Knowledge / Risk and reliability

HAZOP studies: from deviation to traceable action

How to turn HAZOP deviations into traceable decisions, with a cooling-loop example, safeguard checks and action-closure evidence.

On this page

A HAZOP is useful when it makes the difference between intended behaviour and possible behaviour explicit. Its most valuable output is a defensible chain from a credible deviation to a decision, an owner and evidence that the decision was implemented. A long worksheet without that chain is only a record of discussion. This article develops an original, hypothetical shipboard cooling example to explain the method. It is an educational guide. It does not approve a system or replace vessel-specific engineering and statutory review.

Begin with a question that the study can answer

HAZOP means hazard and operability study. The public description of IEC 61882:2016 identifies a guide-word-based examination and a lifecycle extending from definition and preparation through documentation and follow-up. Only that public scope description was consulted here, not the paid standard. The method asks how an intended function can deviate, what could cause that deviation, and what follows. It can reveal loss of production as well as danger, but those consequences should remain distinguishable.

For a cooling circuit, “is the plant safe?” is too broad to guide a productive meeting. A better study question is whether the defined consumers receive cooling within their required operating envelope during the named operating modes. This exposes the boundary: the study includes circulation, temperature control and relevant utilities, but it may refer structural qualification or electrical discrimination to separate analyses. Exclusions need an owner and an interface reference so that they do not become omissions.

Write the design intent before selecting guide words

A node is a manageable part of the system with a coherent purpose. Its design intent should state what enters, what leaves, the operating mode, relevant parameters and the successful outcome. A drawing boundary alone is insufficient. For the hypothetical node, assume a freshwater loop is intended to remove up to 420 kW from one consumer while maintaining the approved inlet condition. The study must identify where the cooling requirement comes from; the invented value is only for this example.

The node boundary should include enough of the physical chain to explain deviations without repeatedly losing the cause upstream. If every valve becomes a separate node, discussion fragments. If an entire engine room becomes one node, important states disappear. Mark supply and return interfaces, controls, available indications and support services. Distinguish the installed arrangement from a future proposal. A proposal cannot be credited as an existing safeguard merely because someone intends to buy it.

Assemble information and people around the real task

The facilitator needs current diagrams, the operating philosophy, equipment limitations, control descriptions and a list of unresolved assumptions. Operations, maintenance and design perspectives are different sources of knowledge, not interchangeable job titles. Someone who knows how a system is actually restored after maintenance may reveal an alignment that the nominal drawing does not show. Someone who understands control logic may reveal that an apparently separate alarm shares the same failed measurement.

Document uncertainty without forcing instant consensus. “Return-line location to be confirmed against the installed arrangement” is a useful action. “Probably adequate” is not evidence. The recorder should preserve the causal reasoning while the team can still correct it. Record the revision of each drawing and the date of the study. Otherwise a later design change can make the worksheet impossible to reconcile with the equipment now aboard the ship.

Combine a parameter and guide word into a meaningful deviation

Prompts such as no, more, less, reverse, other than and out of sequence help challenge the intended state. They are not a requirement to invent every possible combination. For flow, no flow and reverse flow are meaningful. For a timed operation, early, late or omitted may be more useful. The team should explain why an apparently relevant combination was screened out rather than leave a blank that could equally mean “not discussed.”

“Low pressure” is not automatically the same scenario as “low flow.” A blocked path and a loss of driving head may produce different pressure patterns and different consequences. Define the measurement location and physical meaning. In the example, low flow through the consumer can occur while a header pressure indication appears normal. This is exactly the kind of assumption a structured discussion should expose before a safeguard is assigned to the wrong variable.

Keep cause, deviation, consequence and safeguard separate

Consider one worksheet entry: reduced cooling flow, caused by a partly obstructed strainer, can reduce heat removal and eventually challenge the consumer’s temperature limit. A differential-pressure indication across the strainer might support diagnosis; a high-temperature alarm might warn of the consequence. Neither statement proves timely protection. The record must say who receives the warning, what approved response is expected and whether enough time exists for that response.

