It is 04:40 on a cold-morning restart at the mill, outside air around minus two, and the 42-bar main steam header has been off load for thirty-six hours during a planned outage. The operator cracks the eight-inch warm-up valve maybe a quarter turn — exactly what the procedure asks for — and fifteen seconds later we feel the deep metallic knock travel down the pipe rack above our heads. Three hundred metres of header, a handful of trapped condensate pockets, a too-fast warm-up, and the whole line has just taken a shock loading that a correctly populated set of drip legs and traps would have absorbed in silence. No one gets hurt. But that knock is the sound of stored pressure energy telling you it could have been very different.
Steam hazards in the workplace sit in a strange blind spot. Everyone in industry knows steam is hot; far fewer appreciate that a leak you cannot see carries nine times the thermal punch of boiling water, that a “small” water hammer event has enough energy to split carbon-steel pipework, or that a legally compliant steam plant requires a formally written examination scheme signed off by a competent person before you are allowed to put it under pressure. This guide walks through the full risk picture — burns, ruptures, water hammer, asphyxiation, noise, chemical exposure — and maps each one to the engineering, administrative and regulatory controls that actually reduce incidents. It is built for HSE professionals, steam engineers, maintenance planners, and process safety managers who need something more than a bullet-point checklist.
Why Steam Is More Dangerous Than People Assume
The word “steam” hides its physics behind a familiar domestic image — a kettle, a bathroom mirror. Industrial steam is a different animal, and the difference is measurable. When one gram of water at 100 °C flashes to vapour at 100 °C, it absorbs approximately 540 calories of latent heat with no temperature change at all. When that gram of vapour meets cooler skin and condenses back to liquid, every one of those 540 calories is dumped into tissue in the milliseconds of the phase change. Raising the same gram of liquid water from body temperature to boiling requires only about 63 calories of sensible heat. That is the nine-to-one ratio that makes steam burns typically deeper and slower to present than scalds from an equal mass of boiling water — a difference well documented in burn-centre literature and described in Wayne State University physics resources as the defining feature of phase-change thermal transfer.
Temperature is the second layer. Superheated steam at 45 bar sits around 300 °C; the pipework containing it sits at the same temperature. Lagging hides that reality until it is removed during maintenance. Dry and superheated steam are also essentially invisible at the leak point — the familiar white cloud people associate with steam is already partly condensed. A pinhole leak on a superheated line produces a near-transparent jet that is hot enough to strip flesh to the bone and quiet enough to walk into.
Add stored pressure energy and the picture completes. A pressure vessel or header is a spring holding back hundreds of cubic metres of compressed gas at temperature. Release that energy uncontrolled — through a rupture, a failed closure, a failed safety valve — and you are looking at an event that can level buildings. The ASME Boiler and Pressure Vessel Code exists today because in 1905 the Grover Shoe Factory boiler failed in Brockton, Massachusetts, killing fifty-eight people and injuring one hundred and seventeen. The Code has been refined continuously since; what has not changed is the underlying physics it is trying to contain.
Field Test: On your next walkdown, hold a gloved palm 300 mm from any uninsulated elbow on a steam main. If you feel the radiant heat through a thermal glove in under three seconds, the insulation job is not finished — regardless of what the lagging inspection report says.
The Main Steam Hazards at Work
Listing “steam hazards” as one thing is the first error. What exists on a steam system is a family of hazards, each with its own mechanism, population exposed, and control set. The taxonomy below is the reference frame the rest of this article works against.
Thermal Burns and Scalds from Steam and Hot Surfaces
The single most frequent steam injury is direct thermal contact — with escaping steam, ejected condensate, or uninsulated hot surfaces. Saturated steam at modest operating pressures already sits well above 150 °C; superheated lines can exceed 300 °C. The distinction between a burn and a scald matters clinically: a scald is a thermal injury from hot liquid or moist heat, while a burn is from a hot solid, flame, or radiant heat. Steam exposure can produce both in the same event. Burn-centre data reported via the American Burn Association shows that at 60 °C water causes full-thickness damage in about five seconds, and at 68 °C in roughly one second. Steam, condensing against skin at 100 °C or higher, accelerates that timeline further because of the latent-heat dump described earlier.
