Resources - System Safety

Hazard and Operability (HAZOP) Analysis

The HAZOP analysis technique uses a systematic process to (1) identify possible deviations from normal operations and (2) ensure that appropriate safeguards are in place to help prevent accidents. The HAZOP technique uses special adjectives (such as "more," "less," "no," etc.) combined with process conditions (such as speed, flow, pressure, etc.) to systematically consider all credible deviations from normal conditions. The adjectives, called guide words, are a unique feature of HAZOP analysis.

Brief summary of characteristics

  • A systematic, highly structured assessment relying on HAZOP guide words and team brainstorming to generate a comprehensive review and ensure that appropriate safeguards against accidents are in place
  • Typically performed by a multidisciplinary team
  • Applicable to any system or procedure
  • Used most as a system-level risk assessment technique
  • Generates primarily qualitative results, although some basic quantification is possible

Most common uses

  • Used primarily for identifying safety hazards and operability problems of continuous process systems, especially fluid and thermal systems
  • Also used to review procedures and sequential operations

Limitations of the HAZOP Technique

Requires a well-defined system or activity. The HAZOP process is a rigorous analysis tool that systematically analyzes each part of a system or activity. To apply the HAZOP guide words effectively and to address the potential accidents that can result from the guide word deviations, the analysis team must have access to detailed design and operational information. The process systematically identifies specific engineered safeguards (e.g., instrumentation, alarms, and interlocks) that are defined on detailed engineering drawings.

Time consuming. The HAZOP process systematically reviews credible deviations, identifies potential accidents that can result from the deviations, investigates engineering and administrative controls to protect against the deviations, and generates recommendations for system improvements. This detailed analysis process requires a substantial commitment of time from both the analysis facilitator and other subject matter experts, such as crew members, engineering personnel, equipment vendors, etc.

Focuses on one-event causes of deviations. The HAZOP process focuses on identifying single failures that can result in accidents of interest. If the objective of the analysis is to identify all combinations of events that can lead to accidents of interest, more detailed techniques should be used such as Fault Tree Analysis (FTA).

Procedure for HAZOP Analysis

The procedure for performing a HAZOP analysis consists of the following five steps:

  1. Define the system or activity. Specify and clearly define the boundaries of the system or activity for which hazard and operability information is needed.
  2. Define the problems of interest for the analysis. Specify the problems of interest that the analysis will address. These may include health and safety issues, environmental concerns, etc.
  3. Subdivide the system or activity and develop deviations. Subdivide the system or activity into sections that will be individually analyzed. Then apply the HAZOP guide words that are appropriate for the specific type of equipment in each section.
  4. Conduct HAZOP reviews. Systematically evaluate each deviation for each section of the system or activity. Document recommendations and other information collected during the team meetings, and assign responsibility for resolving team recommendations.
  5. Use the results in decision making. Evaluate the recommendations from the analysis and the benefits they are intended to achieve. The benefits may include improved safety and environmental performance or cost savings. Determine implementation criteria and plans.

Detailed Description of Steps

1. Define the system or activity

Intended functions. Because all HAZOP analyses are concerned with ways in which a system can deviate from normal operations, clearly defining the intended functions for a system or activity is an important first step. It is important to clearly document this step for the HAZOP analysis.

Boundaries. Few systems or marine activities operate in isolation. Most are connected to or interact with others. By clearly defining the boundaries of a system or activity, analysts can avoid (1) overlooking key elements at interfaces and (2) penalizing a system or activity by associating other equipment or operations with the subject of the study. This is especially true of boundaries with support systems, such as electric power and compressed air, or boundaries with other vessel activities, such as cargo loading and unloading. It is also important to clearly define the extent to which support systems will be analyzed.


The figures on the next two pages define the boundaries for a HAZOP analysis of fuel barge filling operations at small marine terminals. The procedure that follows describes the intended transfer operation.

2. Define the problems of interest for the analysis

Safety problems. The analysis team may be asked to look for ways in which improper performance of a marine activity or failures in a hardware system may result in personnel injury. These injuries may be caused by many mechanisms, including the following:

  • Vessel collisions or groundings
  • Drowning
  • Exposure to high temperatures (e.g., through steam leaks)
  • Fires or explosions

Environmental issues. The analysis team may be asked to look for ways in which the conduct of a particular marine activity or the failure of a system may adversely affect the environment. These environmental issues may be caused by many mechanisms, including the following:

  • Discharge of material into the water, intentional or unintentional
  • Equipment failures, such as seal failures, that result in a material spill
  • Overutilization of a marine activity resulting in a disruption of the ecosystem

Economic impacts. The analysis team may be asked to look for ways in which the improper conduct of a particular marine activity or the failure of a system may have adverse economic impacts. These economic risks may be categorized in many ways, including the following:

  • Business risks, such as vessels detained at port, contractual penalties, lost revenue, etc.
  • Environmental restoration costs
  • Replacement costs, such as the cost of replacing damaged equipment

A particular analysis may focus only on events above a certain threshold of concern in one or more of these categories.

