Chemical Plant Automation: DCS, Batch, Safety Systems and the Turnaround Window

In the chemical plants where we have worked as a contractor and systems integrator, we were allowed to change whatever control logic the job needed. Nobody asked for a change record. That freedom is convenient for an integrator. For the plant, it is a symptom.

This guide looks at chemical plant automation through our position: chemical plants are messy and neglected, because once a plant is commissioned it gets far less highly skilled engineering work than it did during the build. Logic gets changed without records. Alarms pile up until operators stop trusting them. Drawings drift away from the plant, and control systems run years past the end of vendor support.

The guide covers the distributed control systems (DCS), programmable logic controllers (PLCs), safety instrumented systems (SIS), batch software and networks that run petrochemical, industrial gas, resin, fertilizer, basic and specialty chemical plants. It also covers the rules auditors check, and how to migrate a control system inside a turnaround, the planned shutdown that sets the pace of almost every change.

Pharmaceuticals get their own guide in this series. Soaps and detergents are covered in the CPG guide, and refining belongs with oil and gas.

Joltek has worked in multiple chemical plants as a contractor and systems integrator:

• on process control logic;
• on batching on Rockwell’s PlantPAx;
• on migrations, including moving an idle plant from Rockwell to Siemens.

We have not designed safety systems, and this guide says so where it matters. First-hand observations are marked as ours. Everything else is sourced.

It covers, as of October 2026:

• how commodity and specialty plants differ, and how chemicals are made;
• DCS or PLC, ISA-88 batch control, and whether the SIS has to be separate from the DCS;
• the rules that reach the control system, and what auditors ask about changes and alarms;
• hazardous-area panels, and the open architectures (Ethernet-APL, NOA, MTP and O-PAS);
• who sells the automation, and who is buying it in 2026;
• what the CSB’s recent investigations teach about controls, and cyber after TRITON;
• migrating inside a turnaround window, hydrogen, and where to start;
• a 40-term glossary.

This guide is part of Joltek’s series on how automation differs across 39 industries.

How do commodity and specialty chemical plants differ, and why does that decide the control system?

Commodity plants make large volumes of basic chemicals such as ethylene, ammonia and chlorine, mostly in continuous units that stop for planned turnarounds. Specialty plants make smaller volumes of differentiated products, often in batches on shared equipment, with frequent product changes. Long runs reward a control system built for stability; frequent changes reward recipes and changeover control.

What counts as a chemical plant, by industry code

Statistics agencies sort chemical plants by product, not by process. In the North American Industry Classification System, chemical manufacturing is subsector 325. This guide covers five of its seven industry groups:

• 3251, basic chemicals: petrochemicals, industrial gases, dyes and pigments, other inorganic and organic chemicals, and ethyl alcohol.
• 3252, resins, synthetic rubber and fibers.
• 3253, pesticides, fertilizers and other agricultural chemicals.
• 3255, paints, coatings and adhesives.
• 3259, other chemical products: printing ink, explosives, custom compounding of resins and the rest.

The two groups left out are pharmaceuticals (3254) and soaps, cleaning compounds and toilet preparations (3256).

How big it is

The Census Bureau’s 2022 Economic Census counts 14,961 US chemical establishments, with $900,972,532,000 in shipments and 888,737 employees. Without pharmaceuticals and soaps, that is 9,535 establishments, $584,362,313,000 in shipments and 476,296 employees. Value added was $258,868,509,000, or 44.3 percent of shipments.

Industry group	Code	Establishments	2022 shipments	Employees
Basic chemicals	3251	2,783	$297,894,043,000	162,840
Resins, synthetic rubber and fibers	3252	1,672	$129,679,869,000	114,605
Agricultural chemicals	3253	1,047	$48,810,581,000	37,282
Paints, coatings and adhesives	3255	1,808	$53,230,004,000	74,669
Other chemical products	3259	2,225	$54,747,816,000	86,900
In scope		9,535	$584,362,313,000	476,296

Source: US Census Bureau, 2022 Economic Census, table EC2231BASIC. The total leaves out pharmaceuticals (3254) and soaps, cleaning compounds and toilet preparations (3256).

The six-digit codes show how far apart the plants are. The 60 petrochemical establishments (325110) shipped $77,557,794,000 in 2022, about $1,292,630,000 each. The 1,282 paint and coating plants (325510) shipped $33,176,861,000, about $25,879,000 each.

The newer 2024 Annual Integrated Economic Survey puts the same five groups at 8.3 percent of US manufacturing shipments. It is built differently from the census, so the two should not be read as a trend.

The Bureau of Labor Statistics counted 124,330 chemical equipment operators and tenders, 17,600 chemical technicians and 27,530 chemists in chemical manufacturing in 2025, pharmaceuticals included. Its table lists no instrumentation technicians or controls engineers. There is no public count of the people who keep these control systems running.

In Canada, Statistics Canada puts 2024 revenue of chemical manufacturing at C$77,128,038,000. The five groups in scope made C$52,728,974,000, led by basic chemicals at C$20,866,604,000, and employed 44,432 people in 2025.

Most plants are small

Most chemical plants are small, and a large share of the jobs sits in a few big ones. In the 2023 County Business Patterns, 53.9 percent of the 9,136 in-scope establishments had fewer than 20 employees, and 75.4 percent had fewer than 50. The 336 sites with 250 or more employees, 3.7 percent of the total, held 38.3 percent of the jobs.

The spread depends on the segment:

• Petrochemicals: 14 of 76 establishments had 250 or more employees, and they held 67.9 percent of the segment’s 10,888 jobs.
• Paints and coatings: 62.7 percent of 1,125 establishments had fewer than 20 employees.
• Industrial gases: 351 of 546 sites, 64.3 percent, had fewer than 20 employees.

County Business Patterns counts a few hundred fewer establishments than the Economic Census, so the two sets of figures should not be mixed.

For a controls team, a cracker complex and a gas fill site share an industry group and little else. Plant size also bears on the position this guide takes. A plant of 20 people has few hands to spread across operations, maintenance and engineering. In our reading, that is one reason skilled engineering work thins out once the builders leave.

Commodity against specialty

The American Chemistry Council’s 2021 Guide to the Business of Chemistry gives the only public split by segment. In 2020, US chemical shipments without pharmaceuticals were $485,992,000,000:

• basic chemicals, $288,362,000,000 (59.3 percent);
• specialty chemicals, $77,197,000,000 (15.9 percent);
• agricultural chemicals, $30,726,000,000 (6.3 percent);
• consumer products, $89,707,000,000 (18.5 percent).

The council says its segments are a market view, not industry codes, and that “the boundaries dividing these segments are not clearly defined”. It describes specialty chemicals as differentiated products made “in lower volumes than basic chemicals” and sold “for what they do, rather than for what they contain”, usually at more than $1.25 a pound.

EPA’s archived sector profile, which the agency no longer updates, draws the operating line: “Commodity plants often run continuously, typically shutting down only a few weeks a year for maintenance.” Specialty batch manufacturing, it says, “requires that the raw materials, processes, operating conditions, and equipment change on a regular basis”.

That is a pattern, not a rule. A cracker that runs for years between turnarounds still takes each furnace offline in turn to burn out coke. A 2015 patent puts furnace run lengths between decokes at 5 to 60 days, with each decoke taking 12 to 48 hours, so a “continuous” plant runs automated switching sequences every few weeks.

Some specialty products are made continuously, and some commodity products in batches. No public source says what share of US chemical plants run batch.

The process decides what the control system has to be good at:

	Continuous commodity unit	Multi-product batch plant
Run length	Years between turnarounds	Hours or days per batch
Control emphasis	Stable regulation of many interacting loops, and optimization	Sequences, recipes, changeovers and shared equipment
Typical changes	Setpoints, tuning and the occasional project	New products, new recipes and new equipment paths
Records	Process history and shift logs	A batch record for each lot
When the control system can change	Inside a turnaround window	Between batches, or in short planned stops

Joltek's summary of the pattern described in EPA's archived sector profile, the ACC Guide and the company filings in the next section. Individual plants vary.

How are chemicals made, from crackers to batch reactors?

A handful of large continuous processes make most commodity chemicals: crackers heat ethane in furnaces and separate the gas, ammonia plants fix nitrogen with hydrogen, chlor-alkali cells split salt by electrolysis, and air separation units distill air. Specialty plants run reactions in batch reactors shared across many products, and the recipe decides what each batch becomes.

Ethylene crackers

A cracker heats ethane or another feed in furnaces until it breaks down, then sends the cracked gas on to be separated into ethylene and other products. The filings give the scale:

• Westlake reported ethylene capacity of 4,820 million pounds a year as of February 18, 2026, alongside 6,670 million pounds of chlorine and 7,510 million pounds of caustic soda.
• Its partnership, Westlake Chemical Partners, lists single sites: 1,500 million pounds a year at Petro 1 and 1,490 million at Petro 2, both in Lake Charles, Louisiana, and 730 million at Calvert City, Kentucky.
• LyondellBasell reported North American capacity, including its share of joint ventures, of 6.2 million tons of ethylene, 4.1 million tons of polyethylene and 1.9 million tons of polypropylene at the end of 2025.

“Continuous” does not mean static. Each furnace comes offline in turn to be decoked, and the Chemical Safety Board’s report on the Shell Polymers plant at Monaca, Pennsylvania, shows what that involves. Each furnace there had three motor-operated valves: one on the furnace side, one on the tower side and one for decoking.

Taking a furnace offline, holding it double-isolated and bringing it back are sequences, run through modes such as “pilot-only”, in which some furnace alarms were suppressed by design. The steady state is the easy part. The Monaca case, told in full below, shows how much risk sits in the transitions.

Whole units stop far less often: at Westlake Chemical Partners’ ethylene facilities, about once every five to eight years, for 30 to 60 days. That cycle sets the pace for every control system change, as the migration section explains.

Ammonia and nitrogen

CF Industries makes ammonia by the Haber-Bosch process. It fixes nitrogen from the air with hydrogen made from natural gas to produce anhydrous ammonia, which it sells or upgrades to granular urea, UAN solution and diesel exhaust fluid. Natural gas is both feedstock and fuel, at about 34 percent of CF’s 2025 production costs.

Its Donaldsonville, Louisiana site, which the company calls “the world’s largest and most flexible ammonia production complex”, has six ammonia plants and 4,335,000 tons of average gross annual ammonia capacity. CF notes that the figure “includes allowance for normal outages and planned maintenance shutdowns”.

Ammonia reaches well beyond the fertilizer plant. Many food plants use it as a refrigerant under the same OSHA and EPA rules, which the food and beverage guide covers.

Chlor-alkali

Olin describes chlor-alkali as the electrolysis of salt, which co-produces chlorine, caustic soda and hydrogen “at a fixed ratio”: 1.0 ton of chlorine to 1.1 tons of caustic soda and 0.03 tons of hydrogen per Electrochemical Unit (Olin’s 2025 annual report). The ratio is a plant-wide constraint. A chlor-alkali plant cannot make more chlorine without making more caustic soda, so its production plan answers to two markets at once.

