Hazard identification: checklists, what-if, HAZOP and FMEA

The calculations of the earlier lessons answer questions about scenarios: how much leaks, how far it goes, what a fire or explosion does, how big a relief valve must be. Hazard identification comes first. It asks what can go wrong in the first place. If a scenario is never imagined, no calculation will protect against it. Process hazard analysis, PHA, is the name for the structured methods used to find hazards in a design or an operating plant. Regulations require PHAs for covered processes, and good practice repeats them at intervals, typically every five years, and when significant changes are made. In this lesson Theo joins his first full HAZOP, for the ethyl acetate column and its feed and product systems at Kingfisher Bioenergy.

Choosing a method

Several methods are in common use, and the choice depends on the stage of the project and the complexity of the process. Checklists compare a design or plant with a list of known requirements and good practices: codes, company standards and lessons from past incidents. They are quick and catch familiar hazards but miss anything not on the list. What-if analysis gathers an experienced team to ask questions such as what if the feed pump trips, or what if the wrong product is loaded; it is flexible and suited to simple processes and early design, but its thoroughness depends on the team's imagination. Many teams combine the two as a what-if checklist.

The hazard and operability study, HAZOP, is the most systematic method for continuous processes with detailed piping and instrument diagrams. Failure modes and effects analysis, FMEA, examines equipment one component at a time. For batch processes, procedures are reviewed step by step with similar guide words. For early design, a preliminary hazard analysis or a hazard identification study, HAZID, screens the major hazards before detailed drawings exist. The methods complement each other, and large projects use several at different stages.

How a HAZOP works

A HAZOP is carried out by a team that usually includes a trained facilitator, a scribe, a process engineer, an operations representative who knows the plant, an instrument or control engineer, a mechanical or maintenance engineer, and specialists as needed. The design is divided into nodes, sections of the process with a defined design intent, such as the feed line from the storage tank to the column, or the reflux drum and decanter. For each node the team applies guide words to process parameters to generate deviations from the intent: no flow, more flow, less flow, reverse flow, more temperature, less pressure, more level, as well as (an extra component), part of (a missing component) and other than (a completely different material or operation). For each credible deviation the team records the causes, the consequences if the deviation is not corrected, the existing safeguards and any actions needed.

The discipline of the method is its strength. Every combination of guide word and parameter is considered for every node, so the team cannot skip the dull parts of the plant where hazards may hide. Its weakness is time. A large unit can take weeks of meetings. Facilitators keep the pace by recording only meaningful deviations and by parking design questions that need research outside the meeting.

The ester column HAZOP

For the ester column, the team's first node is the feed from the pre-reactor to the column. The deviation more temperature has a cause in the feed preheater's steam control valve failing open. The consequence is that the feed partly flashes, upsetting the column and possibly lifting the relief valve on the rundown drum; in the worst case, hot ester could reach the storage tanks above its usual temperature, raising the vapour pressure. The safeguards are the preheater temperature controller with its alarm and the relief valve on the drum. But the alarm uses the same transmitter as the controller, the same independence problem that Theo met in the LOPA of CHE-374. The team records an action to evaluate an independent high-temperature trip on the steam supply.

Under the deviation other than, the operations representative, Carla Fontaine, mentions that the same tank truck bay is used for ethanol and ethyl acetate. If a truck of ethanol were offloaded into an ethyl acetate tank, the product would be ruined, and if the mix-up involved the denaturant or a cleaning chemical, worse could happen. The safeguards were procedural only. The team adds actions for dedicated connections with different fittings for each product and for a sample check before offloading. This is typical: some of the most valuable HAZOP findings come from the people who operate the plant.

# HAZOP worksheet bookkeeping and an FMEA risk-priority ranking for the ester column feed
nodes = {"feed to ester column": ["no flow", "more flow", "less flow", "more temperature", "other than (water-rich feed)"],
         "reflux drum and decanter": ["more level", "less level", "reverse flow", "more pressure", "part of (no water draw)"]}
n = sum(len(v) for v in nodes.values())
print(f"{len(nodes)} nodes, {n} deviations reviewed at about 10 minutes each: {n * 10 / 60:.1f} h of meeting time")
# FMEA: severity x occurrence x detection (1 to 10 each), illustrative
items = (("feed pump seal leak", 7, 4, 3), ("feed preheater tube leak", 6, 3, 6), ("level transmitter fails low", 8, 3, 5),
         ("control valve sticks open", 7, 4, 4), ("analyser fails stale", 5, 5, 7))
for name, s, o, d in sorted(items, key=lambda r: -r[1] * r[2] * r[3]):
    print(f"RPN {s * o * d:4d}  S{s} O{o} D{d}  {name}")

