What is a HAZOP study, and when do you need one?
A HAZOP study (Hazard and Operability study) is a systematic review in which a multidisciplinary team asks one question over and over: what happens if this part of the process does not behave as designed? The method was developed at ICI in the United Kingdom in the 1960s and is now the most widely used hazard identification technique in the process industry.
A HAZOP study looks for two kinds of problems. Hazards can lead to injury, fire, explosion or a release to the environment. Operability problems stop the plant from running as intended, for example a control loop that cannot handle start-up conditions. Both matter, because operability problems often become safety problems during abnormal operation.
When do you run one? There are three common moments in the life of a plant:
- during detailed design, once the piping and instrumentation diagrams (P&IDs) are mature enough to review line by line;
- for a modification, as part of Management of Change, whenever the change touches the process or its safeguards;
- to revalidate an existing unit.
Revalidation has a legal basis in some countries. In the United States, the OSHA Process Safety Management standard (29 CFR 1910.119) requires a process hazard analysis to be revalidated at least every five years. Many European operators use a similar cycle in their own safety management system.
Who should be in the team?
The people in the room matter more than the worksheet template. The HAZOP Chairman runs the session: they keep the team on the method and make sure every deviation gets an honest answer. Ideally the chairman is independent of the design team, so nobody feels pressure to wave a scenario through to protect the schedule. Next to the chairman sits a scribe, who types the discussion into the worksheet live so the team can check the wording on screen.
The rest of the team brings the technical knowledge. A typical team for a process unit has:
- a process engineer who explains the design intent and process conditions of each node;
- an operator or shift supervisor who knows how the plant is really run, including start-up, shutdown and maintenance;
- an instrument and control engineer for the control loops, alarms and trips;
- a mechanical or maintenance engineer, and a safety or environmental specialist where relevant.
Five to eight people works well. With fewer, expertise is missing. With many more, the discussion slows down and quieter people stop contributing.
How a HAZOP study works, step by step
Every HAZOP study follows the same logic. The diagram below summarises the cycle that the team repeats for each node.
- Agree the scope: which units, operating modes and documents are included, and which risk matrix the team will use.
- Collect the information. That means current P&IDs, process flow diagrams, heat and material balances, cause and effect diagrams, operating procedures and the results of earlier studies.
- Divide the design into nodes. A node is a section of the P&ID with one clear design intent, for example "feed line from storage tank T-100 to pump P-101".
- Write down the design intent of the node, including its normal flow, pressure, temperature and level ranges.
- Generate deviations by combining a guideword with a parameter. NO + FLOW gives "no flow"; MORE + PRESSURE gives "high pressure".
- For each credible deviation, record the causes, the consequences without safeguards, the safeguards that are in place and, if your procedure asks for it, a risk ranking.
- Where the safeguards are not enough or nobody is sure, write a specific action with an owner and a due date.
HAZOP guidewords and parameters with examples
Guidewords are short prompts that force the team to think about every way a parameter can deviate. IEC 61882:2016 lists the basic set below. Teams combine them with parameters such as flow, pressure, temperature, level, composition and time.
| Guideword | Meaning | Example deviation |
|---|---|---|
| NO / NOT | Complete negation of the design intent | No flow to the reactor cooling jacket |
| MORE | Quantitative increase | High pressure in a separator |
| LESS | Quantitative decrease | Low level in a buffer vessel |
| AS WELL AS | Qualitative addition | Water present in a hydrocarbon stream |
| PART OF | Qualitative reduction | One component of a two-component feed missing |
| REVERSE | Logical opposite of the intent | Reverse flow from a high-pressure system |
| OTHER THAN | Complete substitution | Wrong material delivered to a tank |
For batch processes and sequences, the time-related guidewords EARLY, LATE, BEFORE and AFTER are added. A step that starts before a valve has closed is a classic batch deviation.
What a good worksheet records
The worksheet is the legal and technical record of the study. Each line should be understandable for someone who was not in the room. The illustrative example below shows the level of detail to aim for.
| Field | Illustrative entry |
|---|---|
| Node | Cooling water supply to reactor R-201 jacket |
| Deviation | No flow |
| Cause | Cooling water pump P-210 trips |
| Consequence | Reactor temperature rises, potential runaway reaction and overpressure of R-201 |
| Safeguards | High temperature alarm with operator response; independent high temperature trip that stops the feed |
| Action | Confirm that the alarm set point leaves the operator enough time to respond before the trip point is reached |
Two habits make a big difference. First, write the consequence as if no safeguards were there. Otherwise the team underestimates the scenario before it has even looked at the protection. Second, name each safeguard with its tag number. "TAHH-201 trips the feed pump" can be checked in the field. "Alarms" cannot.
Common HAZOP pitfalls and how to avoid them
The method itself is sound. When a HAZOP study turns out weak, the cause is almost always practical. These are the pitfalls to watch for.
The drawings are the first. If the P&IDs change a lot after the study, the worksheet describes a plant that will never be built. Freeze the drawing revision before the first session. The second is a team without an operator. Engineers review the design as drawn; operators know what happens at three in the morning during a restart, and those are exactly the deviations that matter.
A few other problems come up often:
- sessions that run all day, so the last nodes of the day get a fraction of the attention the first ones got;
- safeguards that are counted twice, such as an alarm and a control loop on the same transmitter, which becomes a real problem once the scenario goes into a LOPA;
- actions that are written down and then never closed out.
That last one is the most expensive. A HAZOP study does not reduce any risk until its actions are implemented and the close-out is documented.
How HAZOP fits with HAZID, LOPA and bow-tie analysis
A HAZOP study is one tool in a wider process hazard analysis toolkit. A HAZID (hazard identification) study is usually done earlier, at concept stage, and looks at the facility as a whole: layout, external events and major hazards. The HAZOP study then examines the detailed design line by line.
For scenarios with severe consequences, the HAZOP team often recommends a follow-up assessment. A LOPA and SIL determination checks whether the safeguards reduce the risk enough and sets the required safety integrity level of a trip. A bow-tie analysis then helps to manage the most important barriers during operation.
If you are planning a HAZOP study for a new project or a modification, see how I support teams with HAZOP facilitation and process safety engineering.
Frequently asked questions
How long does a HAZOP study take?
The duration depends on the number of nodes and their complexity. A small modification can often be reviewed in a single session, while a complete new process unit usually needs several weeks of sessions. Preparation and report writing come on top of the session time.
What is the difference between a HAZOP and a HAZID?
A HAZID is a high-level hazard identification at concept stage that looks at the facility as a whole. A HAZOP study is a detailed, line-by-line review of the P&IDs using guidewords, carried out once the design is mature.
Who should chair a HAZOP study?
An experienced HAZOP Chairman who knows the method and the type of process, and who is preferably independent of the design team. Independence helps the chairman challenge assumptions without pressure from the project schedule.
Which standard describes the HAZOP method?
IEC 61882:2016, Hazard and operability studies (HAZOP studies), Application guide. It describes the principles, the guidewords, the team roles and the documentation of a HAZOP study.
Note: this article is general information, not engineering advice for your specific installation. Standards and legislation are referenced as they apply at the date of publication. For decisions on your plant, involve a qualified engineer who knows your process and your company risk criteria.
Process Safety, Process and Project Engineer with over 12 years of experience across Oil & Gas, Petrochemical and Food & Feed. MSc Sustainable Process & Energy Technologies (TU Delft), Certified Functional Safety Engineer and HAZOP Chairman.
