HAZOP

HAZOP (Hazard and Operability study) is a structured team review that finds what can go wrong in a process design. Learn nodes, parameters and guidewords, how to record causes, consequences and safeguards, risk ranking with a risk matrix, and how HAZOP fits in the safety lifecycle.

Most major accidents — Flixborough, Bhopal, Texas City — were caused by deviations nobody had imagined. HAZOP is a disciplined brainstorm: a team walks through the P&ID, section by section, applying guidewords like 'NO FLOW' or 'MORE PRESSURE' to ask 'what if?'.

It is required for most new plants and major modifications worldwide.

An analogy

HAZOP is like a flight-simulator session for a design: you deliberately 'break' every line and vessel on paper to see what would happen — before it happens for real.

Team and method

A chairman (facilitator), scribe, process engineer, operations, instrument, mechanical and safety specialists. The P&ID is split into nodes (e.g. feed pump to reactor). For each node the design intent is stated, then guidewords are applied to parameters (flow, pressure, temperature, level, composition).

Causes, consequences, safeguards

Causes must be credible and local (valve closed, pump trip, controller failure). Consequences are followed to the worst outcome assuming safeguards fail. Safeguards are independent protections (alarms, trips, relief valves). Recommendations are actions assigned and tracked to closure.

Risk ranking

A risk matrix combines severity (injury, environment, cost) and likelihood; high-risk scenarios go on to LOPA or QRA. Company matrices define tolerable, ALARP and intolerable regions.

Variants and lifecycle

HAZID (early concept hazards), CHAZOP (control systems), procedural HAZOP (batch steps), revalidation every ~5 years, and Management of Change (MOC) for modifications. Results feed SIL determination and safety cases.

Formulas

• Deviation: Deviation = Guideword + Parameter (e.g. NO + FLOW)
• Risk rank: R = Severity × Likelihood
• Worksheet columns: Deviation → Causes → Consequences → Safeguards → Risk → Recommendations

Worked example: NO FLOW to a cooling jacket

Given: Node: cooling-water supply to an exothermic reactor jacket

Find: Worksheet row.

• Causes: CW pump trip, control valve fails closed, blocked strainer
• Consequence: loss of cooling → temperature rise → runaway → overpressure/rupture
• Safeguards: high-temperature alarm, feed trip on high T, relief valve
• Recommendation: add low-flow alarm on CW, SIL-rated high-T trip

Answer: High severity (5) × likelihood (3) = 15 → LOPA required

Worked example: MORE LEVEL in a storage tank

Given: Tank filled from a ship unloading line

Find: Key issue.

• Cause: level gauge fails, operator distracted
• Consequence: overfill → flammable liquid spill → vapour cloud (Buncefield 2005)
• Safeguards: independent high-high level switch closing inlet valve

Answer: Independent overfill protection (API 2350)

Common mistakes

• Wrong: Counting operator action as a safeguard without time to respond. — Right: Safeguards must be independent, effective and timely.
• Wrong: Leaving recommendations untracked. — Right: Assign owners and close them out before start-up.

Applications

• New projects: HAZOP at detailed-design stage before construction.
• Modifications: MOC triggers HAZOP for changes to process or equipment.
• Batch & procedures: Procedural HAZOP of start-up, shutdown and batch steps.

Key takeaways

• HAZOP = systematic 'what if' on P&IDs.
• Guideword + parameter = deviation.
• Record causes, consequences, safeguards, actions.
• Rank risk and escalate to LOPA/QRA.

Going further

• LOPA follow-up: High-risk HAZOP scenarios are quantified with layers of protection.
• CHAZOP: Studies failures of control systems, networks and software.
• Bow-tie diagrams: Visualise threats, top event, consequences and barriers.