2 nodes, 10 deviations reviewed at about 10 minutes each: 1.7 h of meeting time
RPN  175  S5 O5 D7  analyser fails stale
RPN  120  S8 O3 D5  level transmitter fails low
RPN  112  S7 O4 D4  control valve sticks open
RPN  108  S6 O3 D6  feed preheater tube leak
RPN   84  S7 O4 D3  feed pump seal leak

The two nodes Theo helps to review cover ten meaningful deviations, which take nearly two hours of meeting time at about ten minutes each. A full HAZOP of the ester line covers fourteen nodes and takes four days. The output is a worksheet with every deviation and a list of recommendations, each assigned to a person with a due date. The recommendations are tracked to closure, and the company's procedures under CSA Z767 require each to be completed, or formally rejected with documented reasons, before the unit starts up.

Failure modes and effects analysis

FMEA lists each component of a system, its failure modes, the effects of each failure on the system and the means of detecting it. Each failure mode is often scored for severity, occurrence and detection on scales from 1 to 10, and the product, the risk priority number, RPN, ranks the failure modes for attention. FMEA is well suited to instrument and control systems and to equipment such as pumps and compressors, where failure modes can be listed exhaustively. It is less suited to finding hazards that arise from combinations of failures or from process interactions, which is where HAZOP is stronger.

Theo's FMEA of the column feed system ranks a stale analyser reading highest, with an RPN of 175, mainly because it is hard to detect: an analyser that freezes at a normal value looks perfectly healthy. A level transmitter failing low comes next, with severity 8, followed by a sticking control valve, a preheater tube leak and a pump seal leak. The analyser finding leads to a recommendation that the control system check the analyser's value for change over time and alarm if it stops moving. RPNs are a ranking tool, not a measure of risk: the same RPN can come from very different combinations, and a failure with severity 9 or 10 deserves attention whatever its RPN.

Procedures and human factors

Many hazards appear during startups, shutdowns and maintenance rather than in steady operation. Texas City happened during a startup. A complete hazard review therefore looks at the operating procedures step by step, asking what happens if a step is skipped, done out of order or done to the wrong equipment. The ester line's startup procedure, for example, requires the nitrogen blanket on the rundown drum to be established before hot product is introduced. The team asks what would happen if an operator started the transfer first and recommends an interlock that prevents the transfer pump from starting until the drum's oxygen analyser reads below its limit.

Human factors enter in other ways too. Controls that look alike but do different things, valves that are hard to reach, displays that show a value without its trend, and alarms that sound too often all make errors more likely. The HAZOP team includes these in its discussion, and the actions it records range from relabelling valves and moving a gauge to redesigning a display. Theo learns to treat a statement such as the operator will notice with suspicion and to ask how, how quickly and with what information.

Recording and reporting

A HAZOP worksheet is a legal and technical record. Each line should be understandable to someone who did not attend: the deviation, the specific cause, the consequence described without credit for safeguards, the safeguards with their tag numbers, and the action phrased as a question or requirement that can be closed. Vague actions such as review the design are hard to close and easy to forget. The facilitator's report summarizes the scope, the team, the drawings used and their revisions, the key findings and the full list of actions. At Kingfisher Bioenergy the report is filed with the process safety information for the unit, and the next revalidation starts from it.

Making hazard reviews work

A hazard review is only as good as its information, its team and its follow-up. The process safety information, including P&IDs, material hazards, design limits and relief data, must be accurate and current. The V-410 relief error of lesson 9 would have been found sooner if the HAZOP team had been given the relief data sheets. The team must include people with operating experience and the authority to speak freely. And the recommendations must be closed: investigation reports of several major incidents describe hazards that had been identified in earlier reviews but whose recommendations were never implemented. HSE-311 covers the management side of PHA programs, including revalidation and how findings are prioritized across a site.

Theo also learns that hazard reviews should look for inherently safer options, not only for added safeguards. When the team discusses the large inventory of ethyl acetate in the rundown system, someone asks whether the intermediate tank is needed at all. It turns out that a smaller tank would serve, cutting the inventory by a third. Questions like that, asked early, remove hazards rather than guard them.