Journal of Loss Prevention in the Process Industries 26 (2013) 936e940

Contents lists available at SciVerse ScienceDirect

Journal of Loss Prevention in the Process Industries

journal homepage: www.elsevier.com/locate/jlp

HAZOP e Local approach in the Mexican oil & gas industry

M. Pérez-Marín a, M.A. Rodríguez-Toral b, *
a
Instituto Mexicano del Petróleo, Dirección de Seguridad y Medio Ambiente, Eje Central Lázaro Cárdenas Norte No. 152, 07730 México, D.F., Mexico
b
PEMEX, Dirección Corporativa de Operaciones, Gerencia de Análisis de Inversiones, Torre Ejecutiva, Piso 12, Av. Marina Nacional No. 329, 11311 México,
D.F., Mexico

a r t i c l e i n f o a b s t r a c t

Article history: HAZOP (Hazard and Operability) studies began about 40 years ago, when the Process Industry and
Received 3 September 2012 complexity of its operations start to massively grow in different parts of the world. HAZOP has been
Received in revised form successfully applied in Process Systems hazard identification by operators, design engineers and
26 March 2013
consulting firms. Nevertheless, after a few decades since its first applications, HAZOP studies are not truly
Accepted 27 March 2013
standard in worldwide industrial practice. It is common to find differences in its execution and results
format. The aim of this paper is to show that in the Mexican case at National level in the oil and gas
Keywords:
industry, there exist an explicit acceptance risk criteria, thus impacting the risk scenarios prioritizing
HAZOP
Risk acceptance criteria
process. Although HAZOP studies in the Mexican oil & gas industry, based on PEMEX corporate standard
Oil & gas has precise acceptance criteria, it is not a significant difference in HAZOP applied elsewhere, but has the
advantage of being fully transparent in terms of what a local industry is willing to accept as the level of
risk acceptance criteria, also helps to gain an understanding of the degree of HAZOP applications in the
Mexican oil & gas sector. Contrary to this in HAZOP ISO standard, risk acceptance criteria is not specified
and it only mentions that HAZOP can consider scenarios ranking. The paper concludes indicating major
implications of risk ranking in HAZOP, whether before or after safeguards identification.
Ó 2013 Elsevier Ltd. All rights reserved.

1. Introduction transparent in terms of what a local industry is willing to accept as

HAZOP (Hazard and Operability) studies appeared in systematic
way about 40 years ago (Lawley, 1974) where a multidisciplinary
group uses keywords on Process variables to find potential hazards
and operability troubles (Mannan, 2012, pp. 8-31). The basic prin-
ciple is to have a full process description and to ask in each node
what deviations to the design purpose can occur, what causes
produce them, and what consequences can be presented. This is
done systematically by applying the guide words: Not, More than,
Less than, etc. as to generate a list of potential failures in equipment
and process components.
The objective of this paper is to show that in the Mexican case at
National level in the oil and gas industry, there is an explicit
acceptance risk criteria, thus impacting the risk scenarios priori-
tizing process. Although HAZOP methodology in the Mexican oil &
gas industry, based on PEMEX corporate standard has precise
acceptance criteria, it is not a significant difference in HAZOP
studies applied elsewhere, but has the advantage of being fully
* Corresponding author. Tel.: þ52 55 1944 2500x57043.
E-mail addresses: mpmarin@imp.mx (M. Pérez-Marín), miguel.angel.rodriguezt@
pemex.com, matoral09@gmail.com (M.A. Rodríguez-Toral).
the level of risk acceptance criteria, also helps to gain an under-
standing of the degree of HAZOP applications in the Mexican oil &
gas sector. Contrary to this in HAZOP ISO standard (ISO, 2000), risk
acceptance criteria is not specified and it only mentions that HAZOP
can consider scenarios ranking. The paper concludes indicating
major implications of risk prioritizing in HAZOP, whether before or
after safeguards identification.
2. Previous work
HAZOP studies include from original ICI method with required
actions only, to current applications based on computerized
documentation, registering design intentions at nodes, guide
words, causes, deviations, consequences, safeguards, cause fre-
quencies, loss contention impact, risk reduction factors, scenarios
analysis, finding analysis and many combinations among them.
In the open literature there have been reported interesting and
significant studies about HAZOP, like HAZOP and HAZAN differences
(Gujar, 1996) where HAZOP was identified as qualitative hazard
identification technique, while HAZAN was considered for the
quantitative risk determination. This difference is not strictly valid
today, since there are now companies using HAZOP with risk analysis

