Knowledge / Risk analysis methods

HAZOP during mode changes: startup, shutdown and temporary alignments

Examine the intermediate states, timing assumptions and restart conditions that can be missed when a HAZOP studies only steady operation.

On this page

A system can be acceptable in two steady modes while the path between them creates an unresolved hazard. During a changeover, some functions may be available before others, inventory may move faster than a signal updates, and the operator may have an incomplete view of the actual state. A transition HAZOP makes those intermediate conditions explicit. Its subject is the changing design intent and the evidence required to move between states, rather than a list of normal valve positions alone.

Describe the transition as a sequence of states

IEC61882’s public description identifies guide-word examination, preparation, documentation and follow-up as parts of HAZOP. For a transition study, apply that structured questioning to a state description with a beginning, intermediate conditions and an end. The state sequence developed here is an analytical aid, not a reproduction of a prescribed sequence for any installed system.

For a generic cooling-service changeover, the initial state might be one train carrying the required duty, an intermediate state might have the second train available but not yet demonstrated under load, and the final state might have the new train carrying the duty with the first in its defined reserve condition. These are functional descriptions. They intentionally do not prescribe a valve or electrical switching procedure.

Write time-dependent intent, not only a final target

HSE’s operating-procedures guidance emphasizes that linked startup and shutdown operations need ordered, phased treatment. A transition’s design intent should therefore say what must remain true while the final condition is being reached. Examples include maintaining a required service, avoiding incompatible connections and retaining a valid route for changing inventory. A final stable state cannot demonstrate that these conditions held throughout the transition.

Attach the relevant process constraint and evidence to each interval. If a function may be briefly unavailable, the permitted duration must come from an established system basis rather than an assumed operator reaction time. If continuity is required, define how continuity is demonstrated. Avoid a vague phrase such as change over safely when the unresolved question is exactly which intermediate combination would violate the intended function.

Apply deviations to order, duration and completeness

Useful questions include: what if the next stage occurs before its prerequisite, what if a transition takes longer than intended, what if an action is omitted, and what if only part of a multi-component change occurs? These are distinct deviations. A delayed indication, a physically slow device and an omitted command can produce similar displays but require different causal explanations.

Record the event chain in cause–deviation–consequence order. For example, loss of the confirming measurement can leave the true service state unknown; proceeding on a stale value can then remove the currently available function before the replacement is established. The measurement loss is the cause, uncertain or premature transfer is the deviation, and interrupted service is the consequence. Naming only operator error would hide the information and system conditions that make the action possible.

Use a thermal inventory example to test the time assumption

Consider an invented well-mixed liquid inventory of 100 kg with constant specific heat 4.00 kJ/(kg·K). Assume a 20.0 kW heat input continues while heat removal is absent for 45.0 s, with no flow, phase change, wall heat capacity or external loss. The temperature rise is ΔT = Qt/(mcp) = 20.0 ×45.0/(100 ×4.00) = 2.25 K. This is a transparent inventory calculation, not an acceptable interruption interval.

If only 20.0 kg were effectively participating under the same assumptions, the rise would be 11.25 K. The difference shows why the active inventory matters. A nominal tank capacity cannot be substituted for the material actually exchanging heat in the threatened region. Local hot spots, stratification and equipment surfaces can invalidate the well-mixed model; real limits and protection response require the appropriate dynamic assessment.

Distinguish command, movement and proven function

A command being issued, a device reaching its indicated position and the required process function being available are three different milestones. The study should identify what each signal establishes. A position indication may not prove flow; a running indication may not prove useful output; and a measured output may represent an earlier sampling interval rather than the present transition state.

For an illustrative evidence-timing record, assume device movement takes 6 s, a process measurement becomes representative 8 s after that movement ends, and communication adds 2 s. If these stages are strictly sequential, the observation becomes available 16 s after the initial command. If the actual mechanisms overlap, simply adding them would overstate delay. State the causal timing model before using its result to judge a transition.

A common time axis places device movement at 0–6 seconds, representative measurement at 6–14 and communication at 14–16. Under the invented strictly sequential model the evidence is available 16 seconds after the command, not at the command or the end of movement.
Original time-aligned stage bars at 18 drawing units per second. The 8 s measurement stage begins only after 6 s movement is complete;2 s communication follows. Numbers are hypothetical and the sequence is stipulated, not a generic device response specification. The chart concerns when the assumed representative observation is available; it does not prove the underlying service works or authorize transition. Overlapping stages require a different causal timing model.

Study interruption and resumption as separate modes

A paused startup or interrupted shutdown does not necessarily return the system to its original condition. Pressure, temperature, trapped material, controller memory and isolation state may have changed. Resuming from the next written step can therefore be a different operation from starting the procedure with its initial prerequisites satisfied. The HAZOP should make that difference visible.

Specify the information needed to determine the current state after an interruption. A last-completed-step marker is useful but cannot replace physical-state evidence when the process has continued evolving. Also examine who may decide to resume, what assumptions must be re-established and which unavailable indication prevents that decision. These are requirements for the approved procedure, not an invitation to improvise a restart sequence during an abnormal event.

Include temporary alignments and concurrent work

HSE’s plant-change guidance treats temporary operating instructions and changes as controlled matters. A temporary configuration can alter the meaning of a familiar control or indication, remove a normal path, or change the available support services. Its duration alone does not determine its significance. A short-lived change can coincide with the most demanding transition state.

Consider concurrent maintenance, testing, utility changes and another system’s changeover when they can affect the same boundary. Two activities that are individually acceptable may share a single remaining service or need the same operator at the same moment. Record the dependency explicitly. Separate action owners do not make the physical functions independent.

Use incident evidence without copying its plant assumptions

The CSB’s final Texas City investigation discusses startup procedures that had not kept pace with actual equipment and operating changes, including interrupted startup circumstances. Its lesson for this analytical method is the need to examine real transition practice and the information supporting it. The refinery’s hardware, operating limits and event frequency are not transferred to maritime equipment.

Ask whether previous difficult transitions, temporary workarounds or repeated alarms reveal a mismatch between the documented state sequence and actual operation. An experienced crew may have developed adaptations that expose a design or procedure gap. Recording those conditions supports a better system explanation; treating every deviation as an isolated individual lapse can leave the recurring mechanism untouched.

Close the transition question with evidence

A useful action defines the unresolved transition state, the threatened function and the evidence required to resolve it. Depending on the issue, that evidence may be an updated state model, an approved sequence, demonstrated timing, a revised indication or a verified support-system dependency. The closure criterion should explain how the identified consequence is controlled, not merely say that a document has been issued.

Common omissions are studying only the endpoints, assuming all devices move together, treating a command as completed function, and allowing a paused sequence to resume without re-establishing its prerequisites. A complete transition record retains the normal path, the interrupted path, temporary configurations and the assumptions used in timing examples. It makes the question of proceeding depend on a defined state and evidence rather than on elapsed time alone.

Sources