Chlor-alkali cells are also the oldest large-scale electrolysis in the industry. The one sourced turnaround migration in this guide replaced the control system of a membrane electrolyzer unit at a caustic soda plant. The hydrogen section treats chlor-alkali as the precedent for that reason.

Industrial gases

Linde says cryogenic air separation is the most common process it uses to make oxygen, nitrogen and argon from air. It builds plants on or next to large customers’ sites and supplies them by pipeline, under contracts typically running 10 to 20 years. Smaller volumes go out by tanker truck and in cylinders. The industry group spans both ends: large air separation units and small fill and distribution sites, most of them with fewer than 20 employees.

Batch and specialty plants

Specialty plants run on a different rhythm. EPA’s AP-42 describes paint making as the dispersion of a pigment in a vehicle, “followed by the addition of an organic solvent for viscosity adjustment”. Only “weighing, mixing, grinding, tinting, thinning, and packaging” take place, and “no chemical reactions are involved”. Varnish is different: it is cooked in gas-fired kettles for 4 to 16 hours at 200 to 650 degrees F.

So “batch” covers two kinds of plant. A coatings plant mostly weighs, mixes and fills. A resin or specialty plant also runs reactions, with heat, pressure and the risk of a runaway.

In both, the same equipment usually makes many products, and what changes from batch to batch is the recipe. ISA-88 batch control, covered two sections down, exists to keep that recipe separate from the equipment logic.

Should a chemical plant run on a DCS or a PLC, and what sits above them?

Both work. Distributed control systems from Honeywell, Emerson, Yokogawa and others run many large continuous units. In the chemical plants we have worked in, the control system was mostly PLCs, Rockwell and some Siemens, with batching on Rockwell’s PlantPAx. Over half the US plants in scope have fewer than 20 employees. Historians, LIMS and MES sit above both.

What the suppliers sell

Every large process automation supplier sells a control system with a safety system to match:

• Honeywell describes Experion LX as “a purpose-built distributed control system (DCS) for continuous and batch process control applications”. Its Safety Manager is “a SIL 3 certified system” and “part of the Experion Process Knowledge System”.
• Emerson sells the DeltaV and Ovation control systems, and DeltaV SIS for safety.
• Yokogawa sells ProSafe-RS, which it says is “SIL3 certified in a single module configuration” and needs “no gateway or interface hardware” to exchange data with its DCS.
• Schneider Electric sells the EcoStruxure Foxboro DCS and EcoStruxure Triconex safety systems.
• ABB sells System 800xA. In May 2026 it announced an order for 800xA with a safety instrumented system, gas detection and an operator training simulator for a 500,000 tons a year oxo-alcohol plant in China, due in the third quarter of 2027.
• Siemens is among the DCS suppliers most often named for process plants. Its process automation sits inside its Digital Industries business.
• HIMA sells safety systems only.
• Rockwell Automation lists chemicals among its “process end markets” and sells PlantPAx. Our Rockwell Automation pages cover its controllers and software.

No public survey says what kind of system chemical plants run, or in what share. The observation in the answer above is ours.

What we have seen

Asked what vendors and integrators get wrong when they sell into chemical plants, our answer is short: they often do not understand the process. In our view, logic written without that understanding tends to pass a factory test and fail at the edges of the process: a startup, an upset, or the recipe nobody tested.

Practitioners in public forums draw the line between a DCS and a PLC system in a similar place. They define a DCS less by size than by integration: one configuration database across the controllers, operator screens that keep working when a controller is downloaded, and libraries shared across the plant.

One dismissed the idea that a PLC with remote I/O and SCADA adds up to a DCS as marketing. Others note that the lines blur every year, that packaged units arrive with their vendors’ own PLCs, and that most integrators are deep on about two platforms. These are anecdotes, not data, but they point at the same deciding questions.

What decides it

Three questions settle most choices:

• Scale and interaction. A unit with hundreds of loops that upset each other gains from one database, one operator interface and one engineering tool. A small plant whose process steps barely interact may not.
• Variety. Many products on shared equipment call for recipe management, whichever platform runs it.
• Support for decades. The system will outlive several generations of its own hardware, so the question is who will still support it in 15 years: plant staff, the supplier or an integrator. Given how little skilled engineering time most plants get after commissioning, this is the question we would weight most.

The products keep converging, as the supplier list shows. At the I/O level, Honeywell’s Experion IO HIVE lets any Experion controller reach any I/O channel on its network. Honeywell says field cabinets “can be commissioned independently of the control system”, and claims 15 to 20 percent fewer cabinets and 10 to 15 percent fewer engineering hours.

Systems beside the control system

In a chemical plant, several systems sit beside the DCS or PLC, not under it:

• The safety instrumented system, covered two sections down.
• Burner management for furnaces, heaters and boilers, under the codes listed in the rules section. Honeywell lists NFPA 85 and NFPA 86 among the standards for its Safety Manager.
• Fire and gas detection, which ISA’s 2026 technical report TR84.00.07 addresses, and which ABB’s China order bundles with the DCS.
• Packaged units with controllers of their own. Practitioners describe compressor anti-surge protection running in a dedicated controller, and furnace light-off interlocks in PLCs that report to the DCS over Modbus.

The layers above

ISA-95, the standard for linking plant control to business systems, describes five levels, from Level 0, the physical process, to Level 4, business planning and logistics. In a chemical plant, by our reading:

• Levels 0 to 2 are the instruments, I/O, the DCS or PLC and the SIS.
• Level 3 holds the historian, batch management, the laboratory information management system (LIMS) and the manufacturing execution system (MES).
• Level 4 is ERP and planning.

IEC published the third edition of IEC 62264-2, its version of ISA-95 Part 2, in March 2026, while ISA’s Part 2 is still the 2018 edition. Our guide to the ISA-95 levels in practice shows how they map onto a working plant.

The historian matters more in a chemical plant than its place in the stack suggests. When the CSB investigated the 2023 explosion at Dow’s Plaquemine site, the evidence was already in the plant’s process data. For years, a pressure transmitter had often read slightly below zero, meaning air was entering relief piping, and no alarm flagged it. Our guide to what a historian does covers making that data useful before an incident rather than after.

Advanced process control and optimization software also sits above the control layer on large units. Emerson completed its purchase of AspenTech, which its annual report calls “a global leader in asset optimization software”, on March 12, 2025.

What is ISA-88, and does a specialty plant need batch software?

ISA-88 is the batch control standard: it separates the equipment from the recipe, so the same reactor can make many products without changing its code. Its IEC counterpart, IEC 61512-1, was revised in February 2026. In the plants we have worked in, batching ran on PlantPAx or in the general control system. Batch software pays when grades and recipes multiply.

What the standard covers

ISA describes ISA-88 as guidelines for designing and specifying batch control systems, with common terminology, “a standard data structure batch control language” and an architecture “that defines both the physical model and the functional model”. It names five functional types: “recipe management, scheduling, sequential control, regulatory control, and safety interlock systems”.

The ISA series has parts on models and terminology (ISA-88.00.01-2010), data structures and languages (2001), general and site recipes (2003) and batch production records (2006), plus a 2022 technical report on machine and unit states. IEC published IEC 61512-1:2026, the second edition of its counterpart to Part 1, on February 20, 2026. It replaces the 1997 first edition as a technical revision, and IEC says it separates recipe procedural elements from equipment procedural elements. ISA’s catalog does not yet list a matching new edition of its Part 1.

The two models

A controls engineer meets ISA-88 through two models, and Rockwell’s PlantPAx batch design manual describes both plainly:

• The equipment model is “a hierarchical organization of the equipment and basic control capabilities of the plant”. Teaching material on the standard lists its levels as enterprise, site, area, process cell, unit, equipment module and control module.
• The procedural model is “a multi-tiered, hierarchical model” for using that equipment to make product, in four tiers: procedure, unit procedure, operation and phase. A phase is the smallest tier that does something, such as charging a material or heating to a temperature, and the equipment controller runs it.

The recipe sits on top. It names the materials, quantities and steps for one product and calls the equipment’s phases in order. Because the phases belong to the equipment and the recipe is data, the same reactor can make a new product without new code. That separation is the point of the standard.

The batch engines

Batch software runs the recipes against the equipment:

• Rockwell describes FactoryTalk Batch as “native ISA-88 batch control”, part of PlantPAx, and names “specialty chemical” among its target industries.
• Emerson says DeltaV offers “built-for-batch solutions” and lists chemical first among the industries it serves.
• Honeywell pitches Experion LX at “continuous and batch process control”.

Hard-coded sequences or batch software?

Plenty of plants run batches without batch software. The sequence is written straight into the PLC program, step by step, with the recipe values in the code or in a handful of tags.

The best sourced discussion of the choice we found is a 2007 article in Control. A Siemens manager there separated “a simple batch program that can be hard-coded into a PLC” from complex batch systems.

Another contributor said ISA-88 meant “chemical engineers can make flexible recipe changes and push through new products more quickly”. An integrator claimed first-time-right batches “can go from 60% to greater than 90%” with batch software. Those are vendor and integrator claims, 19 years old, and no public benchmark has replaced them.

Practitioners online call the standard a framework rather than a set of rules, and say the equipment module is where most people get lost. Their rule of thumb follows variety. One unit making one product may not justify batch software, while dozens of similar reactors making a hundred products do. A hard-coded recipe works, they add, but every change means changing code.

In our experience, batch control sits in the control layer at small plants and moves up toward MES at large ones.

The rules give the hard-coded route a cost that is easy to miss. OSHA’s non-mandatory Appendix C to the process safety management standard lists “computer program revisions” among the changes that management of change covers. Where the recipe lives in the code, a new product is a program revision.

Batch software does not take a recipe change out of review, since a new recipe can still be a change in process technology. In our reading, though, the review shrinks: a tested equipment phase does not have to be rewritten for each new product.

	Hard-coded sequence	ISA-88 batch software
Fits	A few fixed products	Many grades and recipes on shared equipment
A new product means	A program change	A new recipe that reuses tested phases
Change control	Every recipe change is a logic change	Recipe changes and logic changes are separate
Batch record	Built by hand or by custom code	Structured by ISA-88’s part on batch production records
Skills	Any capable PLC programmer	ISA-88 design skills, especially at the equipment module

Joltek's comparison, drawing on the 2007 Control article, ISA's description of ISA-88, OSHA's Appendix C and practitioner discussion. It is not a benchmark.

Where the batch layer meets the rest

Batch alarms follow ISA’s technical report TR18.2.6-2012 on alarm systems for batch and discrete processes. Batch records and scheduling reach up into Level 3, where ISA’s technical report TR88.95.01-2008 covers using ISA-88 and ISA-95 together. Our guides to MES and electronic batch records and to batch and MES technologies pick up from there.

Does the SIS have to be separate from the DCS?

IEC 61511, as industry guidance reads it, requires the safety instrumented system to be independent of the control system, with a common cause assessment, but not a different brand or box. Vendors sell integrated platforms with separate safety logic solvers; others argue for a fully separate layer. The plant must prove independence in hardware, people, procedures and cyber defenses.

