vaayaa Inclusive Education
Industrial risk assessment

Industrial Instrumentation and Plant Engineering Risk Assessment: Sensor, Control and Maintenance Hazards

A worked example of how a plant engineering team finds, scores and controls the risks from sensors, control loops, maintenance work and process hazards that threaten people, equipment and output.

Updated November 2026 8 hazards assessed Review every 6 months Highest risk: Critical to Medium
See the Industrial Instrumentation and Plant Engineering course

Executive summary

This assessment shows how a plant engineering team can find, rate and control the risks that arise from instruments, control loops, maintenance and operator actions. Eight risks were chosen because they are plausible in everyday plant work. Maintenance bypass and alarm response carry high inherent scores because a single error can expose people to a hazardous release. Sensor drift, specification mismatch and supplier substitution are also common and can quietly defeat protective functions. Each risk is scored before controls and again after existing and added controls. Most fall to Medium or Low once controls are in place, though the bypass risk stays at Medium because its consequence remains severe. The first actions are a bypass permit with timed removal, calibration verification of safety instruments, independent review of setpoint changes and an approved substitution rule for spares. The plant is a teaching example, so every score illustrates method rather than a real facility.

Focus area
Industrial instrumentation and plant engineering
Setting
Continuous process plant with field instruments, control systems and a maintenance team
Method
Five by five likelihood and severity risk register

Scope

This assessment covers the instrumentation, control and mechanical systems of one process plant, from field sensors and control loops to maintenance, commissioning and supplier support. It considers risks to people, equipment, product and the environment. The plant type, jurisdiction, process chemistry and system vendor are not specified, so they are treated as assumptions for teaching. It is not a formal site-specific assessment.

Context

The plant has several hundred field instruments, a distributed control system, a separate safety system and an in-house instrument technician team supported by outside contractors. Maintenance uses a computerized work order system and a calibration schedule. Engineering changes pass through a management of change routine. Each hazard is scored before controls to show natural exposure, then again after existing controls and added controls. Ratings are for learning and do not describe any real facility.

Objectives, assets and stakeholders

The objective is to keep people safe, keep the process within its design limits, protect equipment and product, meet environmental and legal duties, and deliver output reliably. The assets in scope are field instruments, transmitters, control valves, the distributed control system, the separate safety system, cabling and junction boxes, process piping and vessels, spares and calibration records. Stakeholders include plant operators, instrument technicians, maintenance crews, engineering and design staff, contractors, suppliers, site management, neighbors and regulators. Every risk has one owner role, and the plant manager reviews the register each quarter. Responsibility for safety functions stays with the people who hold the competence for them.

Risk matrix: before and after controls

Each cell shows hazard numbers placed by likelihood and impact. Compare the two grids to see how controls move each hazard.

Before controls

Inherent risk

Risk before controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely Likelihood 4, impact 3, score 12, high: H08 Likelihood 4, impact 4, score 16, high: H01 Likelihood 4, impact 5, score 20, critical: H03
3 Possible Likelihood 3, impact 3, score 9, medium: H06 Likelihood 3, impact 4, score 12, high: H05 Likelihood 3, impact 5, score 15, high: H02 H04
2 Unlikely Likelihood 2, impact 5, score 10, high: H07
1 Rare

After controls

Residual risk

Risk after controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely
3 Possible Likelihood 3, impact 2, score 6, medium: H08
2 Unlikely Likelihood 2, impact 2, score 4, low: H06 Likelihood 2, impact 3, score 6, medium: H01 H05 Likelihood 2, impact 4, score 8, medium: H02 H03
1 Rare Likelihood 1, impact 4, score 4, low: H07 Likelihood 1, impact 5, score 5, medium: H04
  • Low 1 to 4
  • Medium 5 to 9
  • High 10 to 16
  • Critical 17 to 25

Hazard register

A summary first, then the detail for each hazard.

Summary of hazards with scores before and after controls
No.HazardBeforeAfterOwner
H01 Sensor drift and calibration failure 16 High 6 Medium Instrument lead
H02 Setpoint or trip mismatch with the design specification 15 High 8 Medium Control systems engineer
H03 Maintenance bypass left in place during operation 20 Critical 8 Medium Operations manager
H04 Electrical installation defect in a hazardous area 15 High 5 Medium Electrical engineer
H05 Supplier component defect or unverified substitution 12 High 6 Medium Procurement lead
H06 Loss of instrument air or power supply 9 Medium 4 Low Utilities engineer
H07 Environmental release from a leaking connection 10 High 4 Low Environmental officer
H08 Alarm flooding and operator error under pressure 12 High 6 Medium Operations manager
H01

Sensor drift and calibration failure

Operational Before 16 After 6

Field transmitters and sensors drift out of calibration or fail silently, so the control system acts on readings that do not match the process.