Steam Inhalation and Airway Injury
The respiratory injury that steam causes is consistently undercounted. Inhaling even a short pulse of hot vapour damages the upper airway mucosa; larger exposures cause laryngeal oedema and can progress to acute respiratory insufficiency within hours. The clinical point — emphasised in burn literature — is that airway involvement is a medical emergency even when visible skin burns appear minor. On a paper machine deck where a broken header elbow was dropping steam onto the walkway grating, we lost the apparent casualty to the contact burn and nearly lost a second worker to inhalation after a short exposure while he tried to close the manual isolator.
Pressure Vessel and Pipe Rupture
Catastrophic failure of a pressure-retaining item is the low-frequency, high-consequence end of the spectrum. Causes cluster into overpressure (failed or undersized relief), low-water conditions in fired equipment, creep and fatigue in long-service headers, corrosion-under-insulation at uninsulated support saddles, and defects left by poor weld repairs. The historical record on boiler explosions is the reason the ASME BPVC exists, and the reason this hazard sits under some of the most prescriptive standards in industry.
Water Hammer and Condensate-Induced Shock
Water hammer is the failure mode that most often kills people on otherwise well-run steam plants, and it is almost always preventable. Three mechanisms produce it. Hydraulic shock occurs when a fast valve closure stops a slug of condensate dead and converts its kinetic energy into a pressure spike. Thermal shock occurs when live steam meets a pool of sub-cooled condensate and collapses violently into it, generating a travelling low-pressure wave. Differential shock occurs in two-phase lines where steam and condensate move at different velocities and the steam phase eventually picks the liquid up as a slug. The US Department of Energy Safety and Health Bulletin reproduced via the National Board documents water hammer as a confirmed cause of fatalities, severe injury, and extensive property damage — and notes how often a missed drip leg or a single failed-closed trap is the upstream cause.
Slip, Trip, and Fall Hazards
Condensate on floor gratings, steam clouds reducing visibility around leaks, and PPE face shields fogging during plume work all create secondary fall hazards. In a damp boiler-house environment these are the steam injuries that rarely make the incident headlines but consistently produce lost-time days.
Steam Trap Failure and Blowthrough
A steam trap that fails open passes live steam into the condensate return system — wasting energy, eroding return-line metallurgy, and creating scald risk at vents and receivers. A trap that fails closed holds condensate in the steam main, which is the seed condition for water hammer. UE Systems’ field surveys, widely cited in steam trap literature, report that up to roughly half of traps in unmanaged systems are found in one of these two failed states. That figure is not a footnote — it is the single most actionable data point in steam safety.
Confined Space and Asphyxiation Risks
Boiler firesides, steam tunnels, large receivers, and evaporator bodies become confined spaces the moment you open them for inspection. Residual steam displaces oxygen. Hot surfaces deliver conductive and radiant heat that can disable an entrant in minutes. Trapped condensate pools scald at first contact. Entry without a permit, gas test, attendance, and a rescue plan is a recipe for a fatality — and Confined Spaces Regulations 1997 in the UK, and 29 CFR 1910.146 in the US, exist precisely because this is a historically under-controlled hazard.
Vacuum Collapse of Vessels
This one catches people out. Close a vessel full of saturated steam, let it cool, and the steam condenses back to liquid. A small volume of water replaces a large volume of vapour, and the vessel experiences external atmospheric pressure on an internal near-vacuum. Drums have been crushed, tanks imploded, and cans flattened by this mechanism. The design countermeasure is a vacuum breaker sized to the condensation rate; the operational countermeasure is never to isolate a steam-charged vessel without breaking vacuum.
Noise-Induced Hearing Loss
Safety valve lifts, blowdown events, and steam trap discharges routinely exceed 100 dB(A) at working distance, with broadband hiss and transient spikes. Under OSHA 29 CFR 1910.95 and equivalent UK guidance, chronic exposure at these levels demands a hearing conservation programme, and transient events demand either distance or doubled-up hearing protection.
Chemical and Biological Hazards in Steam Systems
Boiler feedwater treatment chemicals — phosphates, amines, and historically hydrazine as an oxygen scavenger — are not inert. Spill handling, sampling, and chemical feed pump maintenance carry their own hazard profile. Flash steam from condensate contaminated by a heat-exchanger tube leak can carry process chemicals into the workplace atmosphere. In the wider plant, humidification systems and steam-adjacent warm water circuits are recognised Legionella risks and must sit inside the site’s water safety plan.