The basic process control system, the DCS or PLC that runs the plant, keeps the process where it should be. The safety instrumented system has one job: when the process goes somewhere it must not, take it to a safe state. Each protective action, with its sensor, logic and final element, is a safety instrumented function. The question this section answers is how much the two systems may share.

What the standard asks for

IEC 61511-1 is the process sector standard for safety instrumented systems. The text in force is the consolidated edition 2.1, IEC 61511-1:2016+AMD1:2017, with a stability date of 2029. IEC describes it as giving “requirements for the specification, design, installation, operation and maintenance of a safety instrumented system (SIS), so that it can be confidently entrusted to achieve or maintain a safe state of the process”.

The United States adopts it as ANSI/ISA-61511-1-2018, identical to the IEC text. Part 2 gives guidelines for applying Part 1. Part 3 gives a framework for setting safety integrity levels, but IEC notes it “does not specify the SIL required for specific applications”.

Safety integrity levels are order-of-magnitude bands. For a function demanded rarely, SIL 1 means a risk reduction of 10 to 100, SIL 2 of 100 to 1,000 and SIL 3 of 1,000 to 10,000.

The level a function needs comes from the hazard analysis. OSHA’s process hazard analysis rule names HAZOP and other methods. Layer of protection analysis (LOPA) gives “an order-of-magnitude estimate of risk”, and CCPS calls it “an excellent approach for determining the safety integrity level” a function needs.

The standard is sold, not published free, and this guide does not quote it. Industry guidance reads it as requiring the SIS to be independent of the control system, with an assessment of common cause failures: the faults that could disable both at once. It does not require a different vendor.

Four ways to arrange control and safety

A 2017 guidance document from the 61508 Association, “Integrated and Separate?”, sorts the options into four types:

Architecture	What the control system and the SIS share	What the association said about prevalence in 2017
Air-gapped	Nothing: separate engineering software, workstations, networks, logic solvers and I/O, often from different suppliers	Typical of legacy SISs
Interfaced	Air-gapped, plus a data link such as RS232 or Modbus	Not stated
Integrated	A common network, sometimes a common engineering workstation; separate logic solvers and I/O	“Increasingly prevalent”
Common	The same logic solver for control and safety functions, with separate I/O	“Still few in number”

The same document gives five reasons to keep the SIS apart:

• to reduce common cause, common mode and systematic failures;
• to keep the control system flexible for changes, maintenance, testing and documentation;
• to make validation and functional safety assessment of the SIS easier;
• to support access control and cyber security for the SIS;
• to reduce the analysis needed to show both systems are properly designed, verified and managed.

What the vendors argue

The suppliers do not agree on how far integration can go, and each position comes from a company with something to sell:

• Emerson wrote in 2009 that it is “widely acknowledged that using separate, independent, and diverse hardware/software for safety and control is the optimal way” to guard against common cause errors. It describes DeltaV SIS, with logic solvers and an operating system separate from the DeltaV control system, as “integrated yet separate”.
• ABB argued in a 2009 paper that an integrated safety system “can still act as a completely independent layer of protection”, given third-party certification.
• Yokogawa says its integrated safety controller, ProSafe-RS, has been used in “over 3,500 projects”.
• HIMA, which sells only safety systems, offers what it calls “Independent Open Integration”: safety systems that connect to existing control environments “while maintaining an independent layer of protection”.

No regulator statement taking a side was found. The 61508 Association’s point is the useful one: integration does not remove the independence work, it moves it. When the same team engineers, changes and maintains both systems, independence has to come from separate documents, teams, procedures, test methods and verification records. The association adds that “Risks related to cyber security increase with increased integration”.

What TRITON added

In 2017 attackers reached an SIS engineering workstation at a refinery and reprogrammed its safety controllers. Mandiant’s report on the attack notes “a trend towards integrating DCS and SIS designs for various reasons including lower cost, ease of use, and benefits achieved from exchanging information between the DCS and SIS”. Its conclusion: “TRITON acutely demonstrates the risk associated with integrated designs that allow bi-directional communication between DCS and SIS network hosts.”

The attack, and what changed after it, is covered in the cyber section below. Zones and conduits under ISA/IEC 62443 are how a plant puts that separation into its network. For an existing plant, our guide to segmenting a brownfield network covers how to start.

What OSHA’s rule says, and what it leaves out

OSHA’s process safety management standard reaches the safety system in two places:

• The hazard analysis must address “engineering and administrative controls applicable to the hazards and their interrelationships”. It names “process monitoring and control instrumentation with alarms”. It must be revalidated at least every five years.
• Mechanical integrity covers “emergency shutdown systems” and “controls (including monitoring devices and sensors, alarms, and interlocks)”. Each inspection and test must follow recognized and generally accepted good engineering practice and be recorded with the date, the person, the equipment, the test and the result.

The words “bypass” and “proof” do not appear anywhere in the rule. Bypass control and proof testing are left to the consensus standards and the plant’s own procedures. That makes them easy to let slide when nobody senior is watching.

Monaca: an SIS overridden from the inside

The Shell Polymers plant at Monaca, Pennsylvania, shows what independence on paper can miss. On June 4, 2025, cracked gas flowed back into the firebox of an offline ethane cracking furnace and exploded.

Fifteen employees were evacuated. Shell estimated $95,000,000 in property damage, and the furnace was out of service for seven months. The CSB’s final report, released September 16, 2026, found:

• The trigger: a process control engineer who had never done the task opened the furnace-side isolation valve by mistake while trying to open the tower-side one. The engineer had put the SIS into “debug” mode, which the report describes as a mode “that allows a user to override any programmed logic that operates process equipment”.
• The screen: the SIS logic screen put three nearly identical valve blocks on one scrolling page, and it jumped back to the top when debug mode was entered.
• The alarms: the firebox high-pressure, carbon monoxide and methane alarms were “suppressed by design” while the furnace was in pilot-only mode, to manage alarm floods and nuisance alarms. The carbon monoxide alarm would have sounded about 90 seconds before ignition.
• The controls on paper: Shell relied on 11 controls, each “purely administrative”. Its 2023 hazard analysis had judged engineered protection against backflow “grossly disproportional to the risk reduction”.
• The engineered control: the furnace licensor’s design included a SIL 2 interlock that would close the furnace-side valve on backflow. Shell had not programmed it to work in the double-isolated state.
• The bypass form: Shell’s policy required one whenever the SIS was overridden for a task without a procedure. Shell told the CSB it used the form only when Operations opened the valve, and the CSB did not find that exception in the policy.

The CSB’s second recommendation asks Shell to implement “an engineered control to prevent backflow of cracked gas into a furnace during all modes of furnace operation”, citing IEC 61511 Parts 2 and 3. Since the explosion, Shell has added SIS logic that keeps the tower-side valve closed if the furnace-side one is opened by mistake.

The SIS at Monaca existed, and it had logic for these valves. It still failed to protect, because a person could override it, the alarms were silenced in the mode that mattered, and the engineered control was switched off for that state. Independence is a property of the whole lifecycle, not only of the hardware.

Questions for your plant

Whatever the architecture, these questions show whether the independence is real:

• Who can put the SIS into a mode that overrides its logic, and what does it take?
• Which alarms are suppressed in which plant modes, and was each suppression analyzed for startup, normal operation and shutdown?
• Does every change to SIS logic, alarms and interlocks go through management of change?
• Is there a two-way network path between control system hosts and SIS hosts?
• Is the bypass form used every time, by everyone, and is anyone checking?

Where we fit

Our chemical plant work has been the general process logic, not safety systems. The SIS, its safety requirements specification and its SIL work belong to functional safety engineers. On any project that changes the control system, their review should decide whether a change reaches a safety function.

Which rules reach a chemical plant’s control system?

OSHA’s process safety management standard and EPA’s Risk Management Program set the legal floor: process safety information, management of change, mechanical integrity of interlocks and alarms, and audits every three years. IEC 61511, ISA-18.2 and ISA/IEC 62443 are the consensus standards that show good practice. EPA is rewriting the RMP rule, and CFATS has been unenforceable since 2023.

OSHA process safety management

OSHA’s process safety management (PSM) standard covers a process that involves a listed chemical at or above its threshold quantity, or 10,000 pounds or more of a Category 1 flammable gas or a flammable liquid with a flashpoint below 100 degrees F. Below the thresholds, a process is outside the rule.

For a covered process, six elements of the rule reach the control system:

• Process safety information must include piping and instrument diagrams, the electrical classification, the relief system design basis and “safety systems (e.g. interlocks, detection or suppression systems)”. The employer must document that equipment follows recognized and generally accepted good engineering practices (RAGAGEP). The rule names no code as RAGAGEP.
• The process hazard analysis must address the controls and their interrelationships, and be revalidated at least every five years.
• Operating procedures must cover startup, normal and temporary operation, emergency shutdown, normal shutdown and startup after a turnaround, with the operating limits and the consequences of deviating from them. The sequences and interlocks in the control system have to match them.
• Mechanical integrity covers emergency shutdown systems and “controls (including monitoring devices and sensors, alarms, and interlocks)”, with a record of every test.
• Management of change applies to every change except a replacement in kind, as the next section explains.
• The pre-startup safety review applies to new facilities, and to modified ones when the change alters the process safety information.

The employer must also certify a compliance audit at least every three years. The standard was last amended in April 2019. OSHA’s rulemaking entry for revising it sits among long-term actions with “Next Action Undetermined”, and no proposed or final change appeared in the Federal Register from January 2024 to October 2026.

EPA’s Risk Management Program

EPA’s Risk Management Program (RMP) rule, 40 CFR Part 68, puts a process in its strictest tier, Program 3, if it is covered by PSM or falls in one of several listed industries, most of them chemical codes. Program 3’s prevention program parallels PSM: hazard analysis, mechanical integrity, management of change and pre-startup review.

EPA’s 2024 “Safer Communities” rule added more:

• A safer technology and alternatives analysis inside the hazard analysis, for every Program 3 process in petroleum and coal products (NAICS 324) and chemicals (325). A narrower group must also implement at least one practicable passive measure, or an equally protective mix of active and procedural ones. EPA’s description of active measures includes “alarms, safety instrumented systems, and detection hardware”.
• Power for monitoring. The hazard analysis must consider “standby or emergency power systems”, and monitoring equipment for preventing and detecting releases must have “standby or backup power to provide continuous operation”.
• A gap check between the codes a process was built to and the current versions of those codes.
• Third-party audits and root cause analysis, among other provisions, due by May 10, 2027.

On February 24, 2026, EPA proposed to undo much of that. The proposal would:

• drop the safer technology analysis for existing processes;
• rescind the power-loss additions and the gap check;
• move the third-party audit date to three years after a final rule.

EPA estimated annual savings of $234,700,000 to $240,300,000 at a 3 percent discount rate. Comments closed on May 11, 2026. As of October 28, 2026 no final rule had been published, and the 2024 compliance dates are still in the regulation. Until a final rule says otherwise, May 10, 2027 is the date to plan for.

