ANSI/ASSP Z590.3: 5 decisions that keep hazards out of design

A plant can say it believes in prevention through design and still leave the riskiest choices to the field. ANSI/ASSP Z590.3 matters because it asks a harder question: which hazards can still be removed while the layout, access route, isolation point and maintenance method are still changeable?

Most organizations only notice the gap when the permit is already open. By then, the team is compensating for a design decision it did not make, which is why a standard that looks technical is actually a governance tool. If the drawing freezes the risk, the field inherits the consequence.

Why ANSI/ASSP Z590.3 is not a paperwork standard

The standard is not about filling a binder. It is about moving risk upstream before the field inherits it. If the only time the team talks about safety is after procurement or just before startup, prevention through design has already been reduced to decoration.

Andreza Araujo's The Illusion of Compliance makes the same point from a different angle. A process can look disciplined and still miss the real barrier, because the real decision was never moved far enough left.

This is why the article on permit-to-work, JSA and field verification still matters. The gate that owns the work later is not the same as the gate that should own the hazard earlier.

Decision 1: Start with the hazard, not the equipment

A design brief that starts with the equipment specification usually arrives too late to remove the most important hazard. The better question is what the work can injure, trap, expose or isolate badly, and only then which equipment meets that hazard profile.

That shift changes procurement, controls and layout. It also changes who has to be consulted, because the maintainer, the operator and the contractor all inherit different parts of the risk. If their work is not in the brief, their reality will not be in the design.

The article on MOC, PSSR and field verification shows the next step. If the hazard moved but the proof did not, the team has only renamed the problem.

Decision 2: Design maintenance access before procurement

A surface that is easy to inspect from the drawing room can still be hostile in the field. Maintenance access, lifting clearance, line of fire, LOTO reach, work at height and rescue space all belong in the design brief, because every one of them becomes a future human error multiplier if it is postponed.

When the task is awkward, people take shortcuts that do not look like shortcuts on paper. They bend, stretch, bypass or improvise, and the organization later calls the outcome operator behavior even though the geometry was the first mistake.

Read the article on pre-startup safety review alongside this section. A good PSSR should not merely ask whether the equipment works; it should ask whether a human can reach, isolate, clean, inspect and exit without converting routine work into a recovery event.

Decision 3: Verify the barrier in the real field

Design is not real until it is touched by the field. The gap between a nice drawing and a verified barrier is where a lot of safety theater lives, because a symbol on a P&ID does not prove that a valve can be reached, tagged, locked or restored under real conditions.

This is where field proof gap logic becomes useful. James Reason's latent-failure lens helps here too, because the harm often begins upstream, when the organization accepts a control as real before anyone has tested it in the exact place where the task happens.

The comparison below is crude on purpose. If the team wants prevention through design, it should be able to say whether it is still in the drawing stage, in the verification stage or in the field reality stage.

The article on Bow-Tie, FMEA and critical control verification is a useful companion when the team needs to decide how much proof is enough before startup or changeover.

Decision 4: Separate normal use from abnormal states

The design mistake most teams repeat is assuming the normal state will protect them from the abnormal one. It will not. Cleaning, startup, shutdown, bypasses, temporary power, temporary lighting, override states and post-maintenance restarts create their own hazard map, and that map often looks nothing like the steady-state drawing.

A design that ignores abnormal states asks the supervisor to solve a system problem with a permit. That is why permit discipline matters, but only after the design has made the abnormal state visible and manageable.

The article on permit-to-work explained shows where the field gate belongs. The article on shift-change stop-work rehearsal shows why handover is part of the same barrier, because the state of the work changes even when the equipment does not.

Decision 5: Make handover part of the design

Handover is not just a meeting between shifts. It is the moment when a control that looked strong in one context becomes weak in another, because the next team may not know which isolation, temporary bypass, access restriction or acceptance condition was left behind.

Good design makes the handover visible. Labels are readable, control states are obvious, temporary conditions are time-bound, and the decision log is short enough that the next person can use it under pressure.

This is why the control architecture has to be visible to supervisors, project engineers and maintainers alike. If only one specialist understands the system, the rest of the organization is borrowing confidence from someone else's memory.

What a plant team should do in 30 days

In the next month, pick one active or upcoming change and review it from the hazard backward. Start with the injury or exposure, then check whether the layout, access, isolation, rescue and handover all reduce that hazard before the permit stage ever begins.

• Review five recent work packages where the crew had to improvise.
• Check whether the maintenance team can reach, isolate and restore the critical point without extra tools or workarounds.
• Ask whether the design review included the people who will actually clean, inspect, repair and restart the equipment.
• Compare the field condition against the drawing, not against the intention.

If you want a simple rule, use this one. Any design that needs a sentence like "the crew will figure it out in the field" is not yet finished.

The operational question is not whether the standard sounds good. The question is whether the next job becomes easier to do safely because the hazard was removed early enough to matter. If it does not, the design review was only a formality.

Recommendation

Use ANSI/ASSP Z590.3 as a decision filter, not as a citation on a slide. The standard earns its place when it changes the work before the work changes the people.

If your team wants the companion lens, start with the article on field proof gap, then compare it with MOC, PSSR and field verification and permit-to-work, JSA and field verification. The sequence matters because prevention has to be designed, proved and then governed in the field.

Headline Podcast exists for this kind of conversation, where the gap between policy and practice gets named instead of hidden. If this lens is useful, follow the show at headlinepodcast.us and share the article with the person who signs off on the next change.