HAZOP (Hazard and Operability Analysis)

The decision as to how big a node may be will depend on the experience of the team, the degree to which similar process systems have already been discussed, the complexity of the process and the judgment of the leader.

Figure 1 shows how the first of the Standard Examples can be divided into three nodes. Each node has been circled with a cloud line.

Node 1 (blue line) is the Tank, T-100, with its associated equipment and instrumentation (the process change is level in the tank).
Node 2 (red line) incorporates two pumps, P-101 A/B, and the flow control valve, FCV-101 (the process changes are flow rate and liquid pressure).
Node 3 (green line) includes the pressure vessel, V-101, with its associated relief valve, and other instrumentation (the process changes are pressure, chemical composition and level).

Figure 1
Example of Node Selection

HAZOP Nodes

Often, node sizes increase as the HAZOP progresses because many of the identified hazards are repeated. For example, if a process includes several sets of tank/pump/vessel systems such as that shown in Figure 1, the team may divide the first discussion into three nodes, as shown, but then treat subsequent systems as single nodes.

Once the team meetings start, the scribe will place a set of full-size Piping & Instrument Diagrams (P&IDs), with the nodes marked out, on the wall of the conference room. These master P&IDs will be the focus point for the team discussions and will serve as the official record of the discussions. Team members can also be issued with a set of smaller, or shot-down, P&IDs for personal use.

Most team leaders use highlighter-type pens to define the boundaries of each node. As shown in Figure 1, different colors are used so that the interfaces between the nodes are easily seen. Although the choice of color is not usually significant, some colors may have designated meanings. For example, the color blue may mean that the sections so highlighted were not discussed because they had been covered by a previous HAZOP. The color brown may designate items of equipment and piping that are deliberately being excluded from the current HAZOP discussion - maybe because they are out of service. Yellow may indicate that a node has been defined but not yet discussed. At the conclusion of the analysis all nodes should have been colored out, thus confirming that no equipment or piping items were overlooked.

In order to save time, the leader and scribe may pre-select the nodes. In a very simple process, this decision may make sense. Generally, however, the team as a whole should decide on the nodes, partly because a HAZOP is a team activity, and partly because the definition and selection of a node often is affected by the discussions that have taken place with regard to earlier nodes. Also, if the leader and scribe are from outside the local organization, they may not fully understand all the process parameters that could affect node selection before the HAZOP starts.

For each node, the process engineer, and others who have knowledge of the system, will explain to the team the purpose of each node. Table 2 provides examples of purpose descriptions.

Table 2
Node Purpose Descriptions

Node Number	Name	Purpose
1	Tank, T-100, and associated instrumentation.	T-100 contains a working inventory of liquid RM-12 which is supplied by tank (rail) cars from outside suppliers. The node does not include the tank loading systems.
2	Pumps, P-101 A/B, including flow control valve, FCV-101.	P-101 A/B transfer liquid RM‑12 from Tank, T‑100, to Vessel, V-100. Flow is controlled by FRC-101, whose set point is provided by LRC-100 (Node 1). One pump is operating; the other is on stand-by. A is steam driven; B is electrically driven. B is usually on stand-by.
3	Pressure Vessel, V-101, including relief valve, PSV‑101.	Liquid RM-12 flows into this vessel from various sources. V-101 provides surge capacity, thus smoothing out fluctuations in flow. A vent line removes residual quantities of inert gas.

All control valves have a fail position. In the event of a power failure and/or loss of instrument air, the valve's spring operator will cause the valve to fail open, fail closed, or remain in its current position. These failure modes should be identified. During the course of the HAZOP (probably while discussing 'High Flow' or 'No Flow') the team can discuss if the valve's fail position is what it should be. An analysis of this type is particularly valuable if more than one accident scenario has to be considered, and if the different scenarios call for different valve positions.

Step 2. Process Guideword / Safe Limits

A HAZOP looks at deviations from design or safe process conditions, so the first decision is to select the process parameters that are germane to the facility under discussion. Generally the following parameters will be used:

It will often be found that two parameters are related to one another. For example, the deviation of "high temperature" can create "high pressure". Which of these parameters the team chooses to focus on is not usually all that important.

The parameters listed above can be supplemented with more specialized parameters, such as viscosity, color, surface tension and density. These secondary parameters will not generally be needed since they are dependent on the first set. For example, the density of a liquid is likely to be a function of temperature and composition. Therefore the discussions to do with temperature and composition deviations will incorporate any concerns to do with density.

The safe limit values for each guideword should be established wherever possible.

Step 3. Identification of Hazards and their Causes

Once the nodes have been defined, and the safe operating limits identified, the hazards are determined. A hazard is a deviation outside the safe operating limit that is identified through the use of deviation guidewords. The most commonly used deviation guidewords are:

Some teams use the term "Loss of Containment" as a guideword. Given that the ultimate purpose of a process safety program is to make sure that hazardous materials remain confined in the pipes, tanks, and vessels that they are intended to be in, it could be argued that all process deviations can ultimately result in "Loss of Containment", and so there is no need to handle this term separately. For example, high temperature in a reactor is not, in and of itself, a hazard; it becomes a hazard only if it generates a pressure so high that containment is lost (exacerbated by weakening of pressure vessel walls at the higher temperature). Similarly, high flow is not usually a hazard except that it may lead to a tank being filled too rapidly, thus generating a high level scenario, which then can lead to "Loss of Containment" due to overflow of the tank. Another example would be "Wrong Composition" in T‑101 that can lead to loss of containment if the seal on P‑101A fails.