HON, the chemical air toxics rules

HON is the short name for the air toxics rules covering the synthetic organic chemical manufacturing industry, amended by EPA in May 2024. EPA counted about 207 HON facilities, nearly two thirds of them in Texas and Louisiana. Under the current regulation:

• most existing sources must meet the amendments by July 15, 2027;
• the ethylene oxide requirements, and fenceline monitoring for six air toxics, applied from July 15, 2026.

The part that reaches the control system is the pressure relief device rule. Each affected relief device needs a device or monitoring system that identifies a release, records its time and duration, and notifies operators immediately. The rule also requires at least three redundant prevention measures, which can include “flow, temperature, liquid level and pressure indicators with deadman switches, monitors, or automatic actuators” and “inherently safer designs or safety instrumentation systems”. That is a historian, alarm and interlock requirement written into air law.

The dates have moved for some plants. Presidential proclamations of July 17, 2025 and July 9, 2026 exempted the sources listed in their annexes for two years beyond the relevant compliance dates. EPA listed the HON rule for reconsideration in March 2025, but no reconsideration had been proposed in the Federal Register by October 28, 2026. A plant not named in an annex is still on the 2026 and 2027 dates.

CFATS, ChemLock and TSCA

The Chemical Facility Anti-Terrorism Standards (CFATS) have been unenforceable since the program’s authority expired on July 28, 2023. CISA’s CFATS page still says it “cannot enforce compliance with the CFATS regulations at this time”, and still describes the lapse as of October 28, 2026. About 3,200 facilities had been designated high-risk. CISA’s voluntary ChemLock program offers no-cost assessments and guidance in its place.

TSCA reaches the control system only through records: production volumes for Chemical Data Reporting, next due in 2028 from sites that make 25,000 pounds or more of a reportable chemical, often come from the historian or batch records.

Burner management codes

Fired equipment brings its own documents:

• NFPA 85, the boiler and combustion systems hazards code, in its 2023 edition, and NFPA 86, for ovens and furnaces, now sold in a 2027 edition.
• API RP 556, for instrumentation, control and protective systems on gas-fired heaters in “petroleum production, refineries, petrochemical, and chemical plants”. Its latest edition dates from April 2011, reaffirmed in 2019, and it excludes boilers.
• ISA’s technical report TR84.00.05-2009, on identifying the safety instrumented functions in a burner management system.

Canada

Canada’s federal rule is the Environmental Emergency Regulations, 2019 (SOR/2019-51), in force since August 24, 2019. They list 234 substances and 15 solutions, each with a minimum quantity, for example 4.50 tonnes of anhydrous ammonia and 1.13 tonnes of chlorine. A facility at or above the quantity must:

• notify the Minister within 90 days;
• prepare an environmental emergency plan and bring it into effect within 12 months;
• run an exercise every year and a full-scale exercise every 5 years;
• keep the records for at least 7 years.

One clause rewards automation. In counting the quantity held, a container system excludes “any part of that network that is automatically or remotely segregated from the rest of the network by shut-off valves, or other mechanisms, in the event of any environmental emergency”.

Canada’s process safety standard is CSA Z767:24, published April 30, 2024. It is a national standard, not a regulation, and our research did not establish whether any province requires it. Canada also adopts IEC 61511-1:2016, with Canadian deviations, as CAN/CSA-C22.2 No. 61511-1:17, which the National Research Council lists as current.

The map

Rule or standard	What it asks of the control system	What an auditor looks at	Status, October 2026
PSM process safety information	Documented interlocks, detection and suppression systems, and electrical classification	P&IDs, classification drawings, safety system documentation	Unchanged since 2019
PSM hazard analysis	Controls and their interrelationships analyzed	The hazard analysis and its 5-year revalidation	Unchanged since 2019
PSM mechanical integrity	Tested shutdown systems, alarms and interlocks	Test records: date, person, equipment, test, result	Unchanged since 2019
PSM management of change	Every change reviewed and authorized before it is made	Change records, updated procedures and documents	Unchanged since 2019
PSM pre-startup review and audit	Review before a changed process starts; audit every 3 years	Review records; the last two audit reports	Unchanged since 2019
EPA RMP, 2024 rule	Safer technology analysis; backup power for monitoring	The hazard analysis and its safer technology section	Dates of May 10, 2027 stand; 2026 proposal not final
HON relief device rule	Release detection, timing and immediate operator notice	Release records and the three prevention measures	July 15, 2027 for most existing sources; some exempted
IEC 61511	A safety instrumented system managed over its lifecycle	The safety lifecycle records	Edition 2.1 (2017) in force
ISA-18.2 and IEC 62682	Managed alarms	The alarm philosophy and alarm performance	ISA-18.2-2016; IEC 62682:2022
ISA/IEC 62443	A security program for the control system	The asset owner’s security program	ISA-62443-2-1 revised in 2024
CFATS	Security plans for high-risk facilities	Nothing enforceable	Lapsed since July 28, 2023
Canada E2 Regulations	An emergency plan; credit for automatic isolation	The plan, exercises and 7 years of records	In force since 2019

Sources: 29 CFR 1910.119; 40 CFR Part 68 and EPA's proposal of February 24, 2026 (91 FR 8970); 40 CFR 63.100 and 63.165; IEC and ISA catalog pages; CISA; Justice Laws Website, SOR/2019-51. Status as of October 28, 2026.

What do auditors ask about control-system changes and alarms?

Two questions sit at the center: did every change to the control system go through management of change, and does the alarm system help operators or bury them? PSM requires written change procedures for everything except a replacement in kind. Published alarm guidance puts the manageable average at about 6 to 12 alarms an hour per operator console.

Management of change for logic

PSM’s management of change paragraph never mentions software or logic. It requires written procedures for changes to “process chemicals, technology, equipment, and procedures”, except replacements in kind. Before a change, the procedure must address:

• the technical basis;
• the impact on safety and health;
• changes to operating procedures;
• the time needed;
• the authorization required.

Affected employees must be told and trained before startup, and the process safety information and procedures updated.

OSHA’s non-mandatory Appendix C makes the link to control systems. It says computerized control systems “add complexity to operating instructions”, which “need to describe the logic of the software as well as the relationship between the equipment and the control system”. It lists “computer program revisions and changes in alarms and interlocks” among the changes management of change covers. That is guidance, not a requirement, but it is what an informed auditor reads.

The pre-startup safety review follows when a modification changes the process safety information. Whether a like-for-like controller swap does is a judgment the rule leaves to the plant.

What we saw, and what it means

As the introduction said, nobody asked us for a change record when we changed control logic as a contractor and systems integrator. Whether that broke a rule depends on whether the process was covered, and PSM applies only above its thresholds. Covered or not, a plant that cannot say who changed its logic, when and why has lost track of its own process.

The CSB has been pressing the same point from the other side. In its 2025 report on three hydrogen fluoride releases at Honeywell’s Geismar, Louisiana plant, it found that a 2007 gasket change had been only partly carried out. It also found that poorly managed staffing and organizational changes contributed to a 2023 failure. It repeated a recommendation it first made to OSHA in 2005: require a management of change review for organizational changes such as mergers, staffing changes and budget cuts.

Practitioners describe the same gap from inside plants. In public forum threads, engineers ask what actually triggers a change review for a logic edit. Some describe running a change impact analysis to see whether a safety function is touched.

Others describe a one-page form for setpoint changes, or a spreadsheet only one person knows about. Integrators say they rely on the customer’s paperwork, and some call the last step, getting everyone to sign the updated procedures, the most important part.

The cheapest evidence trail is the one the tools already keep. Version control for control-system code answers the auditor’s first question, what changed, with a comparison instead of a memory. For Rockwell systems, our AssetCentre guide covers what that tool costs and how to run it.

What an auditor should see for a logic change

1. A request that names the controller, the logic and the reason.
2. An impact screen that asks whether the change touches a safety function, an alarm, an interlock or the process safety information.
3. A review and an authorization before the change, by people who understand the process as well as the code.
4. A test offline or in simulation, with the result recorded.
5. A pre-startup safety review where the process safety information changes.
6. Training for the operators affected, before startup.
7. Updated records: drawings, cause and effect documents, operating procedures and the stored program.

Alarms

PSM mentions alarms only in the hazard analysis and mechanical integrity items quoted in the safety system section. It requires no alarm standard and no alarm metric. The consensus standards fill the gap:

• ISA-18.2-2016, management of alarm systems for the process industries, with technical reports on alarm philosophy (2018), identification and rationalization (2016), basic alarm design (2024), monitoring and auditing (2022) and batch processes (2012).
• IEC 62682:2022, the international counterpart. IEC says it covers “all alarms to be presented to the operator through the control system”, including alarms from the control system, packaged systems and the SIS.

Both standards are sold, not published free. Published summaries of the older guidance give the familiar numbers:

• Rates. An ISA InTech article lists averages of about 6 and about 12 annunciated alarms an hour per operator console. A 2016 trade article calls 12 an hour “the maximum manageable for an operator”.
• Floods. The InTech article defines a flood as more than 10 alarms in 10 minutes, with a target of less than 1 percent of the time in flood.
• Priorities and bad actors. The trade article gives the usual split of about 80, 15 and 5 percent for low, medium and high priority, and checks whether ten alarm sources produce more than 20 percent of all alarms.

Treat these as summaries, not as the text of the current editions.

The CSB’s recent reports show the two ways alarms fail:

• Suppressed in the wrong mode. At Monaca, the alarms that would have warned of the backflow were suppressed by design in pilot-only mode. The CSB’s lesson: plants “should not suppress safety-critical alarms without analyzing the hazards involved with silencing them in each plant mode of operation, such as start-up, normal operation, and shutdown”.
• Never configured. At the Givaudan Sense Colour plant in Louisville, Kentucky, a batch reactor exploded in November 2024, killing two employees. The plant “had not established alarms or other indicators to alert operators when a safe operating limit was exceeded”. The CSB’s Givaudan report recommends “automatic alerts, such as alarms or control screen indications” at each safe operating limit.

Leading indicators to ask about

No public benchmark exists for these, so treat them as questions:

• How many management of change records are open past their due date?
• How many safety functions are in bypass right now, and since when?
• How many alarms are standing, and how many are suppressed by design?
• Was each suppression analyzed for every plant mode?

What does a hazardous-area panel need in a chemical plant?

Electrical equipment in a classified area must be intrinsically safe, approved for the location, or otherwise safe for it, under OSHA’s rule and the National Electrical Code. That means knowing the Class and Division or the Zone first, then choosing purged enclosures, intrinsically safe barriers or rated equipment. Combustible dust now falls under NFPA 660, which replaced six older standards.

What OSHA requires

OSHA’s rule for hazardous locations, 29 CFR 1910.307, names “petroleum and chemical processing plants” among the places where equipment and wiring must suit the gases, vapors, dusts or fibers present. Each room, section or area is considered on its own. Equipment must be intrinsically safe, approved for the location, or safe for it.

Approved equipment must be approved “not only for the class of location, but also for the ignitable or combustible properties of the specific gas, vapor, dust, or fiber that will be present”. Areas classified under the zone system, and division areas set up after August 13, 2007, must be documented. The documentation must be available to the people who design, install, inspect, maintain or operate the equipment.

