Hazard identification: checklists, what-if and HAZOP

You cannot control a hazard you have not found. Process hazard analysis (PHA) is the structured search for what could go wrong in a process, what the consequences would be, and whether the safeguards are good enough. This lesson covers the main PHA methods, from simple checklists to the hazard and operability study (HAZOP), and works through a HAZOP of part of an invented batch reactor that we will use for the rest of the course. Lesson 7 then shows how to judge whether the safeguards found in a PHA reduce risk enough.

The running example: reactor R-101

Larchmont Specialty Chemicals is an invented small plant that makes a speciality ester in a 10 m³ glass-lined batch reactor, R-101. Toluene is charged as a solvent, then an alcohol and a catalyst, and an acid chloride is fed slowly from a weigh tank over about four hours. The reaction is exothermic. Heat is removed by cooling water through the reactor jacket, and the batch is held at 60 °C. The hydrogen chloride gas produced is sent through a vent line to a caustic scrubber. Safeguards include a temperature controller on the jacket, a high-temperature alarm, a high-temperature trip that closes the acid chloride feed valve, a rupture disc and relief line to a catch tank, and a nitrogen blanket. Toluene is stored in a 30 m³ tank, T-100, in a diked area outside the building.

Choosing a method

Different PHA methods suit different stages of a project and different levels of complexity. The OSHA PSM standard lists acceptable methods: what-if, checklist, what-if/checklist, HAZOP, failure modes and effects analysis (FMEA), fault tree analysis, or an appropriate equivalent. CSA Z767 and the CSChE guide expect a similar range. The method should match the complexity of the process and the severity of its hazards.

Checklists

A checklist captures experience: lessons from past incidents, code requirements, and company standards. Typical questions include: is every pressure vessel protected by a relief device sized for the worst credible case? Are relief discharges routed to a safe location? Are flammable liquid storage areas diked and bonded? Is electrical equipment classified for the area? Checklists are fast and consistent, and they are good at catching known issues. Their weakness is that they find only what is on the list. An unusual chemistry or a new type of equipment may have hazards that no checklist mentions.

What-if analysis

In a what-if review, a team walks through the process or a procedure and asks questions such as: what if the wrong material is charged? What if cooling water fails? What if the operator is called away during a transfer? For each question the team records the consequences, the existing safeguards and any recommendations. What-if is flexible and works well for procedures and small changes. Its quality depends heavily on the experience and imagination of the team, and it can miss hazards if questions are not asked systematically.

HAZOP: the hazard and operability study

HAZOP was developed at ICI in the United Kingdom in the 1960s and is now the most widely used method for detailed process designs. The team divides the process into nodes, sections of piping or equipment with a defined design intent, such as "deliver acid chloride to R-101 at 0.5 m³/h". For each node, the team combines guidewords with process parameters to generate deviations from the design intent, such as no flow, more flow or higher temperature. For each credible deviation, the team identifies causes, consequences and existing safeguards, and decides whether more protection is needed. The standard reference is IEC 61882, Hazard and operability studies (HAZOP studies) – Application guide.

Guidewords are combined with parameters such as flow, pressure, temperature, level, composition, agitation, time and sequence. Not every combination is meaningful; part of the skill is recognizing which deviations are credible for the node. The code below generates the candidate list that a HAZOP scribe might start from.

# Generate candidate HAZOP deviations for a node from guidewords and parameters.
guidewords = ["No", "More", "Less", "Reverse", "As well as", "Other than"]
parameters = {
    "flow":        {"No", "More", "Less", "Reverse", "As well as", "Other than"},
    "temperature": {"More", "Less"},
    "pressure":    {"More", "Less"},
    "level":       {"More", "Less", "No"},
    "agitation":   {"No", "Less"},
}
devs = [f"{g} {p}" for p in parameters for g in guidewords if g in parameters[p]]
print(f"{len(devs)} meaningful deviations for node 2 (cooling water to jacket):")
for i in range(0, len(devs), 4):
    print("  " + " | ".join(devs[i:i + 4]))