What Causes Steam Incidents — The Failure Modes Behind the Hazards
Naming hazards is the easy part. Understanding why they keep happening is where the engineering work lives. Steam incidents cluster into three causal categories: design shortcomings built in at the plant’s birth, maintenance deterioration that accumulates over years, and human-procedural gaps that surface under real operating conditions.
Design failures include inadequate condensate drainage on long horizontal runs, absent drip legs at low points, undersized or inappropriately selected steam traps, pipework laid with reverse slope or no slope, missing thermal expansion provision, and relief valves sized for the wrong fault case. These are the defects that sit quietly in a system until the first upset condition exposes them, and they are the reason the ASME BPVC governs design before a single weld is made.
Maintenance failures accumulate where the system is run on its asset register rather than its inspection data. Safety valves not tested or lifted on schedule drift upward in set pressure or fail shut. Pressure parts develop scale and corrosion the water treatment programme was supposed to catch. Insulation damaged during prior maintenance is never reinstated. And, most quantifiably, steam traps fail in both modes simultaneously across the plant — the UE Systems figure of roughly 50% trap failure in unmanaged systems is the maintenance metric that translates most directly into water hammer risk.
Human and procedural failures surface during non-routine operations. Cold start-ups pushed through the pressurisation window too quickly. Low-water trips bypassed during a combustion tuning session. Hot-work permits closed out before the pipework has actually depressurised. Operators trained to the boiler they joined on but not the unit the plant replaced it with. These are not competence problems in a character sense — they are training-system and permit-system problems, and they are where administrative controls earn their cost.
Which Industries and Roles Face the Highest Steam Risk
Steam is not confined to power stations. The exposure profile spreads across oil and gas refining, chemical and pharmaceutical processing, food and beverage (pasteurisers, cooking kettles, clean-in-place circuits), pulp and paper, textile and laundry, hospital sterilisation estates running autoclaves, district heating networks, and marine propulsion. Thermal burn data from the US Bureau of Labor Statistics shows manufacturing, food service, and accommodation consistently appearing in the highest-incidence sectors — roughly 11,840 US workers sustained thermal burns severe enough to result in days away from work in 2020 alone, as cited through Shannon Global Energy Solutions’ industry analysis.
Within those sectors, the highest-exposure roles concentrate on the people who open the system: boiler and utilities operators, steam fitters and pipefitters, process operators performing cooking and sterilisation cycles, insulation and lagging contractors removing cladding from live pipework, and maintenance fitters conducting hot-work on traps, valves, and instrumentation. Start-up, blowdown, trap inspection, hot bolting, and lagging removal are the tasks where the daily hazard meets the annual risk — routine in frequency, severe in consequence.
Controlling Steam Hazards — Applying the Hierarchy of Controls
The control logic that actually reduces steam incidents follows the NIOSH hierarchy of controls. Working from the top down — elimination, substitution, engineering controls, administrative controls, and finally PPE — produces fundamentally different risk reduction than jumping straight to gloves and face shields. The sections below map each tier to specific steam-system controls.
[INFOGRAPHIC]
Elimination and Substitution
The most effective control is the one that removes the hazard entirely. Where a process duty can be met with hot water, electric trace heating, or a closed-loop thermal-transfer fluid at lower temperature, switching away from live steam eliminates the burn and rupture pathways at source. Prevention-through-Design thinking — specifying the lowest fit-for-purpose operating pressure and temperature on a new plant, and challenging every steam distribution branch during design review — is substitution upstream, before the hazard is ever built.
Engineering Controls
Engineering controls are where most of the steam-system hazard budget is spent, and correctly so. The core hardware list includes pressure relief valves certified to ASME Section XIII (consolidated in the 2021 edition and carried through to the 2025 Edition of the BPVC) and sized to the governing overpressure scenario; an adequate population of correctly selected steam traps with drip legs at every low point; pipework sloped in the direction of flow with condensate drainage engineered in; insulation continuous across valves, flanges, and fittings both to reduce condensate formation and to protect personnel from contact burns; expansion loops and anchors matched to the thermal range; warm-up valves and bypasses around main isolation valves; remote actuation on critical isolations; clear labelling and colour coding of steam and condensate lines; and on fired plant, a burner management system compliant with NFPA 85 for units above 12.5 MMBtu/hr and ASME CSD-1 below that threshold, with low-water cut-offs and flame safeguards that cannot be bypassed under fault conditions.
