Journal of Loss Prevention in the Process Industries 33 (2015) 52e58

Contents lists available at ScienceDirect

Journal of Loss Prevention in the Process Industries

journal homepage: www.elsevier.com/locate/jlp

A critique of the Hazard and Operability (HAZOP) study

Paul Baybutt
Primatech Inc., Columbus, OH, USA

a r t i c l e i n f o a b s t r a c t

Article history: Conventional wisdom holds that the Hazard and Operability (HAZOP) study is the most thorough and
Received 12 August 2014 complete process hazard analysis (PHA) method. Arguably, it is the most commonly-used PHA method in
Received in revised form the world today. However, the HAZOP study is not without its weaknesses, many of which are not
8 October 2014
generally recognized. This article provides a critique of the method to assist study teams in compensating
Accepted 15 November 2014
for them to the extent possible and to help guide the development of improved methods.
Available online 18 November 2014
© 2014 Elsevier Ltd. All rights reserved.
Keywords:
Process hazard analysis
Hazard and Operability (HAZOP) study
Process safety

1. Introduction this knowledge should help to guide the development of improved

Hazard scenarios for processes are identified using process
hazard analysis (PHA) methods such as the Hazard and Operability
(HAZOP) study (CCPS, 2008; Baybutt, 2013a). Arguably, the HAZOP
study is the most commonly-used process hazard analysis (PHA)
method in the world today and is viewed by many practitioners as
the most thorough and complete. It has been the topic of books
(Kletz, 1999; Redmill et al., 1999), guides (CIA, 1977; Crawley et al.,
2008) and an international standard (IEC, 2001) and is designated
as an acceptable PHA technique by regulations around the world,
for example, the Occupational Safety and Health Administration's
(OSHA's) Process Safety Management (PSM) standard (CFR, 1992). It
boasts a long history of application.
Despite its popularity, the HAZOP study suffers from numerous
inherent weaknesses, many of which are not generally recognized.
It shares common inherent weaknesses with other PHA methods
(Baybutt, 2014a) but also has inherent weaknesses of its own. Also,
there can be weaknesses in how PHA methods are practiced but
they are not addressed in this paper. Some limitations in the
application of the HAZOP study have been addressed previously
(Crawley, 1995; Tyler and Simmons, 1995) but this article provides a
comprehensive critique of the method. No such critique has been
published previously. Knowledge of weaknesses in the HAZOP
study method will enable study teams to compensate for them to
the extent possible. Specific guidance is provided for doing so. Also,
E-mail address: paulb@primatech.com.
PHA methods.
2. The HAZOP study
The HAZOP study is used to identify hazard scenarios that
impact receptors such as people, the environment and property, as
well as operability scenarios where the concern is with the capacity
of the process to function properly. It evolved from Work Study and
Critical Examination (Elliott and Owen, 1968; Lawley, 1974).
HAZOP studies focus on investigating deviations from design
intent. By definition, deviations are potential problems, for
example, lack of flow in a transfer line or overpressuring a storage
tank. Deviations are generated by applying guide words to process
parameters at different locations, called nodes, throughout the
process, for example, for an inlet line to a vessel, No þ Flow ¼ No
Flow, or for a vessel, High þ Pressure ¼ High Pressure. The process
parameters represent aspects of the design intent for the node. The
goal in a HAZOP study is to identify all aspects of design intent for
which deviations may result in scenarios within the scope and
objectives of the study.
A standard list of seven guide words is used: No, More, Less, As
Well As, Part Of, Reverse, and Other Than. Some practitioners add
Early, Late, Before and After, although other practitioners consider
these as variants of Other Than. The HAZOP study team chooses
appropriate parameters for each node, for example, flow, pressure,
temperature, composition, level, addition, cooling, etc. The use of
guide words with parameters provides the opportunity, at least in
principle, to explore deviations from design intent in every

http://dx.doi.org/10.1016/j.jlp.2014.11.010
0950-4230/© 2014 Elsevier Ltd. All rights reserved.
 P. Baybutt / Journal of Loss Prevention in the Process Industries 33 (2015) 52e58
conceivable way, thus helping to ensure completeness of scenario
identification.
The HAZOP team brainstorms causes of each deviation within
each node and identifies the sequence of events that results for
each cause including safeguards that may fail and the conse-
quences. This sequence of events represents a scenario. Usually, a
qualitative estimate is made of the severity and likelihood of the
scenario consequence so that a risk estimate may be produced to
help determine the need for risk reduction.
3. Weaknesses in the HAZOP study
The HAZOP study suffers from various weaknesses that are
specific to the method. They are described below.
