Recommended resources
The freely available resources this lesson will direct you to.
Hello again. Last lesson identified the hazards around a separator level transmitter: process fluid, trapped pressure, electrical energy, and potentially toxic or flammable gas. Identifying them is only the first step. Before work begins, someone must decide how exposure will be prevented, not merely list the hazards on a form.
This lesson introduces the hierarchy of controls and applies it to a simulated instrumentation task. You will compare ways to avoid the hazardous work, change the method, physically separate people from hazards, govern the work, and protect against remaining exposure. Allow about 40 minutes, including the video and reading. This is a method for proposing controls under supervision, not authorization to work on operating equipment.
Why the order of controls matters
The hierarchy ranks controls by how directly they deal with a hazard. A measure that removes the need to encounter a hazard is generally more dependable than one that works only if a person remembers an instruction or wears equipment correctly.
Watch HIERARCHY of CONTROL Health and Safety | 5 Steps EXPLAIN! from Safeti for a short overview. Its examples are not from instrumentation work; focus on the difference between changing the source of danger, separating someone from it, and asking someone to work around it.
HIERARCHY of CONTROL Health and Safety | 5 Steps EXPLAINED!
Watch the five levels explained in sequence to establish the ranking before applying it to a plant task.
Watch the ranking and elimination, substitution and barriers, then procedures and PPE. Notice that a warning tells you about a hazard; it does not physically prevent exposure.
The diagram below gives you a reference for that ranking. It places elimination and substitution together at the top, although they are distinct choices: elimination removes the hazard from the work; substitution replaces something hazardous with a less hazardous alternative.
Consider what each level could mean for a transmitter task:
- Elimination: If the immediate question can be answered from an existing control-room trend, the initial investigation need not take anyone to the field transmitter. This eliminates field exposure for that step, not the plant hazard or the need for any later repair.
- Substitution: If an invasive diagnostic method was proposed, an approved non-invasive method may answer the same question with less chance of a release. It must actually provide adequate diagnostic information; a safer method that cannot answer the question is not a complete substitute.
- Engineering controls: A suitably designed enclosure, physical barrier, or closed diagnostic connection can prevent contact with a hazard while allowing work. For maintenance that requires opening a process connection, an approved, verified physical isolation and removal of stored pressure are essential physical protections; the accompanying rules and checks are also necessary.
- Administrative controls: A task assessment, authorization, procedures, warnings, supervision, and work coordination govern what people do. They do not, on their own, contain process fluid or de-energize a circuit.
- Personal protective equipment (PPE): Specified eye, hand, body, or other protection reduces certain consequences if exposure occurs. It does not prevent a pressurized release or make a hazardous atmosphere safe to enter.
The order is a selection guide, not a rule to use only one level. An engineering control may need inspection and a procedure to keep it effective; appropriate PPE may still be required. Conversely, adding more instructions and PPE does not compensate for an absent physical control when the task calls for one.
Choose controls for a defined task, not a hazard label
“Pressure hazard—wear gloves” is a weak control proposal. It gives no source, task step, or explanation of how gloves would prevent a pressure release. A useful proposal begins with a narrower statement: opening the separator transmitter’s process connection could release trapped, pressurized fluid toward the worker. You can then ask whether that opening is needed at all. If it is, you can identify what must physically prevent a release, how that protection will be established and verified, and what exposure may remain.
Read OSHA’s Identifying Hazard Control Options: The Hierarchy of Controls. It explains both the ranking and why a combination of measures is often required.
[PDF] Identifying Hazard Control Options: The Hierarchy of Controls - OSHA
Read OSHA’s short worksheet guidance to connect each control level to a decision about feasibility and effectiveness.
On pp. 1–2, begin under “What Is the Hierarchy of Controls?” and continue through the “Personal Protective Equipment” examples. Read the five levels, noting which controls change the hazard or workplace and which depend principally on worker action. Then, on pp. 2–3, read “What Are Feasible Controls?” and “How Can You Use the Hierarchy of Controls?” from feasibility to selection. Focus on the questions about whether a control is right for the hazard, reliable, implementable, and compliant with workplace requirements.
A practical way to use the hierarchy is to work through four decisions in order:
- Define the step and exposure route. Is the work limited to reviewing a trend, does it require approaching the transmitter, or might it involve opening a connection? These are different tasks with different exposure paths.
- Ask whether the hazardous step can be avoided or made less hazardous. Do not assume that opening equipment is necessary merely because it appears on an initial work request.