Administrative Controls
Administrative controls govern how people interact with the engineering. A permit-to-work system covering hot work, vessel entry, and any intrusive maintenance on pressurised lines is non-negotiable. Lockout/tagout under OSHA 29 CFR 1910.147, or its UK equivalent under PUWER 1998 and associated isolation guidance, separates the energy source before the work starts. Under the UK Pressure Systems Safety Regulations 2000, the Written Scheme of Examination prepared by a competent person defines what parts of the system must be examined, how, at what frequency, and by whom — and the operator’s duty is to keep the system within its safe operating limits between examinations. Shift handover logs, blowdown and start-up procedures, and a formal steam trap management programme tie daily operation to the wider control scheme.
Personal Protective Equipment
PPE is the last line of defence, and it is not reliable against direct high-pressure steam jets. The specification that holds up against real steam-system exposure includes:
- Heat-resistant gloves rated for both steam temperature and condensate contact
- Face shield over safety glasses — the double barrier is deliberate for plume and blowdown work
- Flame-resistant or heat-resistant clothing covering arms and legs with no exposed gaps at the collar or cuffs
- Safety footwear rated for hot-liquid splash and the floor surface in the work area
- Hearing protection for anyone inside the discharge zone of a safety valve vent or blowdown tail pipe
OSHA’s general PPE guidance sets out the hazard-assessment framework that sits behind these specifications. What PPE cannot do is stop a pinhole jet of 40-bar saturated steam at short range — which is why the hierarchy above starts with elimination and engineering, not with what the operator is wearing.
Watch For: Any job plan that begins with “operator will wear additional PPE” without first describing how the steam pressure is isolated and the residual condensate drained. That sequence has the hierarchy exactly backwards.
Safe Work Procedures for High-Risk Steam Tasks
Controls become real at the point where a procedure tells a fitter what to do on Tuesday morning. Four task families produce most of the exposure and therefore deserve procedure-level treatment.
Cold start-up and warm-up of a steam main is the first. Pressurisation proceeds slowly through a warm-up valve sized for a controlled rate of rise — on large distribution systems this is commonly held to around five degrees Celsius per minute or less to manage thermal stress. Drain bleeds and all trap bypasses remain open throughout the warm-up, venting condensate to safe locations until dry steam is confirmed. Main isolation valves open only after the line is fully warmed and the pressure across them is near-equalised. The deep knock on that cold morning header I described in the opening was the result of a procedure that looked correct on paper but had lost the “hold the bleeds open until you see dry discharge” step two revisions back.
Blowdown operations follow a second procedure. The discharge line must terminate in a purpose-built blowdown vessel or a safe vent location outside the work area. Personnel clear the zone before the valve is cracked; eye protection and hearing protection are primary PPE, not discretionary. The sequence for an intermittent bottom blowdown — open the downstream valve first, then crack the upstream valve briefly, close the upstream first, then the downstream — is explicit in operator training because doing it in any other order places the closure valve under unnecessary thermal and flow stress.
Steam trap inspection and replacement is the third task. Isolate the trap from the steam main upstream and the condensate return downstream. Allow cool-down time proportional to the trap size and line pressure — trap bodies retain heat and residual pressure longer than intuition suggests. Verify zero pressure with a certified gauge before breaking any flange. Drain residual condensate to a safe container, not onto the walkway grating.
Boiler shutdown for internal inspection is the fourth. Full cool-down, drain, ventilation with forced airflow through the firesides and the steam drum, gas testing for oxygen deficiency and any process-chemical residue, and a confined-space permit with attendance are all mandatory under Confined Spaces Regulations 1997 in the UK and 29 CFR 1910.146 in the US. The fitter who walks into a “nearly cool” drum because the clock is tight is the incident report you spend the next year writing.
Legal and Regulatory Framework
Steam plants sit inside one of the most heavily regulated technical envelopes in industry, and the obligations are jurisdiction-specific. A dual reading — UK and US — is what most plants actually need, because ownership, supply chains, and insurance carriers cross borders.