15 meaningful deviations for node 2 (cooling water to jacket):
  No flow | More flow | Less flow | Reverse flow
  As well as flow | Other than flow | More temperature | Less temperature
  More pressure | Less pressure | No level | More level
  Less level | No agitation | Less agitation

Running a HAZOP session

A HAZOP team usually has a trained facilitator, a scribe who records the worksheet, and people who know the process well: a process engineer, an experienced operator, an instrument or control engineer, a maintenance or mechanical engineer, and specialists as needed, such as a chemist for reactive hazards. Operators are essential: they know how the plant is really run, which instruments are unreliable and which shortcuts people take at three in the morning. The team needs current piping and instrumentation diagrams (P&IDs), process safety information, operating procedures and incident history. Sessions are tiring, so most facilitators limit them to a few hours a day.

The 'more flow' line shows why HAZOP finds hazards that intuition misses. Too much cooling sounds safe, but if the batch gets too cold, the acid chloride added during that time may not react and can accumulate. When the temperature recovers, the accumulated reactant reacts all at once and releases far more heat than the cooling system can remove. Several serious reactive incidents, including the explosion at T2 Laboratories in Jacksonville, Florida, in 2007, which killed four people, involved runaway reactions in batch reactors where cooling could not keep up.

Ranking the findings

Most PHAs rank each scenario on a risk matrix so that recommendations can be prioritized. Severity and likelihood are each scored on a scale, usually from 1 to 4 or 1 to 5, and the product or the matrix cell gives a risk category. Matrices are simple and quick, but they are coarse, and different teams can score the same scenario differently. High-risk scenarios are often taken forward to the more rigorous layer of protection analysis described in Lesson 7.

# Rank HAZOP scenarios on a 5 x 5 risk matrix (company-specific categories, illustrative).
def category(sev, like):
    score = sev * like
    if score >= 15: return "High - act now"
    if score >= 8:  return "Medium - reduce risk"
    return "Low - manage by procedures"

scenarios = [   # description, severity (1-5), likelihood (1-5)
    ("No cooling flow during feed -> runaway", 5, 3),
    ("More cooling -> reactant accumulation", 4, 3),
    ("Reverse flow into cooling water", 2, 2),
    ("Wrong drum charged (water in solvent)", 4, 2),
]
for desc, s, l in sorted(scenarios, key=lambda r: -r[1] * r[2]):
    print(f"S{s} x L{l} = {s * l:>2}  {category(s, l):<26} {desc}")

S5 x L3 = 15  High - act now             No cooling flow during feed -> runaway
S4 x L3 = 12  Medium - reduce risk       More cooling -> reactant accumulation
S4 x L2 =  8  Medium - reduce risk       Wrong drum charged (water in solvent)
S2 x L2 =  4  Low - manage by procedures Reverse flow into cooling water

Inherently safer design

The best time to find a hazard is before the plant is built, and the best response is often to remove or reduce the hazard rather than add safeguards. Trevor Kletz, who worked at ICI and wrote widely on process safety, summarized inherently safer design in a few words: what you don't have can't leak. Inherently safer strategies are usually grouped as minimize, substitute, moderate and simplify. Many PHAs now include a structured inherent safety review, and the 2024 EPA rule required some sectors to evaluate safer technology (Lesson 5).

After the PHA

A PHA is only valuable if its recommendations are acted on. Each recommendation needs an owner, a due date and a documented resolution: implemented, or rejected with a recorded justification approved by management. OSHA PSM requires the employer to resolve recommendations promptly, document the resolution and communicate actions to affected workers. Lessons 5 and 12 note that long lists of open PHA recommendations are a common warning sign. PHAs must also be kept current: OSHA requires revalidation at least every five years, and CSA Z767 and good practice expect revalidation when significant changes or incidents occur.