HAZOP explained: how a good study runs and where it fails

A Hazard and Operability study, or HAZOP, is the standard way to find what can go wrong in a process design. It is used in oil and gas, petrochemicals, fertilisers, power and water plants across the GCC. Done well, it finds the scenarios that cause fires, toxic releases and long shutdowns before they happen. Done badly, it produces a thick worksheet that nobody reads and a false sense of safety.

This guide explains how a good study runs, based on the international application guide IEC 61882, and where studies commonly fail.

What a HAZOP is

IEC 61882 describes HAZOP as a structured and systematic examination of a planned or existing process or operation. The aim is to identify and evaluate problems that may present risks to people, equipment or the environment, or prevent efficient operation.

The method is simple to describe. The team breaks the system into parts, states the design intent of each part, and then uses guide words to imagine deviations from that intent. For each credible deviation, the team asks what could cause it, what the consequences would be, what safeguards exist, and whether more action is needed.

The current edition, IEC 61882:2016, replaced the 2001 edition. It aligned terminology with ISO 31000 and ISO Guide 73, and added an improved case study of a procedural HAZOP.

The core vocabulary

Term	Meaning
Node	A section of the system studied as one unit, such as a vessel with its inlet and outlet lines
Design intent	What the node is meant to do, with its parameters and limits
Parameter	A property of the process, such as flow, pressure, temperature, level or composition
Guide word	A word that prompts a deviation, such as NO, MORE, LESS, REVERSE, OTHER THAN
Deviation	Guide word applied to a parameter, such as “more pressure” or “no flow”
Safeguard	An existing measure that prevents the cause or limits the consequence
Action	A recommendation to study further or change the design or procedures

The basic guide words

IEC 61882 lists basic guide words and their meanings:

• NO or NOT. Complete negation of the intent. No flow.
• MORE. Quantitative increase. More pressure, more temperature.
• LESS. Quantitative decrease. Less flow, less level.
• AS WELL AS. Qualitative increase. An extra component, such as water in a hydrocarbon stream.
• PART OF. Qualitative decrease. Only part of the intended composition.
• REVERSE. The logical opposite. Reverse flow.
• OTHER THAN. Complete substitution. A different material, a different operation.

For time and sequence, the standard adds EARLY, LATE, BEFORE and AFTER. These are especially useful for batch processes and procedures.

How a good study runs

1. Define scope and objectives

Agree what is in and out of scope, which drawings and revisions are used, and what the study must deliver. A study on an existing plant after modification needs a different scope from a front-end design review.

2. Prepare the information

The team needs up-to-date piping and instrumentation diagrams, process flow diagrams, heat and material balances, the cause and effect matrix, operating philosophy, relief system data and the plant’s risk matrix. Missing or outdated drawings are the first cause of weak studies. Freeze the revision before sessions start.

3. Build the right team

IEC 61882 stresses a multidisciplinary team. A typical team includes:

• Leader or facilitator. Experienced in the method and independent of the design team.
• Recorder or scribe. Records discussion accurately in real time.
• Process engineer. Knows the design intent and the numbers.
• Operations representative. Knows how the plant is really run, including workarounds.
• Instrument and control engineer. Knows the control and safety systems.
• Mechanical or maintenance engineer. Knows the equipment limits and how things fail.
• Specialists as needed, such as safety, corrosion or chemistry.

The operations representative matters more than most teams admit. The designer knows how the plant should work. The operator knows how it does.

4. Examine node by node

For each node, the leader states the design intent, then takes each relevant parameter and guide word combination. For each meaningful deviation, the team records:

• Causes.
• Consequences, assuming safeguards fail.
• Existing safeguards.
• Risk ranking if the study uses one.
• Actions, with an owner.

Recording consequences without safeguards first is important. It shows how bad the scenario could be, which decides how much protection is needed.

5. Close actions and follow up

A HAZOP report is not finished when the sessions end. IEC 61882 includes documentation and follow-up as part of the procedure. Each action needs an owner, a due date and a closure record that the team, or a delegated reviewer, accepts. Studies that never close their actions have changed nothing.

Where studies fail

These failure patterns are well documented in process safety practice. Watch for them in your own studies.

Wrong or old drawings. The team studies a design that is not what was built or what will be built. Every finding is then suspect.

Missing operations input. Without an experienced operator, the team does not discover the manual bypass that is always open or the startup sequence that is never followed.

Guide word fatigue. Late in a long day, the team starts to skip combinations or accept “no credible cause” without discussion. Keep sessions to sensible lengths and vary the pace.

Safeguards that are not independent. A control loop is listed as the safeguard for a deviation caused by the failure of that same loop. That is not protection. LOPA, layer of protection analysis, exists to test this properly.

Too many “consider” actions. Actions such as “consider adding an alarm” are easy to write and easy to close without doing anything. Write actions that state the problem and the outcome required.

No link to SIL assessment. Where a safety instrumented function is the safeguard, its required integrity must be set under IEC 61511. The HAZOP should feed scenarios to that assessment, not replace it.

Procedures ignored. Many incidents happen during startup, shutdown and maintenance, not steady operation. A procedural HAZOP, using the time and sequence guide words, covers these.

Leader not independent. A leader who designed the plant, or who reports to the project manager under schedule pressure, will steer the team away from expensive findings.

Management of change gaps. The plant is modified after the HAZOP and no one revisits the study. The original study is then about a different plant.

Good practice checklist

1. Freeze drawings and confirm they match the plant or design.
2. Appoint an independent, experienced leader.
3. Include an operator with real plant experience in every session.
4. Agree the risk matrix and how it will be used before starting.
5. Record consequences without safeguards first.
6. Test safeguards for independence.
7. Write specific, owned actions.
8. Feed safety instrumented function scenarios into LOPA and SIL assessment.
9. Cover startup, shutdown and maintenance procedures.
10. Track every action to closure and revisit the study under management of change.

HAZOP in the wider safety system

HAZOP is one tool among several. It identifies scenarios. LOPA tests whether protection is enough. SIL assessment sets the integrity of safety instrumented functions. Bow-tie analysis shows the barriers between a hazard and its consequences in a form managers and operators can use. Together they form the core of a process safety study package.

Next step

If a HAZOP is due on a new project, a modification or a periodic revalidation, our process safety service covers HAZOP facilitation, LOPA and SIL assessment, and action closure.

Sources

1. IEC 61882:2016 Hazard and operability studies (HAZOP studies), Application guide
2. ISO 31000:2018 Risk management, Guidelines
3. UK HSE, Hazard identification and risk assessment for major hazard sites

This article is general information, not legal or regulatory advice. Check the current text of each rule with the issuing authority.