The classes and divisions, in OSHA’s definitions:

• Class I is flammable gas or vapor, and may be classified by divisions or zones. Class II (combustible dust) and Class III (fibers) use divisions only.
• Division 1 is where ignitable concentrations may exist in normal operation, or often because of repair, maintenance or leakage.
• Division 2 is where they are normally confined or prevented by ventilation, and escape only in abnormal conditions.
• Zone 0 has them present continuously or for long periods, Zone 1 is likely in normal operation, and Zone 2 is not likely in normal operation, and brief if they occur.

Because the classification must be available to the people who design the equipment, we would list the area classification drawing among a control system project’s design inputs, ahead of instrument and panel selection.

The National Electrical Code and classification guidance

The National Electrical Code’s hazardous location articles run from 500 to 506. Article 500 sets out the division system, Articles 501 to 503 cover the three classes, Article 504 intrinsically safe systems, and Articles 505 and 506 the zones for gases and for dusts. NFPA has issued a 2026 edition of the code.

For drawing the areas, NFPA 497 covers chemical process areas (a 2027 edition is now advertised), and NFPA 499 covers combustible dusts (2027 edition). ISA’s adoptions of the IEC 60079 series cover classification and protection methods. IEC 60079-14:2024, on installation design, is the newest international edition, and a revision of the gas classification part, IEC 60079-10-1, is in preparation.

Protection methods

Three methods do most of the work in a chemical plant:

• Intrinsic safety. UL 913, edition 8, is the US standard for intrinsically safe apparatus. A 2022 revision added requirements for two-wire intrinsically safe Ethernet on the 10BASE-T1L physical layer, the same layer Ethernet-APL uses.
• Purged and pressurized enclosures. NFPA 496 is the standard for purged and pressurized enclosures for electrical equipment, and ISA has a matching standard for pressurized enclosures.
• Equipment rated for the area, where the device itself is approved for the class and division or zone.

Practitioners in public forums make a point about purges that the panel builders’ pages skip. The purge is only as good as its interlock: if purge pressure falls, power to the panel has to go off. A purge that has failed or been bypassed protects nothing. It is the same bypass problem the safety system faces, one level down.

Combustible dust

NFPA 660, Standard for Combustible Dusts and Particulate Solids, replaced six older standards on December 6, 2024, according to trade press. Its chapter 25 carries the former NFPA 654 content that covers chemicals. Work on the next edition began with a first draft meeting in January 2026. NFPA 68 (deflagration venting, 2023 edition) and NFPA 69 (explosion prevention systems, 2024 edition) cover the protection side.

OSHA has no combustible dust standard. Its rulemaking was listed as completed in 2017 without a rule. The CSB’s 2006 dust study counted at least 281 combustible dust fires and explosions in US industry from 1980 to 2005, which killed at least 119 people. The board is now investigating dust explosions at Horizon Biofuels in Fremont, Nebraska, in July 2025, which killed three.

Toxic and combustible gas detection

ISA administratively withdrew its ISA-92 standards on toxic gas detectors in 2026, without saying which of its standard reasons applied. Its current technical report on the subject is TR84.00.07-2026, guidance on evaluating the effectiveness of fire, combustible gas and toxic gas systems.

Detection fails most easily when the plant is least normal. At the PEMEX Deer Park refinery in October 2024, hydrogen sulfide escaped during a turnaround and killed two workers.

The CSB found the unit’s permanent detectors were out of service for turnaround maintenance. The one working detector in a structure was wired to its own alarm, not to the unit horns. That was a refinery, but the lesson carries to every chemical plant that runs turnarounds.

Canada

The Canadian Electrical Code, Part I (CSA C22.1), has its own section on hazardous locations. We did not verify its current edition, so check it with the authority having jurisdiction.

What are Ethernet-APL, NOA, MTP and O-PAS, and what changes at a brownfield plant?

They are four attempts to open up process automation. Ethernet-APL brings two-wire Ethernet to field instruments in hazardous areas, NOA adds a second data channel beside the control system, MTP describes skid modules so they plug into an orchestration layer, and O-PAS defines an open control architecture. Most installed instruments still talk HART over 4 to 20 mA wiring.

The field layer most plants still have

An ARC Advisory Group study reported by Control in 2019 counted about 78.9 million installed process field devices using FieldComm Group technologies. HART devices were 60.3 percent of that installed base, and FOUNDATION Fieldbus about 4 percent. WirelessHART held roughly 30 percent of industrial wireless sensing. Fieldbus did not replace 4 to 20 mA wiring in most plants.

PROFIBUS PA runs at a fixed 31.25 kbit/s and powers transmitters over the bus cable. It reaches 1,900 meters in non-hazardous areas and 1,000 meters in hazardous ones on an intrinsically safe power supply. ISA’s wireless standard for process control is ISA-100.11a-2011.

Ethernet-APL

Ethernet-APL is two-wire Ethernet for field instruments, including in hazardous areas. It is built on the 10BASE-T1L physical layer and backed by FieldComm Group, ODVA, the OPC Foundation and PI. The project describes:

• cable runs of 1,000 meters;
• a trunk and spur layout;
• power for up to 50 field devices at up to 500 mW each;
• a design for intrinsic safety.

IEC’s port profile specification, IEC TS 63444, was first published in November 2023. That edition was withdrawn on June 4, 2026, and a 2026 version is listed.

Adoption so far is early:

• BASF built an Ethernet-APL test lab at Ludwigshafen in 2019 and 2020, with two redundant controllers and 238 field devices. It contracted ABB for the DCS of its first greenfield Ethernet-APL project in Europe.
• ABB’s 2026 order for a Chinese oxo-alcohol plant includes automation “supported by Ethernet-APL”, due in 2027.
• KROHNE lists Ethernet-APL as an option on several mass flowmeters, introduced “first in the EMEA region, followed by Asia and the US”.

We found no named, operating Ethernet-APL installation at a North American chemical plant.

NOA

The NAMUR Open Architecture (NOA) adds a second channel beside the control system. It carries plant and asset data to monitoring and optimization applications without changing the automation system. NAMUR has published its recommendations NE 175 to NE 178, covering:

• the concept;
• the information model;
• security zones and the security gateway (2025), with two protection profiles that follow IEC 62443-3-3;
• verification of requests.

NAMUR says NOA “is therefore suitable for existing systems (brownfield)”.

MTP

The Module Type Package (MTP) describes a process module, such as a skid, in a vendor-neutral way, so it can plug into a higher-level orchestration layer. PI, with NAMUR and ZVEI, released MTP Specification 2.0 on January 20, 2026, about six months after its own summer 2025 target. Conformance testing is the next step it named.

VDI’s page for the older VDI/VDE/NAMUR 2658 Part 1 shows its withdrawal announced, with no replacement named. IEC 63280 is the planned IEC route for MTP. PI’s February 2025 release says the parts were reworked for it, but we could not confirm its status in 2026.

O-PAS

The Open Group’s O-PAS Standard, 2nd Edition was published on February 6, 2023, in seven parts at Version 2.1. Its certification program began on October 1, 2024, and lists seven profiles. In April 2026 Yokogawa announced that a software kit of its own was certified to the OPC UA connectivity profile, which it called “a first in the process industry”. A certified connectivity profile is not a certified control system.

The one owner-run trial on record is ExxonMobil’s at a Baton Rouge chemicals site: about 2,000 I/O on products “built to O-PAS Version 2.1”. By October 2024 the plant was live on the open system. ExxonMobil’s David DeBari called it “a rip-and-replace project. We took out technology that was 40 years old.” We found no public update since, and no public O-PAS roadmap.

What changes at a brownfield plant

In our reading of those facts:

• The field stays HART on 4 to 20 mA for years. Ethernet-APL arrives with new units and instrument replacements, not as a retrofit.
• NOA is the one that can help an existing plant now, because it reads data without touching the control system. In our reading, it is the same idea as a unified namespace: a data path beside control, not through it.
• MTP matters if you buy skids. Ask the skid builder for an MTP file, and ask what version. Our guide to bringing new machinery into a plant covers the rest of the handover.
• O-PAS is a question to ask at a migration, with eyes open: one certified profile and one public trial are narrow evidence for a decades-long choice.

Who sells chemical plant automation, and who is buying in 2026?

The distributed control systems most often named for process plants come from Honeywell, Emerson, Yokogawa, ABB, Siemens and Schneider Electric, and Rockwell Automation sells PlantPAx to chemical plants. No public market share figures exist after 2021. The buyers had a weak 2025: seven of twelve large North American producers reported lower revenue, and several cut capital spending.

The suppliers

None of the suppliers reports DCS revenue on its own. The closest public figures are the segments that hold their process control lines, taken from filings:

Supplier	Control and safety lines named in this guide	Reporting segment and year	Segment revenue	Grade
Honeywell	Experion PKS, Experion LX, Safety Manager	Industrial Automation, 2025 (Process Solutions within it: $6,165,000,000)	$9,401,000,000	A
ABB	System 800xA	Automation business area, 2025	$8,084,000,000	A
Emerson	DeltaV, Ovation, DeltaV SIS; AspenTech	Software and Control, fiscal 2025	About $5,700,000,000	A
Rockwell Automation	PlantPAx, FactoryTalk Batch	Software and Control, fiscal 2025	$2,383,000,000	A
Siemens	Process automation within Digital Industries	Digital Industries, fiscal 2025	17,788,000,000 euros	A
Schneider Electric	EcoStruxure Foxboro, EcoStruxure Triconex	Industrial Automation, 2025	7,022,000,000 euros	A
Yokogawa	ProSafe-RS and its control systems	Industrial automation and control, year to March 31, 2026	565,523,000,000 yen	A
HIMA	Safety systems only	Not public	Not public	B

Sources: Honeywell 10-K for 2025; ABB Financial Report 2025; Emerson and Rockwell Automation 10-Ks for fiscal 2025; Siemens earnings release, Q4 fiscal 2025; Schneider Electric full-year 2025 results; Yokogawa results for the year ended March 31, 2026; HIMA's product pages. Grades: A is a filing or results release, B a vendor page. Every segment also holds products other than process control, so none of these is a DCS figure.

The segments keep moving, which matters to anyone holding a long service contract:

• Honeywell spun off Solstice Advanced Materials on October 30, 2025 and Honeywell Aerospace on June 29, 2026. Experion now sits in a new segment, Process Automation and Technology, alongside Honeywell UOP’s licensed process technology.
• ABB renamed its Process Automation business area “Automation” and folded Machine Automation into it, so its 2024 figure was recast.
• Honeywell’s Fail Safe Controller “is no longer available for purchase” and was “discontinued and replaced with Safety Manager”.

The only market share figures published are ABB’s own, relaying ARC Advisory Group reports: 20.0 percent of the global DCS market in ARC’s 2018 analysis, and 19.2 percent of a $15,000,000,000 market in January 2021. Its competitors have published nothing comparable.

Licensors and engineering firms shape the control system before the owner touches it. Linde’s Engineering segment, which builds air separation, hydrogen, synthesis and olefin plants for others, had 2025 sales of $2,250,000,000. KBR licenses “over 85” process technologies, including ammonia and petrochemicals.