Now consider reduced flow from loss of electrical supply. It is a separate cause even if the final temperature rise looks similar. If the alarm and standby pump share that supply, safeguards credited in the strainer scenario may not survive this one. Combining all causes into a single “pump problem” row conceals this dependency. Separate rows are warranted when causes change the consequences, safeguard availability or actions needed to resolve the issue.

Use a calculation to test the narrative

Assume steady heat transfer with a water-like fluid of specific heat 4.2 kJ/(kg·K). At 10 kg/s, removing 420 kW requires a fluid temperature rise of 420/(10 × 4.2) = 10 K. At 5 kg/s, the same heat duty would require 20 K. These are original teaching calculations, not measured performance. They show why halving flow cannot be dismissed merely because the pump remains running and some circulation continues.

This balance does not predict metal temperature, transient time to damage or control response. It assumes the duty remains constant and ignores thermal storage, heat-transfer coefficients and changing consumer load. The correct HAZOP action might therefore be to obtain a validated transient assessment rather than to choose an alarm set point in the meeting. A simple calculation is valuable when it identifies the missing engineering question; it becomes misleading when presented as the answer to a more complex one.

Evaluate safeguards as claims requiring evidence

An installed item is not automatically an effective safeguard. Ask what it detects or prevents, in which modes it works, what support services it needs and how its function is demonstrated. An alarm can be useful without qualifying as an independent protection layer. HAZOP should capture the safeguard claim and its limitations; a later LOPA or functional-safety assessment may examine the required reliability in more detail.

HSE’s control and instrumentation assessment guidance links hazard analysis to safety-function allocation, specifications and verification evidence. That document concerns the UK major-hazard framework, not automatic requirements for every ship. The transferable analytical lesson is traceability: if protection is claimed, identify the supporting functional requirement and evidence. Avoid declaring a particular safety integrity level solely because the HAZOP worksheet has a high-severity colour.

Examine operating transitions and temporary states

A normal-running study can miss the moment when a standby pump is unavailable, a bypass is open or a strainer has been restored incorrectly. Revisit the node for start-up, shutdown, maintenance restoration and degraded operation when those states change the causal chain. Record which states are credible within approved operation and which require separate authorization. The purpose is to reveal dependencies, not to invent an unsafe field experiment to test them.

Procedural steps can be examined in the same spirit. What if verification is omitted, a communication arrives late or an operation is performed before another prerequisite? HSE’s operating-procedure guidance provides official background on connecting procedures with hazard assessment. For the cooling example, the study output might require a controlled restoration check linked to equipment identification and a functional demonstration. Writing “crew to take care” does not define such a control.

Convert recommendations into closeable actions

A useful action identifies the issue, the required outcome, the responsible function, the evidence to be returned and the decision authority. For example: “Confirm whether the low-flow scenario can exceed the consumer limit before the approved response is completed; provide the thermal-response basis and update the protection requirements if necessary.” This is more testable than “review cooling.” A due date should reflect the decision that depends on closure, such as design freeze or commissioning.

Closing the action requires review of the answer, not merely receipt of a document. A revised drawing may demonstrate that a sensor was added but not that its range, response and independence meet the claimed function. If an action is rejected, record the technical reason and the person authorized to accept the resulting position. Keep proposed, implemented and verified states separate. That distinction makes the study useful months after the workshop participants have moved to other work.

Know what HAZOP cannot establish alone

Guide words encourage systematic exploration, but no workshop proves that every hazard has been found. External events, structural response, common software defects and complex human interactions may need other techniques. The quality of the result depends on scope, information, expertise and the discipline of the causal discussion. A risk matrix can help organize follow-up, but its ordinal categories should not be treated as measured probabilities or multiplied into a scientifically precise ranking.

The final package should contain the study basis, marked node boundaries, worksheet, assumptions register, action log and closure evidence. A reviewer should be able to reconstruct why each material decision was made and what would trigger reconsideration. For the hypothetical cooling loop, a change in heat duty, utility supply, alarm logic or maintenance alignment is a reason to revisit affected rows. The durable output is this traceable reasoning, rather than the number of pages or deviations produced.

Sources