3.1. Weaknesses relating to people
3.1.1. Heuristic approach
HAZOP studies rely on heuristics rather than algorithms which
is both a strength and a weakness. It is a strength in that study
teams use their imagination and creativity to identify scenarios
rather than following defined rules. This approach helps in iden-
tifying scenarios that otherwise may not be recognized. However, it
is a weakness in that study teams still may fail to identify scenarios
and cannot rely on a more prescriptive approach to save the day.
The weakness can be addressed to some extent by the judicious
incorporation of checklists into HAZOP studies, for example,
covering important aspects of PHA such as design intent and
initiating events.
3.1.2. Focus on team brainstorming
An essential aspect of HAZOP studies is the brainstorming of
scenarios by study teams that helps to stimulate creative thought
by team members. Almost always brainstorming is viewed as a
group activity. However, people also think creatively when given
time for contemplation and reflection while alone. Sometimes, the
human brain needs time to process information and make con-
nections in order to see matters in a new light. Thus, an important
aspect of human creativity is missed if reliance is placed exclusively
on team brainstorming. Unfortunately, the work of HAZOP team
members usually is considered complete after each study session
has finished. However, study team members may continue to think
about issues raised in a team session after the session has ended
and they should be encouraged to do so. Time should be allocated
for introspection by team members and the team leader should
take time at the beginning of each session to inquire of the team if
anyone has further thoughts on the results of previous sessions.
This review should be taken seriously and not viewed as a rote
exercise.
3.1.3. Structure provides a false sense of security
The HAZOP study provides more apparent structure than most
PHA methods through its generation of deviations from design
intent using guide words. The formal structure gives practitioners
the sense that a thorough analysis is being performed. Unfortu-
nately, this sense of security can be deceptive and may mislead
practitioners into believing that a thorough analysis has been per-
formed when that may not be the case. There are no guarantees
that all important deviations have been identified. Moreover, it is
the identification of initiating events that is truly important and
merits a structured approach more than the generation of
deviations.
The structure of the HAZOP study can also lead practitioners into
the trap of the rote generation of process deviations which
53
diminishes creative and imaginative thought that is so important in
hazard analysis.
Team leaders must recognize this pitfall and ensure team
members remain aware of the need to make every effort to ensure
studies are complete and do not become complacent.
3.1.4. Complexity
The many aspects of design intent that must be considered and
the challenges in generating deviations make HAZOP studies
complex, regardless of the complexity of the process on which a
study is performed. As the scope of a study increases and a high
degree of detail is required, the potential for incompleteness in-
creases owing to the increase in the number of items that are
subject to omission. Thus, HAZOP studies are highly susceptible to
being incomplete. Team leaders must remain vigilant throughout
studies to minimize the problem. Reliance on appropriate check-
lists and a focus on quality assurance is essential. Assignment of
responsibility for quality assurance to a qualified team member is
desirable.
3.1.5. Meaning of terms
The HAZOP study employs technical terms that are unfamiliar to
facility personnel who have not used the method. Terms such as
design intent, node, deviation, guide word, parameter, parameter
intent, and design representation can cause confusion. It is not
unusual for people, even practitioners, to confound some of the
terms.
Novice practitioners are sometimes confused by the differences
between guide words, parameters and deviations. However,
experienced practitioners may have difficulties too. It is not un-
common to see checklists that mix parameters, deviations, causes,
and other items. For example, along with common process pa-
rameters such as flow, temperature and pressure, items such as loss
of containment (a deviation), loss of utilities (a cause) and startup
(a mode of operation) may be found. Some practitioners invent
deviations. It is poor practice to supplement deviations with ad hoc
items or unnecessarily utilize guide words that are not part of the
formal framework of HAZOP studies. Either their place in the formal
framework should be identified or the issues they address should
be dealt with outside the HAZOP study.
To make matters even more confusing for study practitioners,
some terms may be viewed differently depending on the circum-
stances and how they are interpreted. For example, corrosion can
be interpreted as a deviation when the design intent is for no
corrosion to occur. However, in many cases it is treated as a
parameter, that is, an aspect of the design intent, and deviations
such as More Corrosion are considered. It is also possible to
consider corrosion as a cause of equipment failure. The differences
in these interpretations relate to the position that corrosion is
considered to occupy in the sequence of events that constitutes a
scenario. Such differences register with team members and create a
sense of unease when they are not understood. This contributes to
the mystique of the HAZOP study but also undermines its effective
use. Such interpretations should be made consistently throughout a
HAZOP study to avoid confusing team members unnecessarily.
Team leaders should be careful to use HAZOP terms correctly
throughout studies and be ready to explain their meaning and
provide examples, particularly with novice teams.
3.1.6. Studies are lengthy
Usually, PHA studies performed with the HAZOP study take
more time than other methods. Lengthy studies can have an
adverse impact on team performance as team members can
become fatigued and jaded (Baybutt, 2003). HAZOP studies take
longer because they involve a detailed search for scenarios but also
54 P. Baybutt / Journal of Loss Prevention in the Process Industries 33 (2015) 52e58
because of inefficiencies in the search process. These inefficiencies
include the identification of operability scenarios when they are not
desired and the consideration of process deviations that do not
result in scenarios of concern. The HAZOP study is theoretically
attractive but practically limited.