Most of the discussion to do with events and their causes will be associated with the node itself. For example, a leak from a pump may be caused by a seal leak at that pump. However, the team should always be looking for causes from other areas of the plant. For example, if a new chemical is inadvertently introduced into the system at another location, that chemical could cause the seal to leak.

If the consequence of a hazard has an effect on another node the team leader and scribe should postpone the relevant discussion until that node is reached by the team.

The actual guideword selected depends on team preference and company tradition. For example, the word "more" is used in traditional HAZOPs to describe an excess of some parameter. However, many teams prefer to use the word "high". An even better term is "too much" because it implies an undesirable situation - the parameter in question has gone outside its safe limit range. After all, high flow is often a good thing because it suggests that the facility is making more product and more money.

Table 3 shows potential hazards for two of the variables: level in T‑100, and flow from T‑100 to V-101.

Node	Process Variable	Deviation	Causes
1	Level	High	1. High flow into T-100 2. Failure of the T-100 level control system. 3. P-101A and B both stop.
		Low	1. Low flow into T-100. 2. Failure of the T-100 level control system
	. . .	. . .	. . .
2	Flow	High	1. Failure of level control system in T-100. 2. Pump overspeed.
		Low/No	1. Failure of level control system in T-100. 2. Pump mechanical problems.
		Reverse	1. Pump failure (with check valve failure).
	. . .	. . .	. . .

Having determined which node parameters are to be used, the team discusses the hazards associated with each (shaded) square, using the prompt questions shown in Table 5 - which uses the term High Flow for illustration.

The team will find that many hazards, causes and consequences are similar to one another as the discussion moves from node to node.

Teams can sometimes become tangled up when hazards have effects outside the current node. For example, the team may be discussing "Low Level" in Tank, T-101. The cause of low level in the tank may lie within the node itself: a leak through the tank base, for example. However "Low Level" is more likely to be caused by loss of flow of RM-12 into the tank, i.e., the cause is "Low Flow" in an upstream node. Similarly, deviations in the current node can create hazards in other nodes. "Low Level" in T-101 could lead to seal failure of P-101A, which is in the next node.

Step 4. "Announcement" of the Hazard

The team should ask how each deviation outside the safe limits "announces" itself. Usually high and low alarms are built into the instrumentation associated with critical variables. These alarms tell the operator that an unsafe condition has occurred, or is developing. In the standard example a high level alarm incorporated into LRC-100 would warn the operator of high level in T-100.

If the team finds that there is no obvious way for an operator to know that a safe limit has been exceeded, then the hazards analysis will probably recommend the installation of additional instrumentation to provide warnings and alarms.

Step 5. Consequences

Having identified the hazards, the team should then determine the consequences of those hazards, with and without safeguards in place. Consequences can be safety, environmental or economic.

Table 6 illustrates some consequences for the standard example using the hazards listed in Table 3.

Step 6. Identification of Safeguards

Some teams choose to list the safeguard-type assumptions that are made during the analysis. Table 7 provides an example of such a list.

Step 7. Predicted Frequency of Occurrence of the Hazard

Estimated frequency values for each hazard are generally stated in terms of events per year, or yr^-1. Sometimes they are in units of events per mission or events per batch operation. Table 8 provides some estimated frequency values for the hazards in the standard example.

If a hazard has more than one cause, a frequency for each can be provided in the same way as was done for consequences in Table 6. The full hazard / cause / consequence / frequency layout can be structured as shown in Table 9.

Table 9
Example of Hazard Frequencies

Hazard	Cause #	Consequence #	Frequency #	Risk
1	1.1	1.1	1.1	1.1
	1.2	1.2	1.2	1.2
2	2.1	2.1	2.1	2.1
3	3.1	3.1	3.1	3.1
	3.2	3.2	3.2	3.2
	3.3	3.3	3.3	3.3

Hazard #1 could be, say, "High Level in Tank, T-100". The first cause for this hazard (#1.1) is "High Flow into T-100". The consequence associated with this failure is "Overflow of tank leading to operator injury". The predicted frequency of this event, taking credit for safeguards, is once in a hundred years, or 0.01 yr^-1.

The second cause (#1.2) for Hazard #1 is the failure of LRC-101, the T-100 level control system. In this case the consequence (#1.2) may be a small spill from the tank that is handled by the drain system, thus avoiding an environmental problem. The predicted frequency for this event (#1.2) is once in twenty years.

Step 8. Risk Rank

Once the hazards have been identified, and their causes, consequences and frequencies discussed, the team should risk rank each identified hazard scenario. If a risk matrix is used the estimated risk values for the two scenarios are 'B' and 'C' respectively.

Formal risk ranking can help reduce the number of findings. Hazards analysis teams have a tendency to be conservative and to generate a recommendation for every identified hazard without a great deal of scrutiny. Formalizing the risk helps cut out those recommendations that are really not justifiable.

Step 9. Findings

Those hazards that have a risk level above the facility's acceptable risk level generate a finding which will then become a recommendation.

Findings and their associated information should be summarized and presented in an overview form as illustrated in Table 10. Generally, findings are listed in the order in which they were created. The order in which the findings are listed is not significant in terms of risk level or follow-up priority.

Step 10. Next Process Guideword / Node

Having completed the discussion to do with a process guideword, the team moves on to the next guideword, or to the next node if all of the guidewords have been discussed until the HAZOP is concluded.