Example for the barge filling HAZOP

The project team defined the problems of interest for this analysis as:

  • Oil spill into the water or onto the ground, outside of secondary containment, during a barge filling operation
  • Fire or explosion involving the product during a barge filling operation

For this brief demonstration workshop, the team chose not to address other possible consequences of interest, such as the following:

  • Various types of injuries to workers not directly associated with the consequences listed above. These injuries can result from physical hazards, electrical hazards, thermal hazards, etc.
  • Product contamination issues
  • Equipment damage not directly associated with the consequences listed above

3. Subdivide the system or activity and develop deviations

Before the HAZOP team meets, the leader and scribe should conduct several activities to help make the team meeting time more efficient. These pre-meeting activities include the following:

3.1 Define sections. Sections are simply discrete parts of a process such as a section of piping a tank, etc. The leader and scribe must divide the system equipment into sections in order to properly apply the HAZOP technique. The leader must balance two competing factors: (1) the HAZOP team may overlook important deviations if the sections are too large and (2) the HAZOP team will waste time examining the same issues repeatedly if the sections are too small.

3.2 Develop credible deviations. Deviations are upset conditions compared to normal operations. The structured approach of the HAZOP analysis is accomplished by using special guide words. Deviations are derived in the following manner:

Guide Word + System Parameter = Deviation

The type of system section, such as piping or tank, will determine the applicable system parameters to be analyzed for that section. By combining guide words with the applicable process parameter, the leader develops a list of credible deviations to analyze during the study.

3.3 Develop HAZOP worksheets.The scribe is responsible for documenting a significant amount of information during the study. Preparing specialized worksheets before the meeting for each type of section and for the credible deviations will help the scribe more efficiently organize the HAZOP information collected during the meetings.

The following subsections describe these terms and steps in more detail.

Guidelines for defining sections for a HAZOP analysis

Three general considerations should guide the leader when dividing a system into sections:

Define sections appropriate for the HAZOP objectives. A HAZOP analysis investigating the potential for reportable material releases into the waterway may require consideration of many more system sections than a HAZOP analysis investigating material releases large enough to create long-term chronic health risks.

Define sections small enough to include all important deviations. It is far better to discover that a section has deviations that are the same as another section than to miss an important deviation. Experienced leaders will quickly recognize the unnecessary section and move the team on. Inexperienced leaders will learn to recognize unnecessary sections, but by defining small sections, they will be less likely to miss an important deviation, while gaining experience as a leader.

Define sections at a consistent level of detail. The HAZOP leader should not define every sample connection and instrument line as sections for one part of a process, while defining a shoreside tank farm as a single section elsewhere in the process. If the HAZOP objectives require sectioning the unit to a certain level of detail, then that same level should be applied throughout the analysis.

Dividing a system or activity into sections and selecting appropriate deviations are interrelated activities. The suggested deviations for sections presume these guidelines for sectioning have been followed. Specific circumstances will dictate exceptions to these sectioning guidelines and to the guidelines for selecting deviations. In most situations, following these guidelines will produce process sections that can be thoroughly reviewed by the HAZOP team with a minimum risk of overlooking important deviations. The guidelines are as follows:

Beginning guidelines (for leaders with less experience)

  • Define each major component as a section. Usually, anything in which a fluid level is maintained should be considered a major component.
  • Define one line section between each major component
  • Define additional line sections for each branch off the main flow
  • Define a section at each connection to existing equipment

Advanced guidelines

Experienced leaders will recognize that the beginning guidelines often produce some "unnecessary" process sections. The following are supplemental guidelines that will help experienced leaders reduce duplication:

  • Define only one section for equipment in identical service. The most common situation is multiple pumps or heat exchangers. CAUTION: Pumps in different service with a "common" spare must be treated separately, and additional deviations such as misdirected flow must be considered. Usually, the HAZOP team must explicitly consider operation of the common spare as a special operating mode if the common spare has characteristics different from the pump it replaces. These characteristics may include higher pressure, larger flow, etc.
  • Define only one line section for a series of components if there are no other flow paths. Line sections are necessary to cover deviations such as the low or high temperature caused by a heat exchanger or the low or high pressure caused by a pump. As illustrated in the figure below, only one line section is necessary between the vessel and the on-shore storage tank.
  • Define only one additional line section if there are alternate flow paths, regardless of how many branches there are. However, add misdirected and reverse flow deviations specifically for each branch. As illustrated in the figure below, assuming flow through FV1 is the desired path, define Section B as the manifold with the following misdirected or reverse flow deviations:
    • Misdirected flow from vessel to FV-2
    • Misdirected flow from vessel to FV-3
    • Reverse flow from FV-1 to FV-2
    • Reverse flow from FV-1 to vessel
    • Reverse flow from FV-2 to vessel
    • Reverse flow from FV-2 to FV-3
    • Reverse flow from FV-2 to storage tank
    • Reverse flow from FV-3 to FV-1
    • Reverse flow from FV-3 to FV-2
    • Reverse flow from FV-3 to storage tank