HAZOP team leaders must monitor the level of interest and
energy of team members throughout studies to minimize the
impact of lengthy studies on study quality (Baybutt, 2003, 2013b).
3.2. Weaknesses relating to design intent
3.2.1. Coverage of design intent
Conceptually, the definition of design intent for a process ap-
pears straightforward but practically it can be challenging (Baybutt,
2014b). The full design intent for a process can be complex and it is
not easily defined. Consequently, HAZOP studies often take the easy
path and default to a consideration of only those parameters that
are part of the process control scheme, plus a few others that are
obvious. Unfortunately, such an approach neglects potentially
important aspects of design intent.
Many aspects of process design influence safety and aspects of
design intent relevant to safety are scattered across multiple
different types of design representations. Identifying the set of
representations that covers those process aspects that could cause
hazards if they do not achieve the design intent is challenging.
Furthermore, typically, there are too many design representations
for a HAZOP study team to consult, either sequentially or in parallel,
so study teams favor those that are commonly used, most familiar,
or readily available. Not only is the team's view of the process
constrained but also it is fragmented because aspects of the process
design are scattered throughout multiple documents.
The guide words As Well As and Other Than are applied to pa-
rameters that represent aspects of the design intent for a process.
As such, they identify deviations from individual aspects of the
design intent that are to be avoided. However, there may be parts of
the design intent which themselves are aspects to be avoided but
which are not documented as part of the design intent. Study teams
need to be alert to the importance of such undocumented aspects
and address the possibility that deviations from them may occur by
applying guide words to the undocumented aspects. For example,
the avoidance of exposing a computer control processor to radio-
frequency interference (RFI) may not be addressed in the design
intent. It may not occur to the study team that the processor may
fail from RFI, say from an operator's radio, unless the study team
considers the possibility of omitted aspects of design intent. This
example emphasizes the importance of process knowledge by team
members.
Often the focus in HAZOP studies is on the design intent for
study nodes. However, aspects of design intent that address mul-
tiple nodes and the overall process also must be considered
(Baybutt, 2014b). Aspects of design intent may be missed for other
reasons including lack of documentation and an emphasis on
physical rather than logical aspects of design intent.
These challenges in covering all key aspects of design intent can
be addressed in HAZOP studies by ensuring team members are
present who have an intimate understanding of all key aspects of
the process. This includes not only design and process engineers
and operators but also maintenance and control systems engineers.
Essentially, any personnel who are involved with the process in
ways that may impact process safety should be represented on the
study team. Of course, the team leader will need to prompt the
team to identify key aspects of design intent.
It can be valuable to designate a team member as a devil's
advocate with responsibility for challenging unrecognized as-
sumptions made by the team, such as incomplete coverage of
design intent. Such an individual should have significant experi-
ence and be respected by the team in order to be effective.
3.2.2. Meaning of parameters
Parameters cover not only process variables such as flow, tem-
perature and pressure but also other aspects of a process such as
activities, for example, operating the process, maintaining equip-
ment, and pulling samples (Baybutt, 2014b). Consideration must be
given to all aspects of design intent for a process where deviations
may result in scenarios within the scope and objectives of the
study.
Care must be taken with the meaning of even apparently
straightforward process parameters such as flow, which should be
specified as flow rate or flow quantity. Such nuances in parameters
create pitfalls for the unwary.
HAZOP study leaders should ensure team members understand
the full scope of design intent and how parameters are extracted
from it in order to generate deviations from design intent.
3.2.3. Identification of parameters
Aspects of design intent may not be shown explicitly on design
representations. For example, piping and instrumentation draw-
ings (P&IDs) commonly are used as the principal design repre-
sentation in HAZOP studies for processes. However, even common
process parameters such as flow, temperature, and pressure are not
readily evident from the drawings. Of course, HAZOP practitioners
are expected to know that these parameters are potentially
important and common practice is to address them and to deter-
mine their allowed values from other process documentation.
However, the challenge of identifying important parameters is
greater for less-common parameters. The key to parameter iden-
tification is to identify those aspects of the design intent that are
subject to variations that may result in scenarios within the scope
and objectives of the study. This requires knowledgeable team
members who have the ability to think creatively. Parameters
should be identified by knowledgeable team members guided by
the study leader.
3.3. Weaknesses relating to deviations
3.3.1. Generation of deviations
There are many aspects of design intent and it is a significant
challenge to address all aspects for which deviations will result in
scenarios of concern. Unfortunately, the procedure that commonly
is employed to generate HAZOP deviations exacerbates the prob-
lem. Often, practitioners select parameters from a checklist. Indeed,
company PHA procedures may provide the checklist to be used.