Who or what is affected: Operators, instrument technicians, process safety and product quality teams

Causes

Process fouling, vibration, temperature swings and calibration done late or without a recorded check.

Consequences

Wrong control action, off-specification product, unsafe operating point and a delayed alarm.

Existing controls

  • Instruments are calibrated on a fixed schedule by the technician team.
  • Operators compare key readings with a manual check each shift.

Control gaps

Calibration records are kept, but drift between intervals is not trended or compared against redundant readings.

Additional controls

  • Prevent: Move safety-critical instruments to a risk-based calibration interval set by the instrument lead.
  • Detect: Compare redundant transmitters and flag any gap above the agreed tolerance to the control room.
Likelihood 4 x impact 4 before; 2 x 3 after Owner: Instrument lead Target: Within 60 days Early warning: Redundant transmitter readings that differ by more than the agreed tolerance for a shift.
H02

Setpoint or trip mismatch with the design specification

Technology and data Before 15 After 8

Alarm limits, trip setpoints or control logic differ from the approved design, so protection acts too late or too early during normal running.

Who or what is affected: Operators, process engineers, plant personnel and neighbors

Causes

Commissioning changes not carried into records, copied logic from another unit and rushed modifications.

Consequences

Protection that fails to act, nuisance trips, product loss and a hazardous excursion.

Existing controls

  • Setpoints are recorded in the design documents held by engineering.
  • Logic changes need sign off by the engineering manager.

Control gaps

Sign off checks the change request but not the live value after download to the controller.

Additional controls

  • Prevent: Compare the live configuration with the approved design file each quarter and after every change.
  • Detect: Run a version comparison on controller and safety logic after each maintenance visit.
Likelihood 3 x impact 5 before; 2 x 4 after Owner: Control systems engineer Target: Within 60 days Early warning: A live setpoint that does not match the approved design file at the quarterly comparison.
H03

Maintenance bypass left in place during operation

Safety Before 20 After 8

A trip or alarm is bypassed or overridden for testing or repair and is not restored, so the protective function is absent when a fault occurs.

Who or what is affected: Operators, maintenance crews, nearby workers and the surrounding community

Causes

Pressure to keep output running, unclear handover of permits and bypasses left in place after a test.

Consequences

Loss of protection during a fault, release of hazardous material, injury or fatality.

Existing controls

  • Bypasses need a written permit signed by the shift supervisor.
  • Overrides are shown on the control screen as a visible flag.

Control gaps

Permits are not linked to the control screen flags, so expired permits remain visible but are often unnoticed.

Additional controls

  • Prevent: Issue a timed bypass permit with a removal date and a named person who must confirm restoration.
  • Respond: Hold a shift handover check of all active bypasses and restore any that lack a current permit.
Likelihood 4 x impact 5 before; 2 x 4 after Owner: Operations manager Target: Within 30 days Early warning: Bypasses or overrides active for more than one shift without a documented reason.
H04

Electrical installation defect in a hazardous area

Safety Before 15 After 5

Wiring, junction boxes or enclosures in a classified area are damaged, unsealed or wrongly rated, so a spark or hot surface can ignite flammable material.

Who or what is affected: Electricians, instrument technicians, operators and the site

Causes

Damage during other work, corrosion, poor sealing after modification and inspections skipped.

Consequences

Fire, explosion, injury and extended plant shutdown.

Existing controls

  • Installations are inspected by a competent person before first use.
  • Enclosures are marked with the rating of the area they serve.

Control gaps

Inspections cover the main plant, but remote instrument junction boxes are often missed.

Additional controls

  • Prevent: Check cable glands, seals and enclosure ratings against the area classification during every planned maintenance visit.
  • Detect: Include wiring and seal condition in a scheduled inspection with dated photographic records.
Likelihood 3 x impact 5 before; 1 x 5 after Owner: Electrical engineer Target: Within 45 days Early warning: An open or damaged seal, or a missing rating label, found during a routine walk down.
H05

Supplier component defect or unverified substitution

Supplier Before 12 After 6

A spare or replacement instrument arrives with the wrong rating, a counterfeit part or an unnotified design change, and is installed without adequate checks.

Who or what is affected: Maintenance crews, operators and the plant process

Causes

Urgent repairs, limited approved sources and a supplier changing a part without notice.

Consequences

Early failure, unsafe operation, delay and cost of rework.