A licensor’s package can include safety logic. At Monaca, the furnace licensor’s design included a SIL 2 interlock that Shell had not programmed to work in one plant state, as the safety system section describes.

The integrators come last and stay longest. In our view, the problem we described earlier, integrators who do not understand the process, is partly the owner’s to solve at selection: ask about the chemistry, not only the platform. Our guide to how integrators and owners split the work covers the handoff, and our scope of work template covers what to put in writing.

The buyers

The producers had a weak 2025. Twelve large North American producers, from their filings:

Company	2025 revenue	Change from 2024	2025 net result	Capital spending, 2025 (2024)
Dow	$39,968,000,000	Down 7.0%	Loss of $2,623,000,000	$2,479,000,000 ($2,940,000,000)
Linde	$33,986,000,000	Up 3.0%	Income of $6,898,000,000	$5,261,000,000 ($4,497,000,000)
LyondellBasell	$30,153,000,000	Down 9.7%	Loss of $738,000,000	$1,878,000,000 ($1,839,000,000)
Air Products (fiscal year to September)	$12,037,300,000	Down 0.5%	Loss of $394,500,000	$7,022,600,000 ($6,796,700,000)
Westlake	$11,170,000,000	Down 8.0%	Loss of $1,508,000,000	$995,000,000 ($1,008,000,000)
Celanese	$9,544,000,000	Down 7.1%	Loss of $1,165,000,000	$343,000,000 ($435,000,000)
Eastman	$8,752,000,000	Down 6.7%	Income of $474,000,000	$546,000,000 ($599,000,000)
CF Industries	$7,084,000,000	Up 19.3%	Income of $1,455,000,000	$950,000,000 ($518,000,000)
DuPont	$6,849,000,000	Up 1.9%	Loss of $779,000,000	Not read
Olin	$6,780,800,000	Up 3.7%	Loss of $101,100,000	$226,300,000 ($195,100,000)
Chemours	$5,808,000,000	Up 0.4%	Loss of $386,000,000	$213,000,000 ($360,000,000)
Huntsman	$5,683,000,000	Down 5.8%	Loss of $284,000,000	$173,000,000 ($184,000,000)

Source: each company's annual filing for 2025, through SEC EDGAR. LyondellBasell's and DuPont's changes use recast 2024 figures. Net result definitions differ by company. Olin's and Chemours' percentage changes are Joltek's arithmetic.

Seven of the twelve reported lower revenue. Capital spending fell at Dow, Celanese, Eastman, Huntsman and Chemours, and rose at Linde, Air Products, CF Industries and Olin. Behind the numbers, capacity is coming out:

• Dow plans to shut its ethylene cracker at Böhlen, Germany, by the end of 2027. In January 2026 it launched a program affecting about 4,500 roles.
• LyondellBasell stopped refining in Houston in the first quarter of 2025, deferred its Flex-2 project at Channelview and sold four European sites on May 1, 2026.
• Westlake closed several plants and units in 2025, among them a PVC plant in Aberdeen, Mississippi, and a chlor-alkali unit and a styrene plant at Lake Charles.
• CF Industries is rebuilding its Yazoo City, Mississippi complex, idle since a November 2025 incident, and expects production to resume in the first half of 2027.
• Nutrien shut its Trinidad nitrogen facility on October 23, 2025.

No source we read says what lower capital spending does to automation budgets. Our view is that a down year deepens the neglect this guide describes. Work that is not forced by an obsolescence notice, an audit finding or an incident waits another year.

What did Monaca, Plaquemine, Martinez and Crosby teach about controls?

Protection fails at the edges: in a mode, a location or an alarm nobody designed for. At Monaca the CSB found the safety system in a debug mode and furnace alarms suppressed by design. At Plaquemine no low-pressure alarm existed. At Martinez the shutdown’s flow meter sat upstream of the diversion. At Crosby, a flood cut power to refrigeration.

The board

The US Chemical Safety and Hazard Investigation Board (CSB) is an independent federal agency. It investigates accidental chemical releases and makes recommendations, and it says it “is not an enforcement or regulatory body”. Its reports are the most detailed public record of how protection fails in practice.

Shell Monaca, 2025

The safety system section above tells the Monaca story in full. Three further controls lessons sit in the report:

• The alarm text. The valve position alarms for the furnace-side valve, MOV-511, and the tower-side valve, MOV-513, were identical except for the last digit. The console operator expected the tower-side valve to move and read the alarm that way. The CSB called reliance on operator response to that alarm “an ineffective control”.
• The screen. The CSB found the safety system’s screen was not designed to make picking the wrong valve unlikely, and cited ISA’s HMI standard, ANSI/ISA-101.01-2015. Its lesson: an HMI “should provide feedback indicating the selected action and allow the action to be canceled before it is executed”.
• The habit. Process control staff had opened the tower-side valve 19 times before without incident. The CSB cited the CCPS warning about the normalization of deviation.

The first of the CSB’s two recommendations to Shell asks it to review the unit’s hazard analysis for every scenario handled only by administrative controls, and to add “an inherently safer design or an engineered control” for any scenario that could cause a fatality, serious injury or substantial property damage.

Dow Plaquemine, 2023

On July 14, 2023, explosions and fires in the Glycol II unit at Dow’s Plaquemine, Louisiana site released more than 31,000 pounds of ethylene oxide. No one was injured, but local authorities ordered hundreds of nearby residents to shelter in place. The CSB found that metal debris from portable work lights, left in a reflux drum after turnaround work, punctured a rupture disc. Ethylene oxide entered relief piping that had filled with air, ignited, and burst the drum.

The controls finding is about an alarm that did not exist:

• A pressure transmitter between the rupture disc and the relief valve had only a high-pressure alarm, set at 80 psig.
• For years it often read slightly negative, for example minus 0.073 psig, meaning air was getting in. No low-pressure alarm flagged it, and operators were not told to check it.
• Dow’s relief standard required only the high alarm, and there were no oxygen monitors on the discharge piping.

The CSB concluded that Dow “did not have an effective system in place to alert operations about the presence of or lack of an inerting atmosphere”. Its recommendation asks Dow to find every ethylene oxide line that should be inerted and is not continuously monitored, and to inert and monitor it.

Marathon Martinez, 2023

On November 19, 2023, a tube ruptured in a fired heater during startup of a renewable diesel unit at Marathon’s Martinez, California plant. More than 200,000 pounds of renewable diesel and about 2,200 pounds of hydrogen escaped, a field operator was burned over more than 80 percent of the body, and damage reached about $350,000,000. The plant makes renewable fuels, not chemicals, but its controls finding applies to any fired heater.

The heater’s safety instrumented system was meant to shut down the burners on low process flow. The CSB’s Martinez report found its flow meter sat upstream of the point where flow was diverted around the heater, so it “continued to indicate adequate flow”. There was “no control system data available to alert the board operators” to the diversion.

Neither the hazard analyses nor a review after a similar 2018 incident had found the gap. The CSB asked API to revise RP 556 to require protection “where process piping diverges downstream of a flow meter”, in “shall” rather than “should” language.

Arkema Crosby, 2017

When Hurricane Harvey flooded the Arkema organic peroxide plant in Crosby, Texas, the plant lost its power, its backup power, its refrigeration and the standby refrigerated trailers. Three fires burned more than 350,000 pounds of product, and more than 200 residents were evacuated for a week.

The CSB’s executive summary records the common-mode failure in plain words. “Backup generators turned on automatically, but the rising flood waters forced workers to turn them off for their safety.” The trailers that did send telemetry “only measured the air temperature inside of the trailer, not the temperature of the organic peroxide products”.

The CSB asked Arkema to make sure flood safeguards “meet independent layer of protection requirements” and that backup power works in extreme weather. EPA’s 2024 requirement for backup power on release monitoring addresses the same failure, and its 2026 proposal would rescind it.

Also on the record

• Givaudan Louisville, 2024: no alarm at a safe operating limit on a batch reactor, covered in the auditor section above. The report also notes that OSHA’s and EPA’s process safety rules do not cover many processes like it.
• Honeywell Geismar, 2021 to 2024: three hydrogen fluoride releases, a change management finding and the renewed request for organizational change review.
• PEMEX Deer Park, 2024: gas detectors out of service during a turnaround, covered in the hazardous-area section.
• West Fertilizer, 2013: an ammonium nitrate explosion that killed 15 people, 12 of them emergency responders. The CSB’s report has no control system finding. Not every disaster is a controls story.
• Remote isolation, 2024: a CSB safety study on incidents that escalated “due to the lack of effective remote isolation equipment”. It asked EPA and OSHA to require an evaluation of remote isolation devices in hazard analyses. Both recommendations are open.
• Open investigations as of October 28, 2026 include Horizon Biofuels in Nebraska, Accurate Energetic Systems in Tennessee, Woodland Pulp in Maine, Catalyst Refiners in West Virginia and Nippon Dynawave Packaging in Washington.

Our reading

Across the five recent reports with a controls finding, we see one pattern. The plant had the measurement or the protective function, but not where, in the mode, or with the alarm it needed:

• at Plaquemine, a transmitter with no low-pressure alarm;
• at Monaca, alarms suppressed by design in the mode that mattered;
• at Martinez, a flow meter upstream of the diversion;
• at Givaudan, no alarm at a safe operating limit;
• at Deer Park, detectors out of service during a turnaround.

None of these is exotic engineering. Each is the kind of gap a skilled engineer walking the unit with the drawings would ask about. That is the work that thins out after commissioning.

What did TRITON change, and where do CIRCIA and CFATS stand?

TRITON showed in 2017 that attackers will go after the safety system itself: they reached an SIS engineering workstation at an oil refinery and reprogrammed safety controllers. None of 44 public chemical companies we checked has filed a material cyber incident report since late 2023. CFATS has been unenforceable since July 2023, and CIRCIA’s reporting rule is still not final.

TRITON

In December 2017 Mandiant reported an attack on safety controllers, using malware it named TRITON. The attacker “gained remote access to an SIS engineering workstation and deployed the TRITON attack framework to reprogram the SIS controllers”. Some controllers “entered a failed safe state, which automatically shutdown the industrial process”, because code on redundant processors failed a validation check. The safety system tripped the plant, as it was designed to do when its own checks failed.

CISA’s advisory on the affected Triconex controllers says the malware needed “unrestricted access to the safety network” and the controller’s key switch in “PROGRAM” mode. The recommendations Schneider Electric issued through CISA are plain:

• keep controllers in locked cabinets and never leave them in program mode;
• never connect the safety engineering workstations “to any network other than the safety network”;
• scan removable media before use.

An OT network assessment checks for these paths, including any route from the business network to a safety workstation.

In March 2022 a joint advisory from CISA, the FBI and the Department of Energy tied TRITON to a Russian state research institute after the Justice Department unsealed indictments. It identified the 2017 target as “a foreign oil refinery”, which shut down for several days.

The physical layer of that advice, a locked switch and a separate workstation, is the same one Monaca turned on. There, at the engineer’s request, an instrument technician took the safety system out of its locked state ten minutes before the wrong valve was opened.