Practitioners may not consider process parameters that may be
important but that are not on the checklist. Usually, such checklists
are short in length and contain only the most common process
parameters. Thus, the procedure used to conduct the HAZOP study
itself acts to inhibit consideration of other aspects of design intent
that may be important. As a consequence, important scenarios may
be missed. HAZOP study teams can try to avoid this pitfall by
defining design intents and selecting parameters from them
directly rather than using checklists of parameters.
However, even if practitioners attempt to address other pa-
rameters that represent important aspects of design intent, the
process of doing so is like gazing into a crystal ball to predict the
future, that is, which aspects of design intent, if addressed, will
generate scenarios of concern. This is the Achilles heel of the
HAZOP study which has not been widely recognized. The study
team can never be sure when all key aspects of design intent have
been addressed because it is not clear when a full set of parameters
has been addressed from the potentially large number to be
 P. Baybutt / Journal of Loss Prevention in the Process Industries 33 (2015) 52e58
considered. Certainly, use of experience from prior HAZOP studies
can assist in ensuring completeness in addressing design intent but
the essence of hazard analysis must be a predictive capability, that
is, the ability to identify important scenarios that have not been
recognized previously. Unfortunately, the HAZOP method provides
no assurance in this regard. The method depends entirely on the
creativity and judgment of the study team.
3.3.2. Inductive/deductive starting point is counterintuitive
HAZOP studies begin with the generation of deviations from
design intent implying that deviations are the central element in
PHA. However, deviations are not an end in themselves but are used
as an aid in identifying initiating events or causes of scenarios. A
deviation from design intent is actually part of the scenario. It
follows from the initiating event or cause and can be considered the
first intermediate event (see Fig. 1). This aspect of the HAZOP study,
which involves jumping to a deviation and then reversing course to
consider causes before proceeding forward again, can be confusing
for novice practitioners and can lead to confounding deviations
with causes or consequences.
HAZOP study leaders should ensure that team members clearly
understand this aspect of HAZOP studies.
3.3.3. Multiple deviations
The combination of some guide words with a process parameter
may generate more than one deviation. For example, the combi-
nation of As Well As with Flow can produce Chemical
Reaction, Foaming, and possibly other deviations. Sometimes de-
viations are called interpretations of guide word/parameter
combinations. Unfortunately, the combinative rule of guide
word þ parameter ¼ deviation is interpreted by some practitioners
as a one-to-one relationship rather than the possibility of a one-to-
many relationship. In such cases, deviations may be missed.
HAZOP study leaders should ensure teams consider multiple
deviations when they are possible for a process.
3.3.4. Compound deviations
Compound deviations involve potential multiple failures
(Baybutt, 2013c). Usually, compound deviations, for example, the
occurrence of the contamination of material in a vessel along with
the independent occurrence of high temperature of the contents
that might cause an explosion, are not considered in HAZOP studies
owing to the difficulty of doing so. While it can be argued that the
occurrence of such compound deviations may be of low likelihood,
they cannot be dismissed entirely on those grounds. It is possible
that some compound deviations could be addressed using enablers
but it is not common practice.
Fig. 1. The role of deviations in the HAZOP study.
55
3.3.5. Repeated deviations and scenarios
The same deviation or interpretation is sometimes possible for
different combinations of guide words and parameters. For
example, the deviation Contamination can be generated from the
combinations As Well As þ Composition and As Well As þ Flow.
Similarly, a scenario that is identified for the deviation High Pres-
sure may also be identified for the deviation High Temperature.
This repetition is viewed by some HAZOP study practitioners as an
advantage of the method because it provides more than one op-
portunity to address a deviation and identify scenarios. However,
repetition in a HAZOP study can frustrate team members and lead
to lower quality studies (Baybutt, 2013b).
HAZOP study leaders should establish and follow a convention
for how deviations will be generated in a study and be alert to and
avoid unnecessary repetition by the team.
3.3.6. Propagation of deviations
Small deviations from design intent in one part of the process
may not be viewed as significant but they may result in significant
effects in other parts of the process. For example, a small change in
the composition of a reactant in a charge tank for a process could
result in a runway reaction in the process reactor. With the focus on
individual nodes in HAZOP studies, the team may not realize the
significance of the small deviation in composition and may miss the
identification of an important scenario.
Assignment of responsibility for quality assurance to a team
member can help to address issues that may be overlooked by other
team members or by the team leader, such as the propagation of
deviations. Of course, the person must be familiar with the types of
issues that may be missed by a team.
