HAZOP (Hazard and Operability Analysis)
For example, when the Process Safety Management (PSM) regulations in the United States were being promulgated in the early 1990s it was not unknown for a plant manager to say, "I know what PSM is, it's HAZOPs!" In fact the HAZOP method is just one of the many types of Process Hazards Analysis (PHA) techniques that are available, and PHAs are just one element of a PSM program. Nevertheless, these managers were somewhat justified in what they said because they knew that, unless they could identify the hazards on their facilities, they could not reduce risk.
Furthermore, both regulators and legal advisors generally support use of the HAZOP technique because of its reputation and because it is so thorough. The use of the HAZOP technique is very defensible if a company is challenged regarding its safety performance, particularly in a legal dispute.
As a result of its widespread use and acceptance, large numbers of process safety practitioners are now trained in the use of the HAZOP method, and many of those are also trained as leaders/facilitators. Furthermore, a substantial HAZOP infrastructure has developed. Many consulting companies offer HAZOP facilitation services special-purpose software.
The TechniqueA HAZOP is organized by dividing the unit to be analyzed into nodes. A node represents a section of the process where a significant process change takes place. For example, a node might cover the transfer of material from one vessel to another through a pump. In this case the process change is the increase in pressure and flow that occurs across the node. Another node might include an overhead air-cooler on a distillation column. Here temperature and phase are the process variables that change.
Although the strength of the HAZOP method lies in its clear organization, it is important not to allow the analysis to become too rigid. If the team finds that it is talking about "Reverse Flow" even though the current guideword is "High Flow", the leader should probably let the discussion continue. If he or she were to postpone the discussion until the "right" guideword, the current thinking and creativity may be lost. On the other hand, the leader must also keep the discussion focused on the issue at hand, and should prevent too many digressions.
Steps in a HAZOPThe HAZOP process can be organized into the steps shown in Table 1.
Step 1. Node Selection and PurposeAs discussed above, a node represents a section of a process in which conditions undergo a significant change. For example, a pump system will be a node because liquid pressure is increased, a reactor is a node because chemical composition changes, and a heat exchanger is a node because it causes changes in fluid temperatures. In practice, a single node will frequently involve more than one process change. For example, the node for a chemical reactor will include changes to pressure, temperature and composition.
The scribe will enter the node description into the hazards analysis software. The start and stop points for the node should explained to the team. Operations and maintenance experts will then provide some history and operating experience about it. Any relevant documentation to do with that node, such as equipment data sheets or material safety data sheets (MSDS), should be put before the team at this time.
All control valves have a fail position. In the event of a power failure and/or loss of instrument air, the valve's spring operator will cause the valve to fail open, fail closed, or remain in its current position. These failure modes should be identified. During the course of the HAZOP (probably while discussing 'High Flow' or 'No Flow') the team can discuss if the valve's fail position is what it should be. An analysis of this type is particularly valuable if more than one accident scenario has to be considered, and if the different scenarios call for different valve positions.Once the node is defined and described, the team discusses deviations from design or operating intent following the steps shown in Table 1.
Step 2. Process Guideword / Safe Limits
A HAZOP looks at deviations from design or safe process conditions, so the first decision is to select the process parameters that are germane to the facility under discussion. Generally the following parameters will be used:
It will often be found that two parameters are related to one another. For example, the deviation of "high temperature" can create "high pressure". Which of these parameters the team chooses to focus on is not usually all that important.
The parameters listed above can be supplemented with more specialized parameters, such as viscosity, color, surface tension and density. These secondary parameters will not generally be needed since they are dependent on the first set. For example, the density of a liquid is likely to be a function of temperature and composition. Therefore the discussions to do with temperature and composition deviations will incorporate any concerns to do with density.
The safe limit values for each guideword should be established wherever possible.
Step 3. Identification of Hazards and their Causes
Once the nodes have been defined, and the safe operating limits identified,
the hazards are determined. A hazard is a deviation outside the safe operating
limit that is identified through the use of deviation guidewords. The most
commonly used deviation guidewords are:
Some teams use the term "Loss of Containment" as a guideword. Given that the ultimate purpose of a process safety program is to make sure that hazardous materials remain confined in the pipes, tanks, and vessels that they are intended to be in, it could be argued that all process deviations can ultimately result in "Loss of Containment", and so there is no need to handle this term separately. For example, high temperature in a reactor is not, in and of itself, a hazard; it becomes a hazard only if it generates a pressure so high that containment is lost (exacerbated by weakening of pressure vessel walls at the higher temperature). Similarly, high flow is not usually a hazard except that it may lead to a tank being filled too rapidly, thus generating a high level scenario, which then can lead to "Loss of Containment" due to overflow of the tank. Another example would be "Wrong Composition" in T‑101 that can lead to loss of containment if the seal on P‑101A fails.
Most of the discussion to do with events and their causes will be associated with the node itself. For example, a leak from a pump may be caused by a seal leak at that pump. However, the team should always be looking for causes from other areas of the plant. For example, if a new chemical is inadvertently introduced into the system at another location, that chemical could cause the seal to leak.