- Select physical protections for hazards that remain, then the procedures and PPE needed to establish, maintain, and supplement those protections.
- Check what the proposal leaves unresolved. Is the protection suitable for this service? Can its state be verified? Does the changed method introduce another hazard? Is the task still within its authorized scope?
Feasibility does not mean choosing the quickest available option. A control must be appropriate to the possible consequences and to site requirements. If a proposed control cannot be provided or verified, the answer is not to quietly move down the pyramid and proceed; the task or plan needs review.
Apply the hierarchy to the separator transmitter
Return to the unreliable level indication. At present, the request is to investigate; it has not established that a process connection or junction box must be opened. The separator is operating, and neither isolation nor atmospheric conditions have been confirmed.
Begin by narrowing the task. A supervisor might arrange review of existing trends, related indications, and available diagnostics before field work. If those records answer the immediate question, there is no reason to expose someone to the field hazards for that investigative step. If a field inspection is still needed, a visual check that does not disturb connections has a different control plan from intrusive maintenance. A change from inspection to opening equipment is a change of scope, not a natural next step to take without further review.
Suppose the investigation eventually shows that a qualified team must work on the transmitter connection. The hierarchy now produces a set of controls rather than a single entry on a form:
| Hazard during the proposed work | Higher-level control to consider | Supporting controls and remaining concern |
|---|---|---|
| Pressurized process fluid at the connection | Avoid opening it if a suitable diagnostic method exists. If opening is necessary, use the site-approved physical isolation and means of removing stored pressure, with their condition verified before disturbance. | Authorization, an isolation procedure, supervision, and specified splash protection support the physical controls. A valve’s position or a remote pressure reading alone does not prove the particular connection is safe. |
| Flammable or toxic atmosphere from a possible release | Prevent the release through a suitable closed arrangement and effective process controls. Where applicable, engineered ventilation or separation must be appropriate to the location and service. | Site-required atmospheric assessment, gas testing, work restrictions, and response arrangements address remaining uncertainty. A detector warns of a condition; it does not prevent the release. Ordinary PPE does not make an unsafe atmosphere safe. |
| Electrical energy or ignition at the junction box | Avoid opening it if existing diagnostics suffice. If electrical access is necessary, use the approved means of controlling the circuit’s energy and equipment suitable for its installed environment. | Qualified personnel, authorization, verification, and specified protective equipment remain necessary. An enclosure label does not, by itself, authorize energized work or opening in a potentially flammable atmosphere. |
Notice the wording in the middle column: these are controls to consider and establish, not claims that an isolation, ventilation system, or suitable electrical arrangement is already present. The person planning the job must confirm the actual equipment and site procedures. As a trainee, your useful contribution is to identify the exposure route and raise any missing or unverified protection; it is not to improvise an isolation or test by loosening a fitting.
Controls can also create new questions. Moving an inspection to a remote indication may avoid one field visit, but is that indication reliable enough to answer the diagnostic question? Adding a temporary enclosure may separate a worker from one hazard but restrict access or ventilation. Replacing a cleaning product, if cleaning is part of the task, may reduce one chemical hazard but introduce compatibility concerns. Check the changed task, rather than assuming that a higher-ranked label guarantees a safe result.
What a defensible proposal sounds like
A control proposal should state what the measure does. Compare these two notes for the same possible connection work:
Too vague: “Pressure and gas hazards. Follow procedure and wear PPE.”
Useful for planning: “Do not open the transmitter process connection for the initial indication check; first use available non-invasive information. If connection work proves necessary, stop and have the work scope reviewed. Before any disturbance, the responsible team must establish and verify the site-required process controls for that connection and address possible atmospheric exposure. Apply the required authorization, testing, supervision, and PPE for the approved task.”
The second note neither assumes that the task is safe nor prescribes an unauthorized field operation. It distinguishes avoiding the exposure, physically controlling hazards that cannot be avoided, and supporting those controls through work rules and protective equipment. It also marks the point where uncertainty requires a decision by the responsible team.
Key takeaways
Use the hierarchy from the top: ask whether a hazardous step is needed, whether a less hazardous method works, and what physical protections are required before relying on procedures or PPE. Select controls for a specific task step and exposure route, and check that each proposed measure is suitable, verifiable, and does not introduce an overlooked hazard. Several levels will often work together, but a lower-level measure is not a substitute for a missing critical control.
Next, you will examine the permit-to-work sequence: how a planned task and its controls are reviewed, authorized, communicated, and carried out under site procedures and supervision.