3.3.7. Focus on deviations
From the perspective of identifying hazard scenarios, the HAZOP
study is inefficient. The work involved in addressing a wide range of
deviations can become exhausting for team members causing
teams to move on before all significant deviations have been
considered which leads to an ineffective study. Short of using a
different PHA method, HAZOP study leaders should do their best to
facilitate studies in ways that avoid burning out team members.
The wisdom of basing a search for hazard scenarios on exam-
ining deviations from the design intent for a process certainly can
be questioned. It can be argued that it is more sensible to re-frame
the task and base the identification of hazard scenarios on a search
for the starting points of scenarios that produce hazardous events
of concern, namely, their initiating events.
56 P. Baybutt / Journal of Loss Prevention in the Process Industries 33 (2015) 52e58
3.4. Weaknesses relating to guide words
3.4.1. Limitations of guide words
In principle, the standard set of seven HAZOP guide words can
generate every conceivable deviation from design intent for a
process, if the design intent is defined fully. However, in practice
some deviations may be missed because the study team does not
recognize the particular combination of a guide word with a
parameter as a valid deviation. For example, when the guide words
As Well As or Other Than are applied to aspects of process intent,
the team must consider a multiplicity of possible additions or
substitutions. Not every team will consider the deviation of Unin-
tended Chemical Reaction generated by the combination of As Well
As with Flow or Installation of an Incorrect Gasket in a flange
generated by the combination of Other Than with Gasket Specifi-
cation. The imagination required for the identification of such de-
viations may be lacking in a team or shelved owing to time
pressures. Missed deviations may lead to missed scenarios.
Of course, HAZOP team leaders should prompt team members to
consider a full set of deviations. However, the selection of team
members with creativity, motivation and stamina is a fundamental
requirement for doing so.
3.4.2. Use of additional guide words
Part of the appeal of the HAZOP study to experienced practi-
tioners is the ability to use a small number of guide words to
generate any parameter deviation whatsoever. However, difficulties
in using the seven standard guide words, combined with a lack of
understanding of the theoretical foundation of the HAZOP study,
can lead to the indiscriminate use of additional guide words. It is
not uncommon to encounter such examples as Loss of Contain-
ment, Startup, and Maintenance. These are not guide words. Loss of
Containment can be a deviation from design intent that is gener-
ated by applying the guide word No to the parameter Containment.
Startup is a mode of operation and should be subject to a HAZOP
study in its own right. Maintenance consists of various tasks that
are performed to address the reliability of equipment. Deviations
from maintenance intent should be considered by applying guide
words to the specific content of maintenance procedures and other
aspects of maintenance intent. The addition of key words or
prompts defeats the essence of HAZOP studies, weakens their rigor,
and can cause confusion. It should be avoided.
The standard guide words do require some minor modifications
to clarify their application to some parameters, for example, More
may be replaced with Higher, Reverse by Inversion, and Other Than
by Sooner/Later or Before/After. Most study teams do not have
difficulty with such contextual substitutions.
3.5. Weaknesses relating to initiating events
3.5.1. Causes of deviations
Once important parameters have been identified and deviations
generated, the HAZOP team searches for credible causes of
parameter deviations. These causes constitute initiating events for
scenarios. Each possible deviation is considered in turn. However,
causes do not follow from deviations and are not necessarily
obvious. Arguably, the most important aspect of PHA is the iden-
tification of initiating events for scenarios because, if initiating
events are missed, an entire scenario will be missing from the PHA
study. The emphasis on deviations in the HAZOP study distracts
from the more important issue of identifying initiating events for
scenarios.
Once pertinent deviations have been identified, HAZOP study
leaders should emphasize to the team the importance of brain-
storming to identify a full set of initiating events.
3.5.2. Identification of initiating events
The HAZOP study does not provide any guidance on identifying
initiating events. HAZOP study teams simply brainstorm what they
believe are credible causes of process deviations using engineering
judgment. A more rigorous process is needed to help ensure
completeness of scenario identification. Checklists of causes can be
used but they can be lengthy and teams quickly become discour-
aged from using them. Also, many causes are similar from one node
to another and teams frequently become fatigued through the re-
petitive nature of HAZOP studies (Baybutt, 2003). This practice
wastes the intellectual energy of the team members which is one of
the most valuable resources of the PHA team. The problem can be
overcome by automating the generation of common initiating
events to preserve the energy of the team for brainstorming novel
causes (Baybutt, 2014a; Primatech, 2014), although this practice is
not commonly employed.
3.6. Weaknesses relating to operability scenarios
3.6.1. Operability issues are included with hazard scenarios
At first glance, a hazard analysis technique that is based on
identifying deviations from the design intent for a process appears
sound. Logically, a hazard scenario will arise when something does
not go as intended. However, there are many deviations from
design intent for a process that do not result in hazard scenarios.
There can be problems with the operability of a process, the quality
of products, etc. and, indeed, the HAZOP study is intended to
identify both hazard and operability scenarios as its name implies.