In Great Britain, the governing instrument is the Pressure Systems Safety Regulations 2000. PSSR applies to systems containing relevant fluids, and critically, any system containing steam at any pressure falls in scope regardless of the pressure-times-volume threshold that determines scope for non-steam fluids. Regulation 7 requires a Written Scheme of Examination prepared by a competent person; Regulation 8 requires examination in accordance with that scheme; Regulation 9 requires operation within defined safe operating limits. HSE’s Approved Code of Practice L122 — recently revised with the PSSR decision tree repositioned to the front of the book for easier use — gives the ACOP the legal standing under the Health and Safety at Work etc. Act 1974 that makes it the benchmark against which enforcement decisions are made. Sitting on top of these: the Section 2 general duty of HSW Act 1974, the risk-assessment duty under Regulation 3 of the Management of Health and Safety at Work Regulations 1999, entry controls under Confined Spaces Regulations 1997, and the extended PPE duties under the PPE at Work (Amendment) Regulations 2022 that now cover limb (b) workers including many contractors. HSE’s PSSR landing page and its ACOP L122 publication page are the authoritative starting points for anyone new to the regime.
In the United States, the regulatory structure is layered differently. Design and construction of boilers and pressure vessels sit under the ASME Boiler and Pressure Vessel Code — Section I for power boilers, Section IV for heating boilers, Section VII for operation, Section VIII for pressure vessels, and Section XIII for overpressure protection, with the 2025 Edition published in July 2025 as the current reference. Combustion safety on automatically fired units follows ASME CSD-1 below 12.5 MMBtu/hr and NFPA 85 above that threshold. Post-construction installation, inspection, repair, and alteration follow the National Board Inspection Code. Workplace exposure is governed by OSHA: 29 CFR 1910.147 for lockout/tagout, 29 CFR 1910.146 for permit-required confined spaces, 29 CFR 1910.132 through 1910.138 for PPE, and 29 CFR 1910.95 for occupational noise. ISO 45001:2018 provides the management-system wrapper that most mature operators use to integrate all of the above into a single OHSMS.
The Written Scheme of Examination
Because it is the single most practically actionable legal obligation for any UK dutyholder, the Written Scheme of Examination deserves its own treatment. The WSE is a document prepared before the pressure system is used that identifies which items are in scope, defines the nature of the examination required for each, sets the maximum interval between examinations, and identifies the competent person responsible for preparing the scheme and carrying out the examinations. For steam systems, typical intervals run to fourteen months unless the scheme specifies shorter — and the dutyholder has no authority to extend them without a fresh determination from the competent person. The WSE is not an inspection certificate. It is the standing engineering judgement about how the system must be looked after.
How to Conduct a Steam Safety Risk Assessment
Steam risk assessments done against the HSE five-step framework are legally defensible; steam risk assessments done generically are neither defensible nor useful. The walkthrough below is the version I use on the mill’s annual review cycle.
Step one is to map the system. Boilers, headers, branch lines, pressure-reducing stations, heat exchangers, traps, condensate return, flash vessels, vents, drains, and chemical dosing points all go on the schematic. If the drawing is more than five years old and the plant has been modified since, the mapping exercise starts with a physical walkdown, not an office drawing review.
Step two is to identify the hazards at each asset against the taxonomy in this article. A PRV station: burn, noise at lift, rupture of upstream pipework, chemical exposure during servicing. A heat exchanger: burn from hot surfaces, tube leak driving chemical carryover into flash steam, confined space during internal inspection. A condensate receiver: scald from flash steam at the vent, vacuum collapse if isolated hot.
Step three identifies who could be harmed and how. Operators are the obvious population; contractors performing lagging or valve work, cleaners in the boiler house, visitors on facility tours, and workers in adjacent areas during a blowdown discharge all need to be on the list.
Step four evaluates existing controls against the hierarchy. The useful question at each asset is: can this hazard be eliminated, substituted, or engineered out further, or are we relying on administrative controls and PPE for risk reduction that should sit higher up the hierarchy? Every time the honest answer is the latter, the control gap goes on the action register.
Step five records and reviews. Review intervals follow the WSE cycle as a minimum, with immediate review after any plant modification, any change in operating regime, any incident, and any change in workforce composition that affects competence. A risk assessment with no revision history is a risk assessment that has been left to age.
Emergency Response and First Aid for Steam Incidents
The first sixty seconds after a steam injury set the clinical outcome. The protocol consolidated from the NHS, the American Burn Association, and occupational first-aid guidance is consistent across jurisdictions. Remove the casualty from the steam source. Cool the burn area under cool running water for twenty minutes — cool, not cold, and never ice. Remove jewellery, watches, belts, and loose clothing from the injured area before swelling sets in, but leave any clothing that is stuck to the skin alone. Cover the burn loosely with cling film or a clean non-fluffy dressing. Do not apply butter, toothpaste, creams, or any traditional remedy. Keep the casualty warm overall even while cooling the burn, because large burns precipitate shock.