What the filings show

From December 18, 2023, when the SEC’s cyber disclosure rule took effect for most companies, to October 28, 2026, none of 44 active US filers with a chemical industry code filed a material cybersecurity incident report. A material incident has to be reported within four business days of being judged material. The 44 run from Dow and LyondellBasell to fertilizer, coatings and ethanol makers, with no pharmaceutical companies among them.

Together they filed 1,446 current reports in the period. The rule covers only incidents judged material, so the result says nothing about smaller ones. We also found no chemical-sector OT incident from 2023 to 2026 confirmed by a filing, CISA or the company itself.

The last documented case is older. In March 2019 the LockerGoga ransomware disrupted the chemical makers Hexion and Momentive and the aluminum producer Norsk Hydro, blocking files and passwords across “corporate and production control systems”. Getting controllers back after an attack depends on clean backups, as our controller ransomware recovery runbook explains.

The current threat is often cruder: CISA warned in December 2025 that pro-Russia hacktivists were reaching control systems through “minimally secured, internet-facing virtual network computing (VNC) connections” and changing setpoints on operator screens. Our guide to locking down vendor remote access covers closing those doors.

The rules

• CIRCIA, the US incident reporting law, will require covered entities to report significant cyber incidents to CISA within 72 hours and ransom payments within 24. It takes effect only with a final rule. CISA proposed one in April 2024, held town halls in June 2026 and says on its CIRCIA page that it “continues to work on the final rule”. The statutory deadline of October 4, 2025 has passed.
• Who CIRCIA would cover. The proposal captures chemical plants through CFATS. Because CFATS has lapsed, it would fall back to facilities under EPA’s Risk Management Program.
• CFATS remains lapsed, as the rules section describes, and ChemLock remains voluntary.
• NIS2 in the EU lists the manufacture, production and distribution of chemicals as a covered sector for medium and larger companies. In January 2026 the European Commission proposed to clarify how the directive covers the chemical sector.
• Canada’s Bill C-8, which received Royal Assent in June 2026, creates cyber duties for designated operators in finance, telecommunications, energy and transportation. Chemicals are not among the sectors named.
• The standards: ISA’s technical report TR84.00.09-2024 addresses cybersecurity across the safety lifecycle, and ISA/IEC 62443 covers the rest of the control system.

How do you migrate a DCS or PLC system inside a turnaround window?

By doing almost everything before the window opens. An ethylene unit may stop only once every five to eight years, for 30 to 60 days. In the plants we have worked in, windows were very short and the work ran in parallel with the live process. One published case moved 1,800 I/O points in five days of a ten-day shutdown.

The clock

Westlake Chemical Partners says each of its ethylene facilities has a turnaround “approximately once every five to eight years” and does not operate for “typically between 30 and 60 days” during each one (annual report). That puts planned turnaround downtime at roughly 1.0 to 3.3 percent of calendar time. It also means a control system migration that misses one window may wait five years for the next. In our view, that is why a modernization roadmap has to be built on the turnaround calendar.

Turnarounds are big events. For the first quarter of 2020 alone, Industrial Info Resources listed unit turnarounds worth more than $810,000,000 in maintenance projects across the US chemical industry, with single units scheduled for about 6 to 15 weeks. Practitioners in public forums tell of turnarounds that ran far past plan: one scheduled for 45 days still running at day 82, another planned for 60 days that took more than 130. Those are anecdotes from unnamed sites, not data.

Turnarounds are also when protection is weakest. At Dow Plaquemine, debris left after turnaround work started the chain of events. At PEMEX Deer Park, the gas detectors were down for turnaround maintenance.

What we have seen

Besides short windows at running plants, we have moved a plant that was not running from Rockwell to Siemens. An idle plant removes the window but not the risk. The risk moves to the restart, when every loop and interlock has to be proven before the process comes back.

A platform change is a re-engineering job, not a conversion. One practitioner noted there are no conversion tools from DeltaV to a PLC platform. The logic has to be understood, which brings back the point about knowing the process, and then rebuilt.

The installed base

Much of what has to move is old:

• Honeywell says its coax platform, which includes the LCN and UCN networks, the xPM controllers and the FSC safety controllers, “has been in service for nearly three decades”. All coax products moved to “Phased Out” support on December 31, 2025, which means no new parts. Support after phase-out focuses on “restoration of service/operations only”, with “no Root Cause Analysis”. Honeywell encourages all coax transitions to be complete by 2027. It expects risk to rise rapidly after the phase-out, because of scarce parts and the “rapid decline of skills proficient in the obsolete technology”.
• ExxonMobil told Honeywell’s users group in 2018 that its TDC 3000 base faced a critical shortage of spare parts by 2025. It had asked Honeywell in 2011 for a way to migrate without wholesale replacement. That is an oil and gas owner’s account.
• Emerson says the legacy systems it migrates are “more than 30+ years old”, most “placed in to end of life or retired lifecycle status”, with “no further factory support”.
• ABB runs a four-phase life cycle for its DCS products (Active, Classic, Limited, Obsolete) and says “no service is guaranteed” once a product is obsolete. For Rockwell controllers, our Allen-Bradley lifecycle guide covers the equivalent statuses.
• ARC Advisory Group estimated in 2015, as relayed by a vendor, that $65,000,000,000 of installed process automation was nearing the end of its life.

Honeywell’s warning about skills is close to the position of this guide, in a vendor’s own words.

What the vendors offer

Every supplier sells a way to keep the field wiring and cut over fast:

• Emerson says its DeltaV MQ controller migrates PROVOX and RS3 with existing PROVOX I/O that “remains in place”, up to 750 real I/O signals per controller. It claims cutovers of “600 I/O points in an 8-hour shift” for its wiring-retention approach.
• Schneider Electric says its programs for Honeywell and Bailey systems keep “your current wiring and cabinet in the same place” and “reduce downtime from weeks to just days”.
• Honeywell released an emulation of its TDC system in 2018 that ExxonMobil described as “100% binary compatible”, with bridge devices for hot cutover: migration while the process runs.

These are vendor claims. The one sourced chemical plant case with a window and a duration is also a vendor’s.

In 2015, at SP Chemical’s caustic soda and aniline plant in Taixing, China, Yokogawa replaced the control system of a 1,800 I/O membrane electrolyzer unit. The plant “could only be shut down for just 10 days”. Yokogawa kept the original cabling and cabinets, tested the new hardware on mounting plates before the shutdown, and finished installation and cutover in five days.

Before, inside and after the window

What makes a short window work is the work done before it:

1. Before: the scope and the I/O list frozen; the new system tested at the factory (factory acceptance testing); panels pre-wired and termination plans drawn; a loop-check plan by cabinet; the change review approved; operators trained on the new screens. PSM requires training before startup.
2. Inside: the cutover, cabinet by cabinet or unit by unit; loop checks; interlocks and trips proven; the pre-startup safety review where the process safety information changed.
3. After: the punch list closed, drawings and procedures updated, and the old system’s spare parts kept until the new one has run a full cycle.

Hot cutover, where the platform supports it, moves part of this out of the window. A cold cutover has to fit inside it. Our guide to planning a platform migration covers like-for-like against re-architecture. Our PLC migration consulting plans the work around the windows a plant actually has.

Is hydrogen a control-system project?

Yes, though a smaller one than the plans of 2023 implied. Electrolyzer plants need controls, safety systems and hydrogen codes such as NFPA 2, and chlor-alkali plants already run electrolysis under a distributed control system. The money has shrunk: the 45V credit now needs construction to start before 2028, and DOE ended 321 awards in October 2025.

The money first. The federal clean hydrogen credit, 26 U.S.C. 45V, now requires construction to begin before January 1, 2028. Public Law 119-21 moved that deadline from 2033 in July 2025. Treasury issued final regulations in January 2025, and no revision had appeared in the Federal Register by October 2026.

The Department of Energy ended 321 awards for 223 projects on October 1, 2025, and California said the cuts included up to $1,200,000,000 for its hydrogen hub. Air Products took about $3,600,000,000 of project exit costs in fiscal 2025, mostly in clean energy. ExxonMobil paused its Baytown low-carbon hydrogen project, saying “neither policy nor the market was sufficient to warrant our continued investment”.

The controls work is real where projects survive. Hydrogen brings its own documents:

• NFPA 2, the Hydrogen Technologies Code, now in a 2026 edition, and NFPA 55 for compressed gases, also 2026.
• OSHA’s 1910.103, which covers delivered hydrogen systems at user sites but not hydrogen manufacturing plants. It still cites editions from the 1960s.
• EPA’s Risk Management Program, which lists hydrogen at a threshold of 10,000 pounds, and Canada’s Environmental Emergency Regulations, at 4.50 tonnes.
• CGA G-5.5, updated in September 2026, which covers vent systems, including “manually and automatically operating a vent system”.

The Department of Energy notes that hydrogen “burns with a nearly invisible flame”, so “special flame detectors are required”.

None of this is new to chemicals: hydrogen is already a co-product of chlor-alkali electrolysis, as the Olin and Taixing examples above show. Canada adds an investment tax credit of 15 to 40 percent of the cost of eligible equipment, depending on carbon intensity. Electrolyzer makers, project lists and renewable fuels are covered in the industries guide linked at the top of this page.

Where should a chemical plant start?

With an honest inventory, because years of thin engineering attention leave drift. List every controller, network and safety system with its support status, check every interlock and alarm against its documented basis, and map the turnarounds for the next five years. That shows what is obsolete, what is unproven and when each fix can happen.

Three lists

The inventory has three parts, and each answers a different question:

• What is obsolete. Every controller, network, operator station and safety system, with its version and the supplier’s support status. Phrases like “Phased Out”, “Obsolete” and “no further factory support” in the notices above are the ones to look for. Our page on building an OT asset inventory covers how to collect it.
• What is unproven. Every interlock, trip and alarm, checked against its documented basis. The questions in the safety system and auditor sections are the test: what is bypassed, what is suppressed and in which modes, and which logic changed without a record.
• When it can change. Every planned turnaround and shutdown for the next five years, with what each window could hold.

Put the three together and the plan writes itself: obsolete and unproven items, sorted into the windows that can take them, with the functional safety engineers in the room for anything that touches the SIS. Our guide to control system modernization strategy covers sequencing that plan across a site.

The measures, said plainly

Few public benchmarks exist for chemical plant control systems, and some of the common ones do not fit:

Measure	What a public source says	Use it as
Mechanical availability	A benchmarker said in 2014 that top performers approach 99 percent while spending 1.4 percent of plant replacement value on maintenance, across refineries, chemical plants and other facilities	A 12-year-old, cross-industry reference point
Planned turnaround downtime	About 1.0 to 3.3 percent of calendar time, from Westlake Chemical Partners’ stated cycle	Arithmetic for one company’s crackers
Alarm rate	About 6 an hour per console on average, about 12 at most, from summaries of ISA-18.2 guidance	A target, measured from the alarm log
Safety function demand rate	No public data found	Your own records only
Batch right-first-time	“60% to greater than 90%” with batch software, one integrator’s claim from 2007	A vendor claim, not a benchmark
OEE	Our view: not the natural measure for continuous units, which track availability and on-stream time	Packaging and discrete lines only

Sources: Solomon Associates via Hydrocarbon Engineering (2014); Westlake Chemical Partners 10-K for 2025; ISA InTech and Control Engineering summaries of ISA-18.2; Control (2007). The OEE row is Joltek's opinion.