Some practitioners want to include both types of scenarios in a
study. However, other practitioners desire only to address hazard
scenarios. Unfortunately, it is difficult to exclude operability sce-
narios and address hazard scenarios exclusively because the con-
sequences of scenarios may not be apparent until causes have been
identified. At that point, much of the work on scenario identifica-
tion has been performed. Typically, operability scenarios signifi-
cantly outnumber hazard scenarios in a HAZOP study and,
consequently, their inclusion can increase the time required for a
study significantly. Obviously, this is a problem when practitioners
would prefer to exclude operability scenarios and militates against
the use of the HAZOP study in such cases.
3.6.2. Hazards of operability scenarios
Operability scenarios may have hazards associated with them.
For example, a scenario that results in an off-specification product
may require the process to be shut down for equipment clean-out.
The activities of shutting down the process and cleaning out the
equipment may pose hazards. The hazards may be within or
outside the scope and objectives of the study. In either case, HAZOP
study teams are less likely to identify these hazards because they
occur incidentally to the operability issues. Teams may not look for
such secondary hazards or may not be able to identify them. Such
hazards can be addressed by performing hazard analysis on the
states of the process involved, although this is not always done.
3.7. Weaknesses relating to technical coverage
3.7.1. Completeness of scenario identification
Completeness for a PHA study means the identification of a full
set of credible hazard scenarios for a process. Some practitioners
confuse the ability of the HAZOP study to identify, in principle,
every conceivable deviation from design intent with completeness
of scenario identification, but they are quite different. Deviations
are the starting point in HAZOP studies and identifying a full set
does not guarantee that a complete set of scenarios will be
 P. Baybutt / Journal of Loss Prevention in the Process Industries 33 (2015) 52e58
identified. Of course, if the identification of deviations is incom-
plete, so will be the identification of scenarios.
Thus, HAZOP study leaders should ensure that team members
understand the importance of considering not only a full set of
deviations but also a full set of initiating events both of which are
needed to help ensure completeness of scenario identification.
3.7.2. Difficulty in focusing on specific hazard types
PHA studies often focus on the so-called major hazards of
toxicity, flammability, explosivity and reactivity. These hazards are
the only specific ones required to be addressed under OSHA's PSM
standard and some companies may wish to restrict their PHA
studies to consider only those hazards covered by regulations.
Other companies may choose to address additional specific haz-
ards. In either case, it would be valuable if PHA methods could be
tailored to address only those hazards of concern to permit more
efficient studies. The HAZOP study can accommodate various haz-
ard types and it does so by addressing deviations from design intent
that might result in the realization of hazards. However, the HAZOP
analysis cannot be restricted in advance only to those aspects of
design intent for which deviations might result in the realization of
the hazards of concern. Thus, the HAZOP study team may address
aspects of design intent that ultimately do not yield hazards of
concern, although other types of hazards may be identified. For
example, a control system failure may result in the release of ni-
trogen into a building with the possibility of asphyxiating
personnel, or a valve misalignment may result in the exposure of
operators to a corrosive material. Such hazards are not major haz-
ards and may not be part of a study. However, they may arise
incidentally to the consideration of major hazards in a HAZOP
study. Obviously, such hazards must be managed when they are
present in a process but there may be better ways of addressing
them than by using the HAZOP method. In such cases, companies
would like to exclude them from consideration but the way in
which HAZOP employs design intent to identify deviations and the
realization of hazards makes it difficult to do so. The indirect way
that hazards of concern are addressed can lead to the consideration
of deviations which do not produce scenarios involving these
hazards and the consequent waste of time spent addressing them.
Team leaders must be alert to the occurrence of such situations and,
as soon as confirmed, quickly move on to consider deviations that
involve pertinent hazards.
3.7.3. Ability to address chemical reactivity hazards
Scenarios for chemical reactivity hazards are different in nature
than those for the other types of major hazards. Scenarios for the
hazards of toxicity, flammability and explosivity typically take the
form:
Initiating event / Intermediate events / Loss of containment
/ Hazardous material release / Effects / Impacts on
receptors.
In contrast, scenarios for chemical reactivity hazards take the form:
Initiating event / Reactivity excursion / Intermediate events
/ Effects / Impacts on receptors.
In the first scenario type, the hazards are realized after containment
has failed and receptors are impacted directly by the realized
hazards (toxic exposure, fires, explosions); whereas in the second
scenario type the hazard is realized as the proximate result of the
initiating event which results in effects, including possible loss of
containment, that produce impacts on receptors. This difference
affects how chemical reactivity hazards are addressed using the
HAZOP study.
Although fires and some explosions involve chemical reactions
(usually an oxidation), combustion processes of flammables with
air are handled in process safety as a fire or explosion hazard
57
external or internal to the process and not as a reactivity hazard.
