HAZOP: nodes, guidewords and deviations

The hazard and operability study, or HAZOP, was developed at Imperial Chemical Industries in the United Kingdom in the 1960s and has become the most widely used process hazard analysis method in the world. It is described in IEC 61882:2016, Hazard and operability studies (HAZOP studies): application guide, and in the CCPS Guidelines for Hazard Evaluation Procedures. HSE-103 mentioned HAZOP in passing. This lesson explains how it works in enough detail for you to take part as a team member, read a HAZOP report critically and recognize a poor study. Leading a HAZOP requires facilitator training and experience beyond this course.

The idea behind HAZOP is simple. A process is designed to work within certain intentions: a flow of so much liquid, at such a pressure and temperature, in this direction. Hazards and operating problems arise when the process deviates from those intentions. HAZOP finds deviations systematically by combining guidewords, such as no, more and less, with process parameters, such as flow, pressure and temperature, for each part of the design. The team then asks what could cause each deviation, what the consequences would be and whether the safeguards are adequate.

Nodes and design intent

A HAZOP divides the process into nodes: sections of the piping and instrumentation diagrams (P&IDs) with a clear design intent, such as "transfer ethanol from storage tank T-101 to reactor R-201 at 10 cubic meters per hour and ambient temperature" or "maintain reactor R-201 at 80 °C and 3 bar during reaction". Choosing nodes is a skill. Nodes that are too large make the discussion vague; nodes that are too small make the study long and repetitive. Typical nodes are a line between two major items, a vessel with its connections, or a heat exchanger.

The design intent must be written down for each node before deviations are discussed. It should state the function, the parameters and their normal ranges, and the materials. Without a clear intent, the team cannot tell what a deviation is. Operating modes matter too: a node may have different intentions during start-up, normal running, shutdown and cleaning, and a thorough HAZOP considers each mode or holds a separate procedural HAZOP for batch and non-routine operations.

Guidewords and parameters

The standard HAZOP guidewords, from IEC 61882, are: no or not (complete negation of the intent), more (quantitative increase), less (quantitative decrease), as well as (qualitative increase, such as contamination), part of (qualitative decrease, such as a missing component), reverse (logical opposite, such as reverse flow) and other than (complete substitution, such as the wrong material). Additional guidewords for time and sequence include early, late, before and after. Combined with parameters such as flow, pressure, temperature, level, composition, reaction, phase and time, they give the deviations.

Not every combination makes sense. "Reverse temperature" means nothing, while "reverse flow" is one of the most important deviations in many processes. Experienced facilitators use a pre-agreed list of meaningful deviations for each type of node, such as lines, vessels and heat exchangers, while still allowing the team to add others. A common deviation list for a line might include no flow, more flow, less flow, reverse flow, more pressure, less pressure, more temperature, less temperature, contamination and wrong material.

Working through a deviation

For each deviation, the team records five things on the HAZOP worksheet. Causes: what could produce the deviation within this node, such as a pump trip, a closed valve or a control failure. Consequences: what would happen, followed through to the ultimate outcome, assuming safeguards fail, which may be in another node. Safeguards: the existing measures that prevent the cause or reduce the consequence, such as alarms, trips, relief valves and procedures. Risk ranking, if the company uses a matrix. Recommendations: actions where safeguards are judged inadequate.

The HAZOP team and session

A HAZOP team is typically four to eight people: a trained facilitator independent of the design team, a scribe, a process engineer, an instrument or control engineer, an operations representative who will run the plant, and maintenance or mechanical engineering, with specialists such as chemists brought in as needed. The PSM standard requires at least one team member experienced in the process and one knowledgeable in the method. Sessions are usually limited to about six hours a day because concentration drops, and a medium-sized unit can take several weeks.

Preparation is critical. The team needs up-to-date P&IDs, process flow diagrams, material safety data, operating procedures, design basis documents, relief system data and incident history. A HAZOP on drawings that do not match the plant is wasted. For existing plants, a site walk-through before the sessions helps the team see the real layout and any field modifications.

Quality of a HAZOP

Signs of a good HAZOP include clear design intents for each node, consequences followed through to the ultimate outcome, safeguards judged critically rather than simply listed, recommendations that are specific and assigned, and attention to non-normal modes such as start-up and maintenance. Signs of a poor one include "no consequence" entered for many deviations without explanation, safeguards listed that are not independent of the cause (a control loop that fails cannot also be its own safeguard), consequences that stop at the node boundary, and recommendations such as "review procedure".

HAZOP has limits. It is time-consuming and depends on good drawings. It considers single deviations, so combinations of failures and common causes may be missed. It is weaker at identifying hazards that do not come from process deviations, such as dropped objects or occupational hazards. And it identifies but does not quantify: for scenarios with severe consequences, the HAZOP often hands over to LOPA to check whether the safeguards are enough. Variants exist for other systems, including computer HAZOP (CHAZOP) for control systems and procedural HAZOP for batch and manual operations.

In the US, HAZOP is one of the PHA methods named in OSHA 1910.119(e) and EPA RMP 40 CFR 68.67, and is by far the most common for refineries and chemical plants. The PHA must be revalidated at least every five years, and many facilities use a revalidation HAZOP that focuses on changes and incidents since the last study.

Recording and reporting a HAZOP

A HAZOP report usually contains the terms of reference, the team list and attendance, the drawings and documents reviewed with their revision numbers, the node list with design intents, the full worksheets, the list of recommendations with owners, and a statement of the study's limits. Recording styles vary: full recording records every deviation discussed, including those with no credible cause, while recording by exception records only deviations with credible causes and consequences. Full recording takes longer but provides better evidence that each deviation was considered, which matters at revalidation and in regulatory audits.

Recommendations are typically classed by priority and sent to a responsible engineer for resolution. Each resolution should explain what was done, or why an alternative was chosen, and be checked by someone with HAZOP knowledge. Under process safety rules, the date of resolution and communication to affected workers must be documented.