What is HAZOP?
HAZOP (Hazard and Operability Study) is a structured, qualitative hazard analysis in which a multidisciplinary team works through a process design section by section and uses fixed guide words such as no, more and less to identify which deviations from the design intent can occur, what their causes and consequences are, and whether the existing safeguards are adequate. The method uncovers both hazards to people and the environment and operability problems that lead to lost production. HAZOP is applied during the design, modification and periodic revalidation of installations in chemicals, oil and gas, pharmaceuticals, food, energy and the water sector, among others.
🕰️ Where does HAZOP come from?
HAZOP originated in 1963 at the British chemical company ICI. A team of three engineers spent several months studying the design of a new phenol plant. They started with critical examination, a technique that asked for alternatives, and switched to asking which deviations from the design could occur. Within ICI the approach was first called operability studies.
| Year | Milestone |
|---|---|
| 1963 | First application at ICI on a phenol plant |
| 1974 | First open publication by H.G. Lawley; in the same year the Flixborough disaster, after which IChemE’s courses were fully booked |
| 1977 | The UK Chemical Industries Association publishes a HAZOP guide |
| 1983 | Trevor Kletz, ICI’s safety adviser from 1968 to 1982, uses the term “HAZOP” in a formal publication |
| 1992 | The US OSHA Process Safety Management standard names HAZOP as an accepted method for process hazard analysis |
| 2001 | IEC 61882, first edition: international application guide for HAZOP studies |
| 2016 | IEC 61882 edition 2.0, aligned with the terminology of ISO 31000; adopted in Europe as EN 61882:2016 |
🔍 How does a HAZOP work?
The team divides the installation into nodes: manageable sections such as a line between two vessels, a pump with its suction and discharge, or a reactor. The main working document is the P&ID, supplemented by process descriptions, material data and the control philosophy. For each node the team first records the design intent, for example “10 m³/h of water at 4 bar and 20 °C to tank T2”. It then systematically combines every relevant process parameter with every guide word.
IEC 61882 gives the following basic set of guide words:
| Guide word | Meaning | Example with parameter |
|---|---|---|
| No / Not | None of the design intent is achieved | No flow in the cooling water line |
| More | Quantitative increase | Higher pressure in reactor R1 |
| Less | Quantitative decrease | Lower temperature in the heat exchanger |
| As well as | Something additional alongside the intent | Water carried along with the solvent stream |
| Part of | Only part of the intent is achieved | Wrong mixing ratio, one component missing |
| Reverse | The logical opposite | Backflow into the feed tank |
| Other than | Complete substitution or unusual condition | Wrong substance in the line, or start-up instead of normal operation |
| Early / Late, Before / After | Deviations in timing or sequence | Valve opens before the pump is running |
The timing and sequence words matter most for batch processes and procedures. Typical parameters are flow, pressure, temperature, level, composition and time, but also start-up and shutdown, draining, maintenance and the loss of utilities such as instrument air or cooling water.
👥 Who sits on a HAZOP team?
A HAZOP is not a job for a single specialist. Its strength lies in combining design knowledge with hands-on experience:
- Chair or facilitator - independent and experienced in the method; guards scope, pace and depth
- Scribe - records deviations, causes, consequences, safeguards and actions in real time, often in dedicated HAZOP software
- Process engineer - knows the design intent and process conditions
- Operator or shift supervisor - knows how the plant is actually run
- Instrumentation and control specialist - knows the control loops, the DCS, interlocks and the SIS
- Maintenance and other specialists as needed - for example materials, ATEX or environmental experts
In practice the core team consists of five to seven participants plus the chair and scribe. A HAZOP is mentally demanding work, so teams usually hold sessions of four to six hours a day with regular breaks. For a medium-sized chemical plant, dozens of sessions are not unusual.
🧠 How do you carry out a HAZOP step by step?
- Define scope and objective - which installation, which operating modes, which risk matrix and which acceptance criteria
- Collect and freeze documentation - current P&IDs, process description, safety data sheets, cause-and-effect matrices and earlier studies
- Divide into nodes - mark them on the P&IDs; nodes that are too large become unmanageable, nodes that are too small lead to repetition
- Work through parameters and guide words - for each credible deviation record the cause, the consequence without safeguards, the existing safeguards and the risk class
- Formulate recommendations - specific, with an owner and a deadline
- Report and follow up - close actions demonstrably and process changes through MOC
- Revalidate periodically - after major changes and, under many regimes, every five years
A simplified example of a HAZOP worksheet:
| Node | Guide word + parameter | Cause | Consequence | Existing safeguard | Recommendation |
|---|---|---|---|---|---|
| Reactor R1 | More + pressure | Outlet valve stuck closed | Overpressure, possible vessel rupture | Pressure alarm, relief valve | Assess a high-pressure trip via the SIS in LOPA |
| Cooling water pump P101 | No + flow | Pump failure or blocked line | Insufficient cooling, temperature excursion in R1 | Temperature alarm | Add flow measurement with alarm; rationalise via alarm management |
| Feed line to T2 | Reverse + flow | Pump trips while T2 is at higher pressure | Backflow, contamination of feed tank | None | Install a non-return valve |
🔄 How does HAZOP relate to LOPA, FMEA and bow-tie?
