seismic loading

8. Which SEMS element most directly relates to ensuring weld condition and support adequacy?
A. Training
B. Mechanical Integrity
C. Emergency Response
D. Recordkeeping

9. What action was taken immediately after confirming worker safety?
A. Walkway removal
B. Evacuation of the platform
C. Securing the walkway with chain bindings
D. Welding repairs

10. Which issue limited the effectiveness of the inspection program?
A. Lack of inspection personnel
B. Excessive inspection frequency
C. Inspection criteria based on temporary design intent
D. Use of third-party inspectors

Answer Key

1. A

2. C

3. C

4. D

5. C

6. B

7. C

8. B

9. C

10. C

Subscribe now

Last December we published the book Process Safety Management. Before that we published Plant Design and Operations. We are now working on the third book in this series: System Reliability: Decision Making in an Age of AI. An introduction to the series is provided here.

This new book is very much a work in progress. Nevertheless, we have releasing draft materials in order to encourage feedback and discussion. Please provide your comments.

Chapter 1

The first set of released materials will be four sections from Chapter 1: Boundaries and Outcome. There are four download modules:

• Chapter 1a

• Chapter 1b

• Chapter 1c

• Chapter 1d

The current Table of Contents for Chapter 1 is shown below.

Chapter 1 — Boundaries and Outcome
Overview
Book Structure
Book Series
The Ethical Core
Benefits of Improved Availability
Optimum Reliability
Production and Profitability
Lower Maintenance Costs
Customer Satisfaction and Public Relations
Personal Benefits
Worked Examples
Pump System
Heat Exchanger

Overview of Chapter 1

Chapter 1 introduces a central idea of this book: that industrial performance is governed by two fundamentally different types of constraint. Safety and environmental protection define the boundaries within which a facility must operate. These boundaries are non-negotiable and reflect ethical, regulatory, and societal expectations. Within those constraints, the primary determinant of outcome is system availability — the ability of the facility to operate as intended, when required, and to recover quickly from disruption.

The chapter distinguishes between external factors that are largely beyond management control, such as market prices and input costs, and internal factors — reliability, maintenance, operations, and organizational effectiveness — that directly influence availability. It shows how these internal variables shape both production and cost, and therefore overall financial performance.

Although safety and availability both involve the management of risk, they are not the same type of problem. Safety decisions are constrained by ethical considerations and do not lend themselves to simple optimization. In contrast, availability can be analyzed, managed, and improved using economic and engineering principles.

The chapter concludes by outlining the structure of the book and introducing two worked examples that are used throughout to illustrate key concepts.

In other words:

Safety defines the boundaries.
System availability defines the outcome.

Subscribe now

Last December we published the book Process Safety Management. Before that we published Plant Design and Operations. We are now working on the third book in this series: System Reliability: Decision Making in an Age of AI. An introduction to the series is provided here.

Chapter 1

This new book is very much a work in progress. Nevertheless, we have releasing draft materials in order to encourage feedback and discussion. The first set of released materials will be four sections from Chapter 1: ‘Boundaries and Outcome’.

These sections will be available for free download. (It is possible to make a financial contribution.)

This first section of Chapter 1 can be downloaded here. The suggested amount is $0.99. It is an Overview of the chapter’s contents. It is also shown below.

Overview

This chapter introduces a central idea of this book: that industrial performance is governed by two fundamentally different types of constraint. Safety and environmental protection define the boundaries within which a facility must operate. These boundaries are non-negotiable and reflect ethical, regulatory, and societal expectations. Within those constraints, the primary determinant of outcome is system availability — the ability of the facility to operate as intended, when required, and to recover quickly from disruption.

The chapter distinguishes between external factors that are largely beyond management control, such as market prices and input costs, and internal factors — reliability, maintenance, operations, and organizational effectiveness — that directly influence availability. It shows how these internal variables shape both production and cost, and therefore overall financial performance.

Although safety and availability both involve the management of risk, they are not the same type of problem. Safety decisions are constrained by ethical considerations and do not lend themselves to simple optimization. In contrast, availability can be analyzed, managed, and improved using economic and engineering principles.

The chapter concludes by outlining the structure of the book and introducing two worked examples that are used throughout to illustrate key concepts.