Existing controls

  • Approved suppliers are listed and reviewed by procurement each year.
  • Goods are checked on arrival against the purchase order quantity.

Control gaps

Certificates are filed but are not checked against the part number actually fitted.

Additional controls

  • Prevent: Require certificates of conformity and a written change notice for any substitution of a critical component.
  • Recover: Quarantine suspect spares and test a sample against the specification before fitting.
Likelihood 3 x impact 4 before; 2 x 3 after Owner: Procurement lead Target: Within 60 days Early warning: A part fitted with a number that differs from the approved spares list.
H06

Loss of instrument air or power supply

Operational Before 9 After 4

A failure of compressed air, uninterruptible power or communication links causes valves to move to fail positions and instruments to lose readings.

Who or what is affected: Operators, control room staff and the process

Causes

Compressor faults, power interruption, cable damage and backup batteries past their useful life.

Consequences

Uncontrolled process movement, shutdown and possible release.

Existing controls

  • Critical loops have fail safe valve positions designed in.
  • Backup power supplies run key control panels for a short period.

Control gaps

Backup run times are estimated from design figures and have not been tested under load.

Additional controls

  • Prevent: Check air receiver capacity and backup run time against the plan at each annual review.
  • Detect: Alarm low air pressure and loss of communication to the control room and to the instrument lead.
Likelihood 3 x impact 3 before; 2 x 2 after Owner: Utilities engineer Target: Within 90 days Early warning: Air receiver pressure falling below the alarm point during a normal shift.
H07

Environmental release from a leaking connection

Environmental Before 10 After 4

A small leak from a flange, drain, gland or sample point releases process fluid to ground, water or air before anyone notices it.

Who or what is affected: Operators, neighbors, wildlife and nearby water sources

Causes

Vibration, corrosion under insulation, aged gaskets and sample points left open after use.

Consequences

Contamination, regulator enquiry, clean-up cost and loss of local trust.

Existing controls

  • Routine walk downs check process connections each shift.
  • Drains are routed to a bunded collection sump.

Control gaps

Walk downs check visible leaks but not connections in insulated or hard to reach runs.

Additional controls

  • Prevent: Replace sample points and drains that lack double isolation or a suitable cap during planned work.
  • Respond: Keep spill kits and an isolation procedure at each sample point and rehearse them twice a year.
Likelihood 2 x impact 5 before; 1 x 4 after Owner: Environmental officer Target: Within 60 days Early warning: Staining, corrosion or residue found at a connection during a walk down.
H08

Alarm flooding and operator error under pressure

People Before 12 After 6

Too many alarms, unclear displays or fatigue cause an operator to miss or misread a warning and take the wrong action during an upset.

Who or what is affected: Control room operators, shift crews and the plant

Causes

Many alarms left at default values, shift changes, long hours and poor screen layout.

Consequences

Delayed response, wrong action, unsafe excursion and an incident.

Existing controls

  • Operators are trained on the control screens before working alone.
  • Critical alarms are shown in a separate priority list.

Control gaps

Alarm review happens after changes rather than on a fixed schedule, so nuisance alarms build up.

Additional controls

  • Prevent: Review alarm priorities and remove nuisance and duplicate alarms with the operators who receive them.
  • Detect: Record alarm floods and review each shift handover for missed or repeated alarms.
  • Recover: Run a refresher drill on upset response after any missed alarm event.
Likelihood 4 x impact 3 before; 3 x 2 after Owner: Operations manager Target: Within 90 days Early warning: More than the agreed number of alarms in ten minutes during an upset.

Rating method and evaluation

Each risk is rated on two five-point scales. Likelihood runs from Rare to Almost certain, and severity runs from Negligible to Catastrophic, with harm to people considered first, then process, equipment, environment and cost. Multiplying the two gives a score from 1 to 25, which falls into one of four bands: Low from 1 to 4, Medium from 5 to 9, High from 10 to 16 and Critical from 17 to 25. The score orders work and does not measure risk itself. Inherent risk is the score before any controls. Residual risk is the score after existing and added controls. Credit for a control is given only when it is verified, such as a tested trip, a completed calibration or a checked permit. Any Critical or High risk needs a dated plan approved by site management. Medium risks need routine controls with a named owner. Low risks are accepted and monitored. Operators, technicians and engineers challenge every rating at the monthly review, and a rating is reopened when a monitoring indicator reaches its escalation threshold or a management of change is raised.

Likelihood, impact and rating bands

Likelihood

  • 5 Almost certain: Expected to happen in most circumstances.
  • 4 Likely: Will probably happen in many circumstances.
  • 3 Possible: Could happen at some time.
  • 2 Unlikely: Not expected, but it could happen.
  • 1 Rare: Only in exceptional circumstances.