Seek emergency medical care for any burn to the face, hands, feet, genitals, or major joints; any burn larger than the casualty’s hand; any burn that appears white, leathery, or charred (full thickness); any suspected airway exposure from inhaled steam; and any eye exposure. Airway involvement in particular can present subtly in the first minutes and deteriorate rapidly.
Major steam leak or rupture response follows a different pathway. Clear the affected zone. Activate remote isolation where the engineering design provides it, and initiate emergency shutdown of the upstream source. No one approaches the leak until the line pressure has demonstrably dropped and the casualty — if reachable — can be recovered without putting rescuers into the plume. Notify the dutyholder and, for reportable events in the UK, submit a RIDDOR report; in the US, follow the site’s OSHA reporting and, where applicable, CSB notification procedures.
Training and Competence Requirements
Training content on steam is often thin and generic — a boilerplate e-learning module that tells an operator what a pressure vessel is but not how the one in front of them responds to a low-water event. A usable training programme covers, at minimum, steam physics including latent heat and phase change; the specific layout and operating envelope of the plant the trainee will work on; start-up, shutdown, and emergency shutdown procedures; the site’s steam trap management programme; permit-to-work and lockout/tagout procedures; PPE selection and limitations; and burn first aid. Refresher training sits on a defined interval — annual for most operational roles, shorter where regulatory schemes require.
The PSSR-specific competence requirement is narrower and more demanding. The competent person preparing the Written Scheme of Examination or carrying out the examination under it must have the practical and theoretical knowledge and actual experience of the type of system, the independence and resources to make impartial judgements, and in practice certification through a recognised scheme. This is not an in-house role a plant engineer holds by default; it is a technical authority that the dutyholder appoints and is legally accountable for selecting.
Inspection, Testing, and Maintenance Programme
The cadence that actually prevents incidents runs on three timescales. Daily operator checks cover water level, operating pressure, visible leaks and insulation damage, blowdown valve condition, and a try-lever test on the safety valve where the design permits. Weekly checks include safety device function tests, combustion analysis on fired plant, and feedwater chemistry sampling. Periodic examinations — the annual or fourteen-monthly cycle driven by the WSE in the UK, or the NBIC schedule in the US — cover internal and external thorough examinations by the competent person, non-destructive testing of pressure parts where specified, safety valve removal and overhaul on a test rig, and full documentation against the previous examination report.
Overlaying all of this is the steam trap survey programme. Ultrasonic trap testing has become the industrial standard because it detects passing steam across both failed-open and failed-closed conditions without breaking the line. In unmanaged systems the failure rate approaches the roughly fifty per cent figure cited by UE Systems; in well-managed programmes it stays below five per cent, and the water hammer and rupture exposure drops accordingly. Thermographic cameras extend the same coverage to insulation breaches and hot-spot detection on pressure parts. IoT-based continuous trap and valve monitoring — networked acoustic and thermal sensors streaming data to a maintenance platform — is now cost-competitive for large distribution networks and is the direction predictive maintenance on steam systems is heading.
[INFOGRAPHIC]
Frequently Asked Questions
Conclusion
Steam safety is not a static discipline. The 2025 Edition of the ASME BPVC carries forward the Section XIII consolidation of overpressure protection introduced in 2021, and the updated ACOP L122 has repositioned the PSSR decision tree for faster dutyholder use — both reflecting a regulatory landscape that is still tightening, not relaxing. The technology available to plant operators has moved further in the last five years than in the preceding twenty. Ultrasonic leak detection, infrared thermography, and IoT-based continuous steam-trap and valve monitoring have replaced the annual visual inspection as the baseline expectation on well-run sites, and the case for continuous monitoring on any large steam distribution network now rests on cost rather than capability.
For the dutyholder, the target keeps moving. A steam safety programme that was competent in 2015 — certified plant, a current WSE, a competent person appointed, permit-to-work and LOTO enforced, role-specific training documented — is the floor, not the ceiling, in 2026. The programmes that will look defensible after the next serious incident investigation are the ones that have already moved the trap survey cadence toward continuous, closed the gap between the design drawing and the physical plant through walkdown-driven risk assessment, and treated the Written Scheme of Examination as a living engineering judgement rather than a compliance artefact. Steam hazards in the workplace remain predictable. The plants that keep getting hurt are the ones still treating prediction as optional.