In other words:

Safety defines the boundaries.
System availability defines the outcome.

Subscribe now

Boundaries

We have just published the book Process Safety Management (PSM). We are now beginning the next book in the series; it has the working title System Reliability: Decision Making in an Age of AI.

This new work grows directly out of the first. Process Safety Management addressed risk in its most critical form: the risk of harm to people, the environment, and the facility. Its focus was on the prevention of catastrophic events and on the management systems required to keep industrial operations within safe limits.

The new book addresses a different type of risk. Whereas PSM focuses on safety, System Reliability is concerned with operability, profitability, and sustained performance. The central question is not whether a facility can be operated safely — that is a prerequisite — but whether it can be operated effectively, consistently, and economically over time.

To reiterate: safety and environmental performance are non-negotiable. They are go/no-go conditions. A facility that does not meet these standards should not operate.

These requirements establish the boundaries within which all other decisions must be made.

Once those boundaries are established, management attention shifts to performance. In other words:

Levers of Control

Many of the variables that influence financial outcomes lie outside the direct control of line managers, engineers, and operations leaders. Commodity prices, energy costs, labor agreements, interest rates, and regulatory frameworks are generally already determined. They define the economic environment, but they are not directly controlled by the operating organization.

In contrast, the internal performance of the facility is controllable. The ability to operate when required — and to recover rapidly when disruptions occur — is shaped by decisions made within the organization. These include:

• Equipment reliability and failure frequency

• Maintenance quality and timeliness

• Effectiveness of fault detection and diagnosis

• Shutdown and restart execution

• Inspection and turnaround planning

• Operator competence and procedural discipline

Taken together, these factors define system availability: the fraction of time that the facility operates as intended.

Availability and Profitability

Once market conditions and economic factors are often set externally, total revenue over time is directly proportional to uptime. A facility that runs well, runs steadily, and returns quickly from disruption will generally outperform one that suffers repeated interruptions, slow recovery, and degraded operating discipline. Poor availability also drives costs upward through inefficiency, repeated failures, and equipment deterioration.

For that reason, system availability is not merely a technical measure. It is a management outcome. It reflects how well an organization designs, operates, maintains, and improves its assets. It is also the primary lever through which many industrial organizations can influence profitability in a world where so many other economic variables are outside their control.

This Series

This Substack series will develop in a structured way, following the framework of the book while allowing for commentary, examples, and practical application.

Topics will include:

• Definitions and framework

• Failure modes and equipment behavior

• System availability and performance metrics

• Management systems and decision-making

• Operations, maintenance, and inspection

• Human factors and organizational performance

• Projects and design

• The role of artificial intelligence in industrial systems

The objective is practical. These posts are written for managers, engineers, and regulators responsible for the performance of complex industrial systems. The emphasis will be on decisions: how they are made, how they fail, and how they can be improved.

Subscribe now

The CCPS (Center for Chemical Process Safety) has published the April 2026 Process Safety Beacon: ‘Emergency Response System Saves Lives’ at https://ccps.aiche.org/resources/process-safety-beacon/archives/2026/april/english. This Beacon describes an ammonia release incident where deficiencies in emergency response systems, alarms, and procedures led to worker exposure and injuries.

The incident demonstrates that emergency preparedness must be integrated, comprehensive, scenario-based, and regularly practiced. Systems must ensure timely detection, communication of potential emergencies. They should also provide appropriate protective actions (shelter-in-place vs. evacuation).

Effective process safety requires not only identifying hazards but ensuring that detection, alarms, procedures, and training work together to protect personnel during abnormal situations.

The following is an analysis of the Beacon using the ‘top three’ of the 20 elements of process safety as defined by the CCPS.

PSM Elements

In this series of posts we evaluate incidents for process safety insights using the management elements defined by the Center for Chemical Process Safety (CCPS). The elements are:

1. Process Safety Culture

2. Compliance

3. Competence

4. Workforce Involvement

5. Stakeholder Outreach

6. Knowledge Management

7. Hazard Identification and Risk Management

8. Operating Procedures

9. Safe Work Practices

10. Asset Integrity / Reliability

11. Contractor Management

12. Training / Performance

13. Management of Change

14. Operational Readiness

15. Conduct of Operations

16. Emergency Management

17. Incident Investigation

18. Measurement and Metrics

19. Auditing

20. Management Review

The ‘Top Three’

Of the elements listed, the following are particularly pertinent to this incident.