Where OEE does fit, on packaging and discrete lines, our guide to measuring OEE from the machine up covers how.

The position, restated

Chemical plants are messy and neglected because, once a plant is commissioned, it gets far less highly skilled engineering work than it did during the build. The CSB’s request for change review of staffing cuts and budget cuts, and Honeywell’s warning about vanishing skills, point the same way. The fix is to put skilled attention back on the plant on a schedule, not only when something forces it.

Where the plant has no one to own that work, an owner’s engineer can hold the inventory, the change process and the migration plan across the vendors and integrators who do the work.

Chemical plant automation glossary

Forty terms a newcomer meets in a chemical plant’s control room and audit file, with the rule, standard or source behind them where one exists.

Show all 40 terms

Advanced process control (APC)

Multi-loop and multivariable control, including model predictive control, built on top of a unit's regulatory controllers.

Alarm flood

A burst of alarms faster than an operator can handle. Published summaries of alarm management guidance define it as more than 10 alarms in 10 minutes.

Basic process control system (BPCS)

The instrumented system that provides the normal, everyday control of the process, usually a DCS or PLCs, as distinct from the safety instrumented system.

Burner management system (BMS)

The safety system for fired equipment such as furnaces, heaters and boilers. ISA's technical report TR84.00.05-2009 covers identifying its safety instrumented functions.

CFATS

The Chemical Facility Anti-Terrorism Standards, a CISA security program for high-risk chemical facilities. Unenforceable since its authority expired on July 28, 2023.

Chlor-alkali

The electrolysis of salt, which co-produces chlorine, caustic soda and hydrogen at a fixed ratio: 1.0 ton of chlorine to 1.1 tons of caustic soda and 0.03 tons of hydrogen.

Commodity chemical

A basic, relatively inexpensive chemical made in large quantities in a large plant and usually sold on price. Feedstock and materials can be more than 65 percent of its cost.

Data historian

A centralized database that supports data analysis using statistical process control techniques, in NIST's definition. In a chemical plant it holds the process data that trends, reports and investigations rely on.

Decoking

Burning out the coke that builds up inside a cracking furnace's radiant tubes. A patent filing puts run lengths between decokes at 5 to 60 days.

Distributed control system (DCS)

A control system whose intelligence is distributed about the process rather than held in one central unit. NIST lists chemical manufacturing among the industries that use one.

Division and zone

The two ways OSHA lets a plant classify flammable gas areas. Division 1 and Zone 1 are where ignitable concentrations are likely in normal operation; Division 2 and Zone 2 are where they occur only in abnormal conditions; Zone 0 is where they are present continuously.

Ethernet-APL

Two-wire Ethernet for field instruments, including in hazardous areas, built on the 10BASE-T1L physical layer: up to 1,000 meters, trunk and spur, power for up to 50 devices.

Fire and gas system

The detection and alarm system for fire, combustible gas and toxic gas. ISA's technical report TR84.00.07-2026 covers evaluating how well it works.

FOUNDATION Fieldbus H1

A digital, two-way, multi-drop link between intelligent field devices and automation systems at 31.25 kbit/s. About 4 percent of FieldComm Group devices installed, in a 2019 study.

HART

The protocol that superimposes digital communication on 4 to 20 mA analog wiring without disturbing the analog signal. HART devices were 60.3 percent of FieldComm Group devices installed, in a 2019 study.

HAZOP

A hazard and operability study, one of the process hazard analysis methods OSHA's rule names.

HON

EPA's air toxics rules for the synthetic organic chemical manufacturing industry, amended in 2024, with relief device monitoring and fenceline monitoring requirements.

Hot cutover

Replacing control system components while the process keeps running, also called on-process migration.

ISA-88

The batch control standard, with a physical model of the equipment, a procedural model of how to use it, and five functions: recipe management, scheduling, sequential control, regulatory control and safety interlocks. IEC 61512-1 is its international counterpart.

ISA-95

The standard for linking control systems to business systems, with five levels from the physical process (Level 0) to business planning and logistics (Level 4).

Laboratory information management system (LIMS)

Sample-centric laboratory software focused on data analysis, workflow and the features needed to meet regulatory requirements.

Layer of protection analysis (LOPA)

A simplified risk method between a qualitative hazard analysis and a full quantitative one, giving "an order-of-magnitude estimate of risk". CCPS calls it an excellent way to set the SIL a function needs.

Management of change (MOC)

Under OSHA's process safety management standard, written procedures to manage every change to process chemicals, technology, equipment, procedures and facilities, except a replacement in kind.

Manufacturing execution system (MES)

Software at ISA-95 Level 3 that manages manufacturing operations such as batch records and scheduling.

Mechanical integrity

The PSM element that requires written procedures, training, and inspection and testing of process equipment, including emergency shutdown systems, alarms and interlocks.

Module Type Package (MTP)

A vendor-neutral description of a process module's interfaces and functions, so a skid can plug into an orchestration layer. Version 2.0 was released on January 20, 2026.

NAMUR Open Architecture (NOA)

A second communication channel that sends plant and asset data to monitoring and optimization applications without changing the automation system.

O-PAS

The Open Process Automation Standard from The Open Group. The 2nd Edition was published on February 6, 2023, and certification began on October 1, 2024.

Pre-startup safety review

The PSM review before a new or significantly modified process starts, confirming equipment, procedures and training are ready.

Process hazard analysis (PHA)

The PSM study of a covered process's hazards and the controls against them, revalidated at least every five years.

Programmable logic controller (PLC)

A solid-state control system with user-programmable memory for functions such as I/O control, logic, timing, counting, PID control and communication.

RAGAGEP

Recognized and generally accepted good engineering practices: the yardstick PSM uses for equipment design, inspection and testing, without naming any particular code.

Recipe

The materials, quantities and steps that define how to make one product. ISA-88 keeps it separate from the equipment logic that runs it.

Risk Management Program (RMP)

EPA's accident prevention rule, 40 CFR Part 68. Program 3, its strictest tier, parallels PSM. A 2026 proposal to roll back the 2024 amendments was not final in October 2026.

Safety instrumented function (SIF)

One protective action of a safety instrumented system, from sensor through logic solver to final element, that takes the process to a safe state.

Safety instrumented system (SIS)

The sensors, logic solver and final elements that perform safety instrumented functions. IEC 61511 and its US adoption, ANSI/ISA-61511, cover its lifecycle.

Safety integrity level (SIL)

An order-of-magnitude band of risk reduction for a safety function. For rarely demanded functions, SIL 1 is a reduction of 10 to 100, SIL 2 of 100 to 1,000 and SIL 3 of 1,000 to 10,000.

Specialty chemical

A differentiated product made in lower volumes than basic chemicals and sold "for what they do, rather than for what they contain".

Steam cracker

The unit that makes ethylene and propylene by subjecting hydrocarbons such as ethane to high temperatures in the presence of steam.

Turnaround

A planned shutdown for inspection, replacement and overhaul. One partnership's ethylene facilities have one about every five to eight years, lasting typically 30 to 60 days.

Definitions draw on NIST SP 800-82 Rev. 3 (DCS, PLC, historian), the UK Health and Safety Executive (BPCS), the HART Communication Foundation and the Fieldbus Foundation, OSHA and EPA rule text, ISA and IEC catalog pages, CCPS, and the sources cited in the body of this guide.

Frequently asked questions

Does the safety instrumented system have to be separate from the DCS?

It has to be independent, which is not the same as a different brand. Industry guidance on IEC 61511 reads it as requiring independence between control and safety, with an assessment of common cause failures. Vendors sell integrated platforms with separate, certified safety logic solvers, and others argue for a fully separate layer. Either way, the plant must show independence in hardware, in people and procedures, and against cyber attack.

Does a PLC or DCS program change need management of change under PSM?

At a process covered by OSHA’s process safety management standard, yes, unless it is a replacement in kind. The rule requires written procedures that address the technical basis, the safety impact, procedure updates, timing and authorization before a change. The rule text never mentions software, but OSHA’s non-mandatory Appendix C lists computer program revisions and changes in alarms and interlocks among the changes management of change covers.

Should a chemical plant use a DCS or a PLC?

It depends on the plant’s scale, how tightly its units interact, and who will support the system for decades. Distributed control systems run many large continuous units. Most chemical plants are small. In the chemical plants we have worked in, the control system was mostly Rockwell PLCs, with some Siemens, and batching ran on PlantPAx. The products keep converging, so support matters more than the label.

Can PLC code run batches, or do we need ISA-88 batch software?

PLC code can run batches, and many plants do it with hard-coded sequences. That works when a plant makes a few fixed products. When grades, recipes and shared equipment multiply, batch software built on ISA-88 pays, because it keeps the recipe separate from the equipment logic, so a new product becomes a new recipe rather than a code change. IEC revised ISA-88’s counterpart, IEC 61512-1, in February 2026.

How long does a control system migration take, and does it need a shutdown?

The cutover can be short if the work is done beforehand. In one published case, Yokogawa replaced the control system of a 1,800 I/O electrolyzer unit at a caustic soda plant in five days of a ten-day shutdown, keeping the original wiring and cabinets. Some platforms support cutover while the process runs. In the plants we have worked in, windows were very short and the work ran in parallel with the live process.

Is CFATS still in effect?

No. The Chemical Facility Anti-Terrorism Standards program has been unenforceable since its statutory authority expired on July 28, 2023. As of October 2026, CISA’s page still says it cannot enforce compliance, require security plans or inspect facilities. CISA offers ChemLock instead, a voluntary program of no-cost assessments, guidance, exercises and training for facilities that hold dangerous chemicals.

Keeping the plant from drifting

In chemical plant automation, the control system is three things that must not lean on each other: the system that runs the process, the system that trips it, and the records that prove which is which. Commissioning usually gets them right. The years after are where they drift, because the plant gets far less skilled engineering attention than the build did. Logic changes go unrecorded, alarms get suppressed to quiet a flood, and a platform runs past the end of support until the next turnaround forces a decision.

The CSB’s recent reports show where that drift ends: a safety system overridden in debug mode, an alarm that did not exist, a shutdown that could not see the flow it protected. The fixes are rarely exotic. They are an inventory, a change process that covers logic, an alarm system operators trust, and a migration plan built around the windows the plant actually has.

Joltek helps plants start there. A plant systems assessment maps the installed base, its support status and its risks into a sequenced plan. Where a migration is due, our control-system modernization work plans it around the turnaround. The simplest first step is to book a free modernization consultation.

Photos, all via Wikimedia Commons: header photo of distillation columns by CEphoto, Uwe Aranas, licensed CC BY-SA 3.0, cropped and resized; cracker furnace block by DRajkhowa, licensed CC BY-SA 4.0, resized; heat exchanger bundle by CEphoto, Uwe Aranas, licensed CC BY-SA 3.0, cropped, resized and with a name patch removed. The adapted versions are shared under the same licenses.