Flammable or explosive materials do not necessarily present
chemical reactivity hazards. Fires and explosions internal to a
process are similar to the second scenario type.
Chemical reactivity scenarios can arise from loss of control of
intended chemical reactions, self-reacting chemicals, and chemical
incompatibilities arising from the inadvertent mixing of process
chemicals or the reaction of process chemicals with materials
present in the process such as water, air, materials of construction,
lubricating oils, utility fluids, etc. The need to address loss of control
of intended chemical reactions should be obvious to HAZOP study
teams as such reactions are a key part of the design intent for the
process. Thus, a HAZOP study will address deviations from inten-
ded chemical reactions such as More Reaction (Runaway Reaction)
and Other Than Reaction (Different Reaction Than Intended).
However, aspects of design intent that relate to self-reacting
chemicals and chemical incompatibilities often are less obvious to
the study team and, indeed, may not be documented as part of the
design intent. Thus, their consideration in HAZOP studies can be
challenging without an awareness of chemical reactivity hazards by
the study team and the desire to consider them. Deviations from
the design intent that result in chemical reactivity scenarios must
be considered. Thus, the study team must recognize the importance
of considering deviations such as Other Than Composition (Mate-
rial Self-reacts) and As Well As Composition (Inadvertent Mixing of
Materials).
The nature of chemical reactivity hazards makes their consid-
eration using the HAZOP study more difficult for practitioners than
for other major hazards (Baybutt, 2014c).
3.7.4. Ability to address process changes
Periodically, PHA studies must be updated to make corrections,
edits, and/or add new content, that is revalidated. Periodic updating
provides an opportunity to address the impacts of changes to
processes. PHA studies on changes can be conducted as a new study
or the existing PHA for the process can be updated. However, the
HAZOP study is not well suited to updating a previous study for
changes owing to the difficulty of focusing precisely on the effects
of the change. The structure of a HAZOP study inhibits a focus on
changes. For example, the addition of a pump to a line may intro-
duce new scenarios. Typically, the scenarios will be associated with
multiple different deviations and different aspects of design intent.
Consequently, they must be recorded in different parts of the
HAZOP study worksheets which detracts from the focus on the
effects of the change. For example, if the pump fails off it will result
in No Flow, if the pump leaks it will result in Low Flow, and if the
pump fails on it will result in High Level. This problem is an artifact
of the HAZOP study and little can be done to address it, other than
ensuring the team is aware that a single process change may result
in multiple worksheet changes in different locations so that the
chance of missing any is reduced.
Some changes propagate throughout a process and the modifi-
cation of existing scenarios and recording new scenarios become
even more complex. For example, a change in a reactant specifi-
cation will have impacts throughout a process. Scenarios for many
nodes and deviations will be affected but they will be scattered
throughout the study worksheets thus impeding a focus on the
effects of a change. Furthermore, there can be a tendency in PHA
revalidation studies to focus on the local effects of changes that
propagate throughout a process at the expense of effects that occur
in other parts of the process. HAZOP team leaders must ensure
team members are aware of this issue to reduce the likelihood of
omitting needed worksheet modifications during revalidation
studies.
58 P. Baybutt / Journal of Loss Prevention in the Process Industries 33 (2015) 52e58
3.8. Weaknesses relating to documentation
3.8.1. Incomplete identification of scenario elements
Typically, HAZOP studies are documented in worksheets that
record deviations, causes, consequences, safeguards and recom-
mendations. Commonly, columns for scenario severity, likelihood
and risk are also provided so that a risk estimate can be made.
However, the inclusion of these columns, and even a safeguards
column, in HAZOP study worksheets dates back only to the early
1990's.
There are other elements of scenarios that may be important
and often are not recorded in HAZOP study worksheets. Usually,
intermediate events that may occur between a cause and its con-
sequences are not recorded in a separate worksheet column. Either
they are omitted or they are included in the Consequences column
of the worksheet. The omission of details on intermediate events
may make scenarios harder for reviewers to understand and makes
follow-on studies, such as layers of protection analysis, more
difficult to perform. Furthermore, the inclusion of intermediate
events in the Consequences column produces consequence entries
that can be confusing. A solution for this issue is to add an Events
column to the worksheet to provide important scenario details,
such as the specific location of a release, although this practice is
not yet common. Such a column also can be used to capture process
states, such as hazardous events, that occur as part of a scenario.
Usually, enablers have not been addressed in PHA unless they
are perceived to play a critical role for a scenario, such as the pos-
sibility of a disabled safety system. Of course, enablers play key
roles in real-world accidents and their inclusion in PHA studies is
desirable (Baybutt, 2014d). A solution for this issue is to add an
Enablers column to the worksheet and record important enablers
and contributing causes for scenarios in the column.