Emergency Management

This is the most prominent element. The Beacon highlights several critical gaps:

• The emergency action plan did not address all credible scenarios, particularly outdoor ammonia releases.

• There was no effective site-wide alarm to notify all personnel.

• Evacuation guidance was unclear, resulting in some workers moving toward the hazard.

• Emergency drills were insufficient in scope and realism.

Hazard Identification and Risk Management

The failure to anticipate and plan for an outdoor ammonia release indicates gaps in hazard identification:

• The overpressurization scenario and relief discharge location were known hazards but not fully evaluated for consequences to personnel.

• Hazard assessments did not adequately consider how released ammonia could impact evacuation routes or assembly areas.

• Safeguards (alarms, procedures) were not aligned with the identified hazards.

A more robust hazard analysis would have identified the need for integrated detection and alarm systems and safe evacuation planning.

Asset Integrity / Reliability

Equipment functioned as designed (for example, the pressure relief valve opened), but system-level reliability was inadequate:

• Gas detection systems were not fully integrated (indoor vs. outdoor detection not linked to alarms).

• Alarm systems were not designed to ensure full-site coverage.

• Critical safeguards (detection, alarms, shutdown options) were either unavailable or not used.

This reflects a gap in ensuring that safety-critical systems are properly designed, installed, connected, and maintained to perform their intended protective functions.

Other Relevant CCPS Elements

The three elements just discussed are the ‘top three’. However, the following elements should be considered.

Operating Procedures

Emergency shutdown procedures existed but were not used. This suggests either lack of clarity, accessibility, or confidence in procedures.

Safe Work Practices

Evacuation practices were not clearly defined or understood, particularly regarding wind direction and hazard zones.

Training / Performance

Workers were not adequately trained to interpret alarms, understand ammonia hazards, or choose appropriate protective actions (evacuate vs. shelter-in-place).

Knowledge Management

Information about the outdoor release detection system and its limitations was not effectively communicated or retained within the organization.

Management of Change

Not clearly indicated, but if detection or alarm systems were modified or expanded over time without full integration, MOC may have been insufficient.

Conduct of Operations

Breakdowns in communication (verbal evacuation orders only) and lack of practice in the use of alarms indicate weaknesses in operational discipline.

Incident Investigation

The Beacon itself reflects learning after the event; however, prior near misses or system weaknesses may not have been fully captured or acted upon.

Measurement and Metrics

No indication that leading indicators (e.g., alarm system coverage, drill effectiveness) were tracked.

Auditing

Gaps in emergency preparedness and alarm integration suggest audits did not identify or address these deficiencies.

Management Review

Senior leadership oversight may not have fully evaluated the effectiveness of emergency systems and preparedness.

Less Relevant Elements

Not all of the CCPS elements apply to this incident, at least based on the information provided in the Bulletin.

Compliance

Not explicitly discussed, though regulatory compliance may be indirectly implicated.

Competence

While training gaps exist, the competence of individuals was not called into question.

Workforce Involvement

No specific indication of worker participation in planning or drills.

Stakeholder Outreach

No reference to community or external stakeholder engagement.

Contractor Management

Not relevant to this incident.

Operational Readiness

There are no indications this incident was related to startup or commissioning.

Subscribe now

The latest Process Safety Beacon (March 2026) is Decontaminate Processes Before Opening! It describes an incident in which a contractor was exposed to a small quantity of hydrogen fluoride (HF). The injured person (IP) was hospitalized, but recovered.

PSM Elements

In this series of posts we evaluate incidents for process safety insights using the management elements defined by the Center for Chemical Process Safety (CCPS). The elements are:

1. Process Safety Culture

2. Compliance

3. Competence

4. Workforce Involvement

5. Stakeholder Outreach

6. Knowledge Management

7. Hazard Identification and Risk Management

8. Operating Procedures

9. Safe Work Practices

10. Asset Integrity / Reliability

11. Contractor Management

12. Training / Performance

13. Management of Change

14. Operational Readiness

15. Conduct of Operations

16. Emergency Management

17. Incident Investigation

18. Measurement and Metrics

19. Auditing

20. Management Review

The ‘Top Three’

Of the elements listed, the following are particularly pertinent to this incident.