If the consequence of a hazard has an effect on another node the team leader and scribe should postpone the relevant discussion until that node is reached by the team.
The actual guideword selected depends on team preference and company tradition. For example, the word "more" is used in traditional HAZOPs to describe an excess of some parameter. However, many teams prefer to use the word "high". An even better term is "too much" because it implies an undesirable situation - the parameter in question has gone outside its safe limit range. After all, high flow is often a good thing because it suggests that the facility is making more product and more money.
Table 3 shows potential hazards for two of the variables: level in T‑100,
and flow from T‑100 to V-101.
Some hazards can have more than one cause. For example, High Level in T-100 is shown in Table 3 to have three potential causes:
The process and deviation guidewords are organized into a matrix, as shown in Table 4. The shaded boxes in this matrix are to be discussed by the team. The empty boxes (such as "Reverse Phase" and "Misdirected Temperature") are not discussed because they do not have physical meaning. In Table 4, the deviations "Low" and "No" are merged since they often lead to essentially the same discussion. However they should be used separately where appropriate. For example, "Low Level" in a tank may lead to little more than production problems, whereas "No Level" in that tank could create major hazards such as pump cavitation and air ingress into the tank.
The choice of terms can vary according to the practice and culture of the facility. For example, some companies use the terms "As Well As" or "Contamination". These are equivalent to the term "Wrong Composition" in Table 4. Sometimes the guideword combination "Reverse Pressure" is us used to cover situations where operating pressures are below ambient.
Having determined which node parameters are to be used, the team discusses the hazards associated with each (shaded) square, using the prompt questions shown in Table 5 - which uses the term High Flow for illustration.
The team will find that many hazards, causes and
consequences are similar to one another as the discussion moves from node
Step 4. "Announcement" of the Hazard
The team should ask how each deviation outside the safe limits "announces" itself. Usually high and low alarms are built into the instrumentation associated with critical variables. These alarms tell the operator that an unsafe condition has occurred, or is developing. In the standard example a high level alarm incorporated into LRC-100 would warn the operator of high level in T-100.
If the team finds that there is no obvious way for an operator to know that a safe limit has been exceeded, then the hazards analysis will probably recommend the installation of additional instrumentation to provide warnings and alarms.
Step 5. Consequences
Having identified the hazards, the team should then determine the consequences of those hazards, with and without safeguards in place. Consequences can be safety, environmental or economic.
Table 6 illustrates some consequences for the standard example using the hazards listed in Table 3.
It can be seen from Table 6 that the term "None identified" is entered into the notes when the team was unable to think of a significant consequence associated with that hazard. Use of this term assures readers of the final report that the team did discuss potential consequences, but were unable to come up with issues of significance; they did not simply forget to examine this scenario.
Step 6. Identification of Safeguards
Some teams choose to list the safeguard-type assumptions that are made during the analysis. Table 7 provides an example of such a list.
Step 7. Predicted Frequency of Occurrence of the Hazard
Estimated frequency values for each hazard are generally stated in terms of events per year, or yr-1. Sometimes they are in units of events per mission or events per batch operation. Table 8 provides some estimated frequency values for the hazards in the standard example.
Taking the deviation "High Level" in T-101 as an example, the anticipated frequency of this event is 0.1 yr-1, or once in ten years. If credit is taken for the safeguard (high level alarm on LRC-101) and the probability of this alarm failing is say 0.1, then the anticipated frequency of high level drops to 0.01 yr-1, or once in a hundred years.
The second cause (#1.2) for Hazard #1 is the failure of LRC-101, the T-100 level control system. In this case the consequence (#1.2) may be a small spill from the tank that is handled by the drain system, thus avoiding an environmental problem. The predicted frequency for this event (#1.2) is once in twenty years.
Step 8. Risk Rank
Once the hazards have been identified, and their causes, consequences and frequencies discussed, the team should risk rank each identified hazard scenario. If a risk matrix is used the estimated risk values for the two scenarios are 'B' and 'C' respectively.
Formal risk ranking can help reduce the number of findings. Hazards analysis teams have a tendency to be conservative and to generate a recommendation for every identified hazard without a great deal of scrutiny. Formalizing the risk helps cut out those recommendations that are really not justifiable.
Step 9. Findings
Those hazards that have a risk level above the facility's acceptable risk level generate a finding which will then become a recommendation.
Findings and their associated information should be summarized and presented in an overview form as illustrated in Table 10. Generally, findings are listed in the order in which they were created. The order in which the findings are listed is not significant in terms of risk level or follow-up priority.
During the course of a long HAZOP, the team may find that certain findings are repeating themselves. For example, it may be that all centrifugal pumps of a certain type have an unusually high rate of seal failure. In such cases the team should develop generic findings and recommendations.
Step 10. Next Process Guideword / Node
Having completed the discussion to do with a process guideword, the team
moves on to the next guideword, or to the next node if all of the guidewords
have been discussed until the HAZOP is concluded.
home | top of page | view cart
Copyright © Sutton Technical Books 2007-2012. All rights reserved
PO Box 2217
Ashland, VA 23005-9998