0950-4230/$ e see front matter Ó 2013 Elsevier Ltd. All rights reserved.
http://dx.doi.org/10.1016/j.jlp.2013.03.008
 M. Pérez-Marín, M.A. Rodríguez-Toral / Journal of Loss Prevention in the Process Industries 26 (2013) 936e940 937

and its acceptance criteria (Goyal & Kugan, 2012). Other approaches Table 2
include HAZOP execution optimization (Khan, 1997); the use of HAZOP recommendations without risk ranking.

intelligent systems to automate HAZOP (Venkatasubramanian, Zhao, Description

& Viswanathan, 2000); the integration of HAZOP with Fault Tree
Analysis (FTA) and with Event Tree Analysis (ETA) (Kuo, Hsu, &
Chang, 1997).
According to CCPS (2001) any qualitative method for hazard
evaluation applied to identify scenarios in terms of their initial
causes, events sequence, consequences and safeguards, can be
extended to register Layer of Protection Analysis (LOPA).
Since HAZOP scenarios report are presented typically in tabular
form there can be added columns considering the frequency in
terms of order of magnitude and the probability of occurrence
identified in LOPA. There should be identified the Independent and
the non-Independent Protection Layers, IPL and non-IPL respec-
tively. Then the Probability of Failure on Demand (PFDs) for IPL and
for non-IPL can be included as well as IPL integrity.
Another approach consists of a combination of HAZOP/LOPA
analysis including risk magnitude to rank risk reduction actions
(Johnson, 2010), a general method is shown, without emphasizing
in any particular application. An extended HAZOP/LOPA analysis for
Safety Integrity Level (SIL) is presented there, showing the quan-
titative benefit of applying risk reduction measures. In this way one
scenario can be compared with tolerable risk criteria besides of
being able to compare each scenario according to its risk value.
A recent review paper has reported variations of HAZOP
methodology for several applications including batch processes,
laboratory operations, mechanical operations and programmable
electronic systems (PES) among others (Dunjó, Fthenakis, Vílchez,
& Arnaldos, 2010).
Wide and important contributions to HAZOP knowledge have
been reported in the open literature that have promoted usage and
knowledge of HAZOP studies. However, even though there is
available the IEC standard on HAZOP studies, IEC-61882:2001 there
is not a worldwide agreement on HAZOP methodology and there-
fore there exist a great variety of approaches for HAZOP studies.
At international level there exist an ample number of ap-
proaches in HAZOP studies; even though the best advanced prac-
tices have been taken by several expert groups around the world,
there is not uniformity among different consulting companies or
industry internal expert groups (Goyal & Kugan, 2012). The
Mexican case is not the exception about this, but in the local oil and
gas industry there exist a national PEMEX corporate standard that
is specific in HAZOP application, it includes ranking risk scenarios
(PEMEX, 2008), qualitative hazard ranking, as well as the two ap-
proaches recognized in HAZOP, Cause by Cause (C  C) and Devia-
tion by Deviation (D  D).
Published work including risk criteria include approaches in
countries from the Americas, Europe and Asia (CCPS, 2009), but
nothing about Mexico has been reported.
3. HAZOP variations
In the technical literature there is no consensus in the HAZOP
studies procedure, from the several differences it is consider that
Recommendation 1
Recommendation 2
Recommendation 3
Recommendation 4
Recommendation 5
the more important are the variations according to: (D  D) or
(C  C). Table 1 shows HAZOP variations, where (CQ  CQ) means
Consequence by Consequence analysis.
The implications of choosing (CC) are that in this approach
there are obtained unique relationships of Consequences, Safeguards
and Recommendations, for each specific Cause of a given Deviation.
For (DD), all Causes, Consequences, Safeguards and Recommenda-
tions are related only to one particular Deviation, thus producing
that not all Causes appear to produce all the Consequences. In
practice HAZOP approach (D  D) can optimize analysis time
development. However, its drawback comes when HAZOP includes
risk ranking since it cannot be determined easily which Cause to
consider in probability assignment. In choosing (C  C) HAZOP
there is no such a problem, although it may take more time on the
analysis. The HAZOP team leader should agree HAZOP approach
with customer and communicate this to the HAZOP team. In our
experience factors to consider when choosing HAZOP approach
are:
1. If HAZOP will be followed by Layers of Protection Analysis
(LOPA) for Safety Integrity Level (SIL) selection, then choose
(C  C).
2. If HAZOP is going to be the only hazard identification study, it is
worth to make it with major detail using (CC).
3. If HAZOP is part of an environmental risk study that requires a
Consequence analysis, then use (D  D).
4. If HAZOP is going to be done with limited time or because
HAZOP team cannot spend too much time in the analysis, then
use (DD). Although this is not desirable since may compro-
mise process safety.
Regarding risk ranking in HAZOP, looking at IEC standard (IEC,
2001) it is found that HAZOP studies there are (D  D) it refers to
(IEC, 1995) in considering deviation ranking in accordance to their
severity or on their relative risk. One advantage of risk ranking is
that presentation of HAZOP results is very convenient, in particular
when informing the management on the recommendations to be
followed first or with higher priority as a function of risk evaluated
by the HAZOP team regarding associated Cause with a given
recommendation. Tables 2 and 3 are shown as illustrative example
of the convenience of event risk ranking under HAZOP, showing no
risk ranking in Table 2 and risk ranking in Table 3.
When HAZOP presents a list of recommendations without
ranking, the management can focus to recommendations with
perhaps the lower resource needs and not necessarily the ones with
higher risk.