Example sections for the barge filling HAZOP

To facilitate the HAZOP analysis, the team divided the system into the following three distinct sections:

  • Section 1: Shoreside Transfer System. A line section from the storage tanks to the barge's piping manifold, including any pump stations, shoreside flow control valves and isolation valves, and the transfer hose
  • Section 2: Barge Transfer System Piping. A line section from the transfer hose to the barge's cargo tanks, including the barge's manual valves
  • Section 3: Barge Cargo Tanks. A vessel section representing each of the cargo tanks on the barge, including the tanks and associated gauging devices

Develop credible deviations

Deviations are developed in the HAZOP technique by applying guide words to system conditions.

Example sections for the barge filling HAZOP

For each section, the team developed a list of possible deviations (off-normal conditions) that could develop and cause consequences of interest. Consistent with the HAZOP analysis approach, the team developed this list of deviations by combining "guide words" (essentially a standard list of adjectives) with normal process parameters for sections of the system. The following table lists the deviations that the team considered for each section and illustrates how the team developed the list.

Develop HAZOP worksheets

During the meeting, the scribe will document the HAZOP information on worksheets. The following information will be documented for the HAZOP:

Section. Name of the section. This is usually documented by the leader and scribe before the meeting.

Intent. The team will describe the design intent for the particular HAZOP section being analyzed. Declaring this intent is important, because the remainder of the discussion will focus on ways that the process can deviate from this intent. An example of a design intent for a vessel unloading line may be: "Transfers crude oil from vessel cargo tanks to the shoreside storage tank using flow control."

Deviation. Specific deviation that will be analyzed by the team

Causes. Credible causes for the deviation as postulated by the HAZOP team

Accidents. Ultimate accidents of the deviation as postulated by the HAZOP team. These should correspond to the problems of interest that were defined as an objective for the study.

Safeguards. Engineering and administrative controls that protect against the deviations. These safeguards can either help prevent the cause from occurring or help mitigate the severity of the accidents should the cause occur.

Recommendations. Suggestions made by the team to help reduce the risk associated with specific issues if the team is not comfortable with the level of safeguards that currently exist

The table on the following page includes an example HAZOP worksheet. Completed HAZOP worksheets are presented later in this section.

4.0 Conduct HAZOP reviews

The systematic analysis process of the HAZOP technique is conducted in the following manner:

Step 1. Introduce the team members.

Step 2. Describe the HAZOP approach.

Step 3. Identify Section 1.

Step 4. Ask the team to define the design intent of Section 1.

Step 5. Apply the first deviation to Section 1, and ask the team "What are the consequences of this deviation?"

Allow time for the team to consider the system upset. Some prompting may be necessary to get the discussion going.

If no accidents of interest are identified, go back to the beginning of Step 5 and apply the next deviation. If there are no credible accidents, there is no need for the team to investigate causes or safeguards.

Step 6. After the team has exhausted its analysis of accidents, prompt the team to identify all of the causes of the deviation.

Step 7. Identify the engineering and administrative controls that protect against the system upset. Remember, these controls can be either preventive (i.e., they help prevent the upset from occurring) or mitigative (i.e., they help reduce the severity of the accidents associated with the upset if it occurs).

Step 8. If the team is concerned that the level of protection is not adequate for the particular system upset, then the team should develop recommendations to investigate alternatives. Level of protection includes the number, type, and pedigree of the safeguards.

Step 9. Summarize the information collected for this deviation.

Step 10. Repeat Steps 5 through 9 for the remaining deviations associated with this section.

Step 11. Repeat Steps 3 through 10 for the remaining sections.

Source: USCG Risk-based Decision-making (RBDM) Guidelines.

Certisafety Section Home Page

Copyright ©2000-2019 Geigle Safety Group, Inc. All rights reserved. Federal copyright prohibits unauthorized reproduction by any means without permission. Disclaimer: This material is for training purposes only to inform the reader of occupational safety and health best practices and general compliance requirement and is not a substitute for provisions of the OSH Act of 1970 or any governmental regulatory agency. CertiSafety is a division of Geigle Safety Group, Inc., and is not connected or affiliated with the U.S. Department of Labor (DOL), or the Occupational Safety and Health Administration (OSHA).