HAZOP identifies scenarios; other methods quantify, deepen or visualise them. HAZOP does not set a SIL itself: it delivers the scenarios for which a follow-up study such as LOPA or a risk graph determines the required risk reduction and SIL.
| Method | Character | Purpose | Typical moment |
|---|---|---|---|
| HAZOP | Qualitative, team-based | Find deviations, causes and consequences per node | Detailed design, modification, revalidation |
| LOPA | Semi-quantitative | Test whether independent protection layers suffice; SIL allocation | Directly after the HAZOP |
| FMEA | Qualitative to semi-quantitative | Failure modes of components and their effects | Design of equipment and instruments |
| BOW-TIE | Visual | Show causes, barriers and consequences around one top event | Communication and barrier management |
| What-if / checklist | Qualitative, less structured | Quick exploration of simple installations | Early design, minor changes |
Within functional safety, HAZOP is the most widely used method for the hazard and risk assessment required by clause 8 of IEC 61511 and phase 3 of the IEC 61508 lifecycle. IEC 31010, the catalogue of risk assessment techniques that accompanies ISO 31000, also describes HAZOP as a method.
🏛️ Is HAZOP mandatory in the Netherlands and the EU?
No Dutch or European law prescribes HAZOP by name. Seveso establishments, which until 2024 fell under the Dutch Brzo 2015 and now under the Environment and Planning Act (Omgevingswet), must however demonstrate that they have systematically identified and controlled major-accident hazards, including in a major-accident prevention policy and, for upper-tier establishments, a safety report; see Seveso and Cybersecurity. HAZOP is a widely used method for this that inspectors recognise. Because regulators regard IEC 61511 as the state of the art for instrumented safeguards, and that standard requires a hazard analysis, a HAZOP is practically unavoidable for process plants with an SIS. In the United States, the OSHA Process Safety Management rule names HAZOP explicitly and requires the process hazard analysis to be revalidated at least every five years.
🔐 What does HAZOP mean for OT security?
A classic HAZOP assumes random failures and human error. An attacker, however, can trigger several causes at once and disable a protection layer; TRITON targeted exactly such a Safety controller in 2017. Variants have therefore emerged:
- CHAZOP - a HAZOP of the control system itself: what if a controller, network or operator station fails or provides wrong values
- Security PHA Review (SPR) and related cyber PHA methods - re-examine existing HAZOP scenarios to ask whether an attack could create the cause or defeat a safeguard; the outcome is either a non-hackable safeguard, such as a mechanical relief valve, or a security level from IEC 62443
- Link with IEC 62443-3-2 - HAZOP consequences help define zones and target levels in a cyber risk assessment under IEC 62443-3-2
Since the 2016 edition, IEC 61511 clause 8.2.4 also requires a security risk assessment of the SIS. Cyber-Informed Engineering also uses HAZOP scenarios as a starting point to engineer out unacceptable consequences at the design stage.
❓ Frequently asked questions
What is the difference between HAZOP and HAZID?
A HAZID (hazard identification) is a broad, early exploration of hazards at plant or site level, often in the concept phase. A HAZOP goes much deeper and works through the detailed design node by node using guide words. A HAZID therefore usually comes before the HAZOP.
How long does a HAZOP take?
The duration of a HAZOP depends on the size and complexity of the installation. A small modification can be reviewed in one or two days, while a new chemical plant may need dozens of session days. As a rule of thumb, a team covers a few nodes per session day for continuous processes.
Which standard describes the HAZOP method?
The HAZOP method is described in IEC 61882, the international application guide for HAZOP studies. The current edition 2.0 dates from 2016 and has been adopted in Europe as EN 61882:2016. The standard covers guide words, team composition, sessions, documentation and follow-up.
Can a HAZOP be used outside the process industry?
Yes, HAZOP is also applied to batch procedures, control software, electrical systems and even medical and logistics processes. The guide words are then adapted to the system, for example for signals or steps in a procedure. For machinery safety, other methods under ISO 12100 are usually used.
How often should a HAZOP be repeated?
A HAZOP is repeated or supplemented whenever an installation changes significantly, through the management of change process. Many companies also apply a periodic revalidation, often every five years, in line with the review cycle of the safety report and with the US OSHA requirement.
What does a HAZOP actually deliver?
A HAZOP delivers a worksheet with all credible deviations, their causes, consequences and existing safeguards, plus an action list of recommendations. That report is the basis for LOPA, SIL determination, alarm rationalisation and the safety report. It remains a reference document throughout the life of the installation.
📌 In summary
HAZOP is the standard method for using a multidisciplinary team and fixed guide words to systematically work out what can go wrong in a process installation, before it goes wrong. Its results feed LOPA, SIS design under IEC 61511, Compliance with Seveso requirements and, increasingly, OT security analysis, so that process safety and cybersecurity rest on the same scenarios.