Table 1
Main approaches in HAZOP studies. Table 3
HAZOP recommendations with risk ranking.
Source HAZOP approach
(Crowl & Louvar, 2011) (D  D) Scenario risk Description
(ABS, 2004) (C  C) & (D  D) High Recommendation 2
(Hyatt, 2003) (C  C), (D  D) & (CQ  CQ) High Recommendation 5
(IEC, 2001) (D  D) Medium Recommendation 3
(CCPS, 2008); (Crawley, Preston, & (D  D), (CC) Low Recommendation 1
Tyler, 2008) Low Recommendation 4
938 M. Pérez-Marín, M.A. Rodríguez-Toral / Journal of Loss Prevention in the Process Industries 26 (2013) 936e940

Table 6
Risk description (within matrix in Fig. 1) (NOM, 2005).

Risk level Risk qualitative description

A Intolerable: risk must be reduced.
B Undesirable: risk reduction required or a more
rigorous risk estimation.
C Tolerable risk: risk reduction is needed.
D Tolerable risk: risk reduction not needed.
Fig. 1. Risk matrix in (NOM, 2005).

As can be seen in Tables 2 and 3, for the management there will
be more important to know HAZOP results as in Table 3, in order to
take decisions on planning response according to ranking risk.
4. HAZOP standard for the Mexican oil & gas industry
frequency categories, thus giving same flexibility, but with risk
specific for local industry acceptance risk criteria.
One principal consideration in ranking risk is to define if ranking
is done before safeguards definition or after. This definition is
relevant in:

Looking at the worldwide recognized guidelines for hazard
identification (ISO, 2000) there is mentioned that when consid-
ering scenarios qualitative risk assignment, one may use risk matrix
for comparing the importance of risk reduction measures of the
different options, but there is not a specific risk matrix with risk
values to consider.
In Mexico there exist two national standards were tolerable and
intolerable risk is defined, one is the Mexican National Standard
NOM-028 (NOM, 2005) and the other is PEMEX corporate standard
NRF-018 (PEMEX, 2008). In both Mexican standards the matrix
form is considered for relating frequency and consequences. Fig. 1
shows the risk matrix in (NOM, 2005), nomenclature regarding
letters in this matrix is described in Tables 4e6. It can be mentioned
that risk matrix in (NOM, 2005) is optional for risk management in
local chemical process plants.
For Mexican oil & gas industry, there exist a PEMEX corporate
standard (NRF), Fig. 2, shows the corresponding risk matrix
(PEMEX, 2008). Nomenclature regarding letters in this matrix is
described in Tables 7e9 for risk concerning the community. It is
important to mention that PEMEX corporate standard considers
environmental risks, business risks, and corporate image risks.
These are not shown here for space limitations.
The Mexican National Standard (NOM) as being of general
applicability gives the possibility for single entities (like PEMEX) to
determine its own risk criteria as this company opted to do. PEMEX
risk matrix can be converted to NOM’s by category’s grouping in
 HAZOP kick-off presentation by HAZOP leader, explaining im-
plications of risk ranking.
 HAZOP schedule definition. Risk ranking at this point takes
shorter time since time is not consumed in estimating risk
reduction for each safeguard.
If after HAZOP a LOPA is going to be done, then it should be
advisable to request that HAZOP leader considers risk ranking
before safeguards definition, since LOPA has established rules in
defining which safeguards are protections and the given risk
reduction. Otherwise if for time or resource limitations HAZOP is
not going to be followed by LOPA, then HAZOP should consider risk
ranking after safeguards definition. Therefore, the HAZOP leader
should explain to the HAZOP team at the kick-off meeting a concise
explanation of necessary considerations to identify safeguards
having criteria to distinguish them as Independent Protection
Layers (IPL) as well as the risk reduction provided by each IPL. In
HAZOP report there should be make clear all assumptions and
credits given to the Protections identified by the HAZOP team.
Figs. 3 and 4, shows a vision of both kinds of HAZOP reports: For the
case of risk ranking before and after safeguards definition. In Figs. 3

