ModulesProcess Safety InformationProcess Safety
The information the plant runs on, pointed to, not copied.One register per unit, and limits that change only with an approved MOC.
For process safety engineers and unit owners: answer each item with the document, study or barrier that holds it, or mark it not applicable with a reason. Then publish the limits operators read, mode by mode.
| Variable | Limit | Mode | Class | Consequence of deviation | Steps | Time | Basis | Source | Protection beyond |
|---|---|---|---|---|---|---|---|---|---|
V-201 · Pressure · Upper | 17.5 bar g | Normal | Safe operating limit | Overpressure of V-201 toward the PSV-201 set pressure; rupture and propane fire if relief fails |
| 10 min | DS-V201 · rev D | HAZOP-0007 · Node 2 · More pressure | BE-0012 · In place |
V-201 · Level · Upper | 80 % | Normal | Safe operating limit | Liquid carry-over into the vapour header; liquid propane reaches the users |
| 15 min | DS-V201 · rev D | HAZOP-0007 · Node 2 · High level | BE-0015 · Impaired |
V-201 · Temperature · LowerNo time to consequenceNo source scenario | −5 °C | Start-up | Critical integrity window | Shell below its minimum design metal temperature; brittle fracture |
| — | DS-V201 · rev D | — | — |
One unit, three views of the same record. An example unit; the fields are the product’s, the values illustrative.
Where it connects
On the same loop: Document Manager, Barrier Management, Chemical Management and 38 more modules in one workspace.
Method note
Limits from the HAZOP, or from the design basis? Both schools are right.
Operations teams start from the scenarios. Engineering teams start from the data sheets. Neither list is complete on its own.
Leandro · Founder, UProcess
One school derives each safe operating limit from a HAZOP deviation, so the consequence and the time to act are already argued. The other starts from the design basis, the vessel data sheet or the relief case, so every number has a document behind it. A limit with neither is a guess; a limit with only one is half a case.
So each row can carry its scenario, its basis, or both, and the checks say which one is missing.
- From the HAZOPDeviations with a parameter propose rows through a preview, with the scenario consequence as starting text.
- From the basisThe row cites the document that sets the number, at the revision in force.
- Both on one rowSource scenario and basis side by side, for the limits an auditor will open first.
Where Process Safety Information usually breaks
Four places the information a plant runs on goes wrong, and what the register does about each.
A limit for normal running, none for the mode you are in.
The CSB found a refinery’s fluid catalytic cracker running in an abnormal mode with no pre-established safe operating limits and no criteria for when to shut it down.
Source: U.S. Chemical Safety Board, ExxonMobil Torrance
In UProcess Every limit row names its operating mode from your company’s list. A row cannot be published without a value, the consequence of deviation and the steps to take.
V-201 · pressure · upper · by mode
- Normal
- 17.5 bar g · Safe operating limit
- Start-up
- 16.0 bar g · Safe operating limit
- Shutdown
- No row yet
A row publishes only with a value, the consequence of deviation and the steps.
The drawing on file is not the plant in the field.
A CCPS Beacon describes a fatal release where the P&ID left out a strainer, a check valve and isolation valves, so the PHA and its revalidation never saw the trapped-liquid hazard.
Source: CCPS Process Safety Beacon, July 2024
In UProcess Each register item points to the document in Document Manager and shows the revision in force, or that no revision is in force.
Register · Propane vaporizer area
The limits list grows, and stops being checked.
A refinery that set 645 safe operating limits across five units found some had no DCS pre-alarm configured, and planned a full reconciliation after two years of operation.
Source: CCPS Canadian regional meeting, NWR refinery
In UProcess Each row is checked as you write it: no time to consequence, no source scenario, no basis, or a limit sitting inside a lower class. The checks suggest; they never block.
Checks · V-201 · temperature · lower · start-up
Checks suggest. They never stop you saving.
The plant changed. The information did not.
The CSB found a unit restarted on a new control system with an unapproved, overly complex procedure, incomplete operator training and the pre-startup review unfinished.
Source: U.S. Chemical Safety Board, Bayer CropScience
In UProcess When an MOC touches what a unit documents, the unit lists the items to update. Items still open 30 days after the change is installed read late, and a changed or retired limit publishes only with an approved MOC.
MOC-2026-0031 · this unit
- 18 Sep 2026
- Change approved
- 2 Oct 2026
- Installed
- 14 Oct 2026
- Limits version 3 published with this MOC
- 1 Nov 2026
- P&ID and OP-012 updates late
Late is read from the dates. Nobody types it.
Unit Propane vaporizer area
| Version | Published | By | MOC | Added | Reworded | Limit changed | Retired |
|---|---|---|---|---|---|---|---|
| 1 | 3 Jun 2026 | Sarah Mitchell | — | 14 | 0 | 0 | 0 |
| 2 | 19 Aug 2026 | Sarah Mitchell | — | 2 | 3 | 0 | 0 |
| 3 | 14 Oct 2026 | David Chen | MOC-2026-0031 | 0 | 1 | 1 | 1 |
Reasons are kept per row. A changed or retired limit carries the MOC.
The record an auditor asks for.
What the operator read on a given day is a published version, not the latest edit.
- Every required item, answered by a pointer or marked not applicable, with who and why.
- Each limits version with its number, date, publisher and the MOC behind it.
- Row by row, what changed between versions: added, reworded, limit changed or retired, and the reason.
- The HAZOP studies that cover the unit, and the scenario each limit came from.
What’s in a unit register
- Structure
- Unit → register items from your company’s template → answers. One limits table per unit, kept as a draft and published as versions.
- Answers
- A document revision, a HAZOP study, a barrier element, a chemical record, the unit’s own limits, a reference in another system, or not applicable with a reason.
- Limit row
- Tag, parameter, direction, value and unit or a text limit, operating mode, class, consequence of deviation, steps, time to consequence, basis.
- Classes
- Ranked from safe operating limit down to normal operating range, as a company list. A check flags a higher class sitting inside a lower one for the same tag.
- Changes
- The MOC cases that touch the unit, each item resolved or dismissed with a reason, and late after a number of days your company sets.
Questions
Does UProcess keep a second copy of our P&IDs?
No. Document Manager holds the files and their revisions. The register points to the revision in force.
Can limits come from our HAZOP?
Yes. Deviations with a parameter, such as more pressure, propose rows through a preview. Nothing is created until you confirm.
What if the scenario behind a limit changes?
The row keeps a snapshot of its source and shows “Source changed”. You decide what to do with the new text.
Does every edit need an MOC?
No. Changing or retiring a published limit needs an approved MOC. An added or reworded row needs a written reason.