Impact

  • 1 Insignificant: No lasting effect. Handled within routine work.
  • 2 Minor: Small effect that is quickly corrected.
  • 3 Moderate: Noticeable effect that needs managed effort to correct.
  • 4 Major: Serious effect on people, delivery or reputation.
  • 5 Catastrophic: Severe or lasting effect that threatens the whole activity.

Bands (likelihood x impact)

  • Low (1 to 4): Accept and monitor.
  • Medium (5 to 9): Manage with routine controls.
  • High (10 to 16): Senior attention and a treatment plan.
  • Critical (17 to 25): Act first. Do not proceed until reduced.

Monitoring, escalation and review

Review this assessment every 6 months, and sooner when an indicator below reaches its threshold.

Early-warning indicators and escalation thresholds
Indicator to watchEscalate when
Bypasses or overrides active for more than one shift without a documented reason.Escalate to the operations manager at once, and to the plant manager if still active after one day.
Safety instruments with calibration overdue or results outside tolerance.Escalate to the instrument lead when any item is overdue, and to the engineering manager if a safety instrument fails verification.
Setpoint or logic changes made without a recorded independent review.Escalate to the engineering manager at once and hold the change until the review is complete.
Alarm rate per operator above the agreed limit during a normal shift.Escalate to the control systems engineer when the limit is exceeded for a week, and to the operations manager if operators report missed alarms.
Spare parts fitted that are not on the approved list or lack certificates.Escalate to the maintenance planner at once, and to the procurement lead if the supplier cannot provide evidence within one week.

Contingency arrangements

If a serious event occurs, such as a loss of containment, a spurious trip with injury or a bypass found in place during a fault, the shift supervisor makes the area safe, follows the emergency shutdown procedure and calls the emergency response team. Affected instruments are isolated and tagged, and no bypass is restored until the cause is verified. The plant manager informs the engineering lead and the regulator contact where the relevant rules require it. Spares are drawn from a verified store, and a temporary measurement plan keeps critical readings visible until repairs are proven.

Prioritized action plan

  1. Introduce a timed bypass permit with a removal log and shift handover check, owner operations manager, within 30 days.
  2. Verify safety instruments against the calibration schedule and record the results, owner instrument lead, within 60 days.
  3. Require independent review of every setpoint change through management of change, owner engineering manager, within 45 days.
  4. Set an approved spares list and a substitution rule for critical components, owner maintenance planner, within 60 days.
  5. Review alarm priorities and remove nuisance alarms during operator walk throughs, owner control systems engineer, within 90 days.

Conclusion

Reliable plant depends on a few steady habits: verified instruments, controlled bypasses, independent review of setpoint changes, approved spares and alarm design that supports people under pressure. The highest scores sit with bypass handling and alarm response, and each has actions that bring the residual score down. Treat the register as a living record, review it on the stated cycle and update it after every modification or incident. Seek qualified engineering and legal advice for any real design, safety or compliance question.

Assumptions and limitations

Assumptions

  • The plant handles hazardous materials under pressure and temperature, and the exact process is not specified.
  • The jurisdiction is not specified, so legal duties are described only in general terms.
  • Safety functions are implemented in a separate system with its own sensors, logic and final elements.
  • Contractors and the system vendor provide support under written agreements and keep their own competence records.

Limitations

  • The scores are examples for learning and do not describe any real plant or incident.
  • Instrumentation and process safety rules differ by country and change over time, so specialist review is needed.
  • This is educational content and does not replace a formal site-specific assessment or advice from a licensed engineer.

Related frameworks to study

  • Hierarchy of controls
  • Failure modes and effects analysis as a general method
  • Layers of protection thinking for independent safeguards
  • Management of change for engineering modifications
  • Preventive and condition-based maintenance planning

Industrial Risk Assessment

China, India, United States, Indonesia, Pakistan, Nigeria, Brazil, Bangladesh, Russia, Japan, Mexico, Philippines, Vietnam, Egypt, Turkey, Germany, United Kingdom, France, Italy, Canada, South Korea, Australia, Spain.

For Learning Reference Only: This assessment demonstrates how risk assessment principles are applied in a practical setting, providing a useful reference for learning and understanding. Actual assessments may be adapted to suit specific site conditions and circumstances.

Keep learning

Study the subject behind this assessment.

Industrial Instrumentation and Plant Engineering course Read the best practices for this course

More Industrial risk assessments

Hourly Active: 39,499 Learners