3.8.2. Presentation of results
Usually, scenarios in HAZOP studies are captured in individual
worksheets for a particular combination of a node and parameter
using software or paper. Thus, scenarios for each node are spread
across several worksheets. It is preferable for a PHA method to
organize all scenarios for a node in a logical order in a single
worksheet for ease of use and reference. HAZOP study worksheets
can be reorganized on the completion of studies but usually this is
not done owing to the effort involved.
4. Conclusions
Most practitioners view the HAZOP study as the most thorough
and comprehensive of the traditional PHA methods. On face value,
the method appears to offer a thorough and comprehensive iden-
tification of hazard scenarios. However, while theoretically it may
be capable of achieving this goal, practically it is unlikely to do so
for various reasons. The HAZOP study shares weaknesses with
other PHA methods and also has weaknesses of its own. This paper
describes inherent weaknesses in the HAZOP study.
Weaknesses that were addressed relate to the coupling of vul-
nerabilities of the method with the human limitations of
practitioners; the coverage of design intent and the meaning and
identification of parameters; the generation and role of deviations;
the consideration of multiple, compound and repeated deviations;
the propagation of deviations and the focus on deviations; limita-
tions of guide words; use of additional guide words; causes of de-
viations and the identification of initiating events; the
consideration of operability scenarios; technical coverage including
completeness of scenario identification, focus on hazard types,
chemical reactivity hazards, and process changes; and documen-
tation including identification of scenario elements and presenta-
tion of results. A number of the weaknesses relate to particular
ways in which the HAZOP study is dependent on the knowledge
and experience of the participants.
Knowledge of weaknesses in the HAZOP study allows practi-
tioners to compensate for them to the extent possible when per-
forming studies. Guidance was provided on how to do so for each
issue identified. Knowledge of weaknesses also assists with the
development of improved PHA methods (Baybutt, 2014a).
References
Baybutt, P., 2003. On the ability of process hazard analysis to identify accidents.
Process Saf. Prog. 22 (3), 191e194.
Baybutt, P., 2013a. Analytical methods in process safety management and system
safety engineering e process hazards analysis. In: Haight, J.M. (Ed.), Handbook
of Loss Prevention Engineering. Wiley-VCH, Weinheim, Germany.
Baybutt, P., 2013b. The role of people and human factors in performing process
hazard analysis and layers of protection analysis. J. Loss Prev. Process Ind. 26,
1352e1365.
Baybutt, P., 2013c. Treatment of multiple failures in process hazard analysis. Process
Saf. Prog. 32, 361e364.
Baybutt, P., 2014a. Requirements for improved process hazard analysis (PHA)
methods. J. Loss Prev. Process Ind. 32, 182e191.
Baybutt, P., 2014b. Design intent for hazard and operability (HAZOP) studies. Pro-
cess Saf. Prog. http://dx.doi.org/10.1002/prs.11718.
Baybutt, P., 2014c. Process hazard analysis for reactive chemicals. Chem. Eng. Prog.
(in press).
Baybutt, P., 2014d. Addressing enablers in layers of protection analysis. Process Saf.
Prog. http://dx.doi.org/10.1002/prs.11639.
CCPS, 2008. Guidelines for Hazard Evaluation Procedures, third ed. Center for
Chemical Process Safety/American Institute of Chemical Engineers, New York,
NY.
CFR, February 24, 1992. Final rule, process safety management (PSM) of highly
hazardous chemicals, vol. 57, Number 36. Federal Register, pp. 6355e6417, 29
CFR 1910.119.
CIA, 1977. A Guide to Hazard and Operability Studies. Chemical Industries Associ-
ation, London, England.
Crawley, F.K., 1995. Do hazard and operability studies have their limitations? Loss
Prev. Bull. (121), 3e5.
Crawley, F., Preston, M., Tyler, B., 2008. HAZOP: Guide to Best Practice, second ed.
Institution of Chemical Engineers, Rugby, England.
Elliott, D.M., Owen, J.M., 1968. Critical examination in process design. Chem. Eng.
377e383.
IEC, 2001. Hazard and Operability Studies (HAZOP Studies) e Application Guide. IEC
61882:2001. International Electrotechnical Commission, Geneva, Switzerland.
Kletz, T.A., 1999. Hazop and Hazan: Identifying and Assessing Process Industry
Hazards, fourth ed. Taylor and Francis, London, England.
Lawley, H.G., 1974. Operability studies and hazard analysis. Chem. Eng. Prog. 70 (4),
45e56.
Primatech, 2014. PHAWorks®. Primatech Inc.. www.primatech.com (last accessed
09.06.14.).
Redmill, F., Chudleigh, M., Catmur, J., 1999. System Safety: HAZOP and Software
HAZOP. Wiley, Chichester, England.
Tyler, B., Simmons, B., 1995. Hazop studies: knowing their limitations. Loss Prev.
Bull. (121), 6e8.