7. Hazard Identification and Risk Management

There was a failure to fully identify and control hazards within the system.

• A dead-leg section of piping was not included in the decontamination scope.

• Residual hydrogen fluoride (HF) remained in the system, creating an unseen hazard.

• The isolation boundary was incorrectly assumed to encompass all hazardous material.

9. Safe Work Practices

Breakdowns in safe work execution directly contributed to the exposure.

• The system was declared ‘proven empty’ without full verification.

• PPE (Personal Protective Equipment) was downgraded prematurely from Level B to Level D.

• Line opening occurred without confirming that all sections were decontaminated.

6. Knowledge Management

Incomplete and unavailable system information was a key contributing factor. Gaps in process knowledge and documentation led directly to missed hazards and ineffective decontamination.

• The operator did not have all relevant piping drawings.

• The decontamination plan was therefore incomplete.

• System complexity (e.g., dead legs) was not fully understood or documented.

Subscribe now

A recent edition of Pipeline & Gas Journal featured an article ‘Golden Pass LNG Produces First LNG from Train 1 at Sabine Pass’.

I worked on that project in its early days. One memory is a safety incident that occurred during construction, and the manner in which the owner/operator (ExxonMobil) responded.

The Incident

A contractor drove into the facility with a raised bed dump truck containing gravel. He went to the designated area and elevated the truck bed so that the gravel slid out on to the ground.

Some of the gravel did not move, so a worker climbed into the bed of the truck ― while it was still raised ― in order to loosen the stuck material.

An ExxonMobil employee witnessed this event (which was a near-miss, the worker was not injured). That employee called an ‘organizational time out’. Management stopped all work and instructed everyone at the site to attend stand-down safety meetings that lasted for almost two hours. (I had just arrived on site in order to lead a safety study. Therefore, my first task was to lead one of those meetings.)

The company’s decision was expensive ― halting a world-scale project for two hours was a non-trivial decision. But the message was clear: safety was not just a slogan, it was a financial commitment.

More broadly, the management response to this incident illustrated,

• Hazards analysis at the company was an on-going and active process. It was not something confined to safety meetings, top-down reviews and audits. Hazards analysis was part of on-going daily work.

• The employee who spotted the infraction was not afraid to speak up. The company was open to feedback.

• Management was willing to spend serious money on safety ― their commitment went beyond rhetoric, slogans and mission statements.

Culture

The term ‘safety culture’ is frequently used, but it is hard to define. Everyone knows it when they see it, but they have difficulty explaining it. Incidents such as this help us understand what a safety culture looks like.

A real safety culture is visible when:

• Unsafe acts are challenged immediately;

• Authority to intervene is exercised without hesitation;

• Production/project pressure does not override caution; and

• Management accepts real cost in order to reinforce safe behavior.

Subscribe now

The material in this post is taken from Chapter 1 ― the Process Safety Management of the book Process Safety Management.

Read more

The material in this post is taken from Chapter 1 ― the Process Safety Management of the book Process Safety Management.

Read more

AI is moving rapidly from novelty to part of process safety management infrastructure. In the energy and process industries, adoption is accelerating in areas such as predictive maintenance, anomaly detection, operator support, and document analysis. Many professionals therefore see AI as a way to make facilities safer and more reliable.

That promise deserves careful scrutiny.

Process safety management (PSM) is not solved by data alone. It is a socio-technical discipline built on hazard recognition, conservative design, human judgment, and organizational memory. AI can strengthen the discipline, but only if its limitations are understood and managed explicitly.

Ultimately, PSM is a governance and human-performance discipline. AI is a tool inside the discipline — it is not an external tool.

Where AI Can Add Real Value

AI is well suited to tasks that involve large volumes of data, pattern recognition, and weak-signal detection. In the context of process safety, several applications are genuinely valuable, especially when AI is used to inform people rather than replace them.

Read more