Table 4
Consequences description (X-axis of matrix in Fig. 1) (NOM, 2005).

Consequences Consequence quantitative criteria

C4 One or more fatalities (on site).
Injuries or fatalities in the community (off-site). Fig. 2. Risk matrix as in (PEMEX, 2008).
C3 Permanent damage in a specific Process or construction area.
Several disability accidents or hospitalization.
Table 7
C2 One disability accident.
Probability description (Y-axis of matrix in Fig. 2) (PEMEX, 2008).
Multiple injuries.
C1 One injured. Frequency Occurrence criteria
Emergency response without injuries.
Category Type Quantitative Qualitative
High F4 >101 >1 in 10 years Event can be presented
within the next 10 years.
Table 5 Medium F3 101  102 1 in 10 yearse1 It can occur at least once in
Probability description (Y-axis of matrix in Fig. 1) (NOM, 2005). in 100 years facility lifetime.
Low F2 102  103 1 in 100 yearse1 Possible, it has never occurred
Frequency Frequency quantitative criteria in 1000 years in the facility, but probably it
L4 1in 10 years has occurred in a similar
L3 1 in 100 years facility.
L2 1 in 1000 years Remote F1 <103 <1 in 1000 years Virtually impossible. It is no
L1 <1 in 1000 years realistic its occurrence.
 M. Pérez-Marín, M.A. Rodríguez-Toral / Journal of Loss Prevention in the Process Industries 26 (2013) 936e940 939

Table 8
Consequences description (X-axis of matrix in Fig. 2) (PEMEX, 2008).

Event type and consequence category

Effect: Minor C1 Moderate C2 Serious C3 Catastrophic C4

To people
Neighbors Health No impact on public Neighborhood alert; potential Evacuation; Minor injuries or moderate Evacuation; injured people; one or
and Safety. health and safety. impact to public health and safety. consequence on public health and safety; more fatalities; sever consequence
side-effects cost between 5 and 10 million on public health and safety; injuries
MX$ (0.38e0.76 million US$). and side-consequence cost over 10
million MX$ (0.76 million US$).
Health and Safety No injuries; first aid. Medical treatment; Minor injuries Hospitalization; multiple injured people; One o more fatalities; Severe injuries
of employees, service without disability to work; total or partial disability; moderate health with irreversible damages; permanent
providers/contractors. reversible health treatment. treatment. total or partial incapacity.

Table 9
Risk description (within matrix in Fig. 2) (PEMEX, 2008).

Risk level Risk description Risk qualitative description

A Intolerable
B Undesirable
C Acceptable
with control
D Reasonably
acceptable
Risk requires immediate action; cost should not be a limitation and doing nothing is not an acceptable option. Risk with level “A”
represents an emergency situation and there should be implements with immediate temporary controls. Risk mitigation should be
done by engineered controls and/or human factors until Risk is reduced to type “C” or preferably to type “D” in less than 90 days.
Risk should be reduced and there should be additional investigation. However, corrective actions should be taken within the next
90 days. If solution takes longer there should be installed on-site immediate temporary controls for risk reduction.
Significant risk, but can be compensated with corrective actions during programmed facilities shutdown, to avoid interruption of
work plans and extra-costs. Solutions measures to solve risk findings should be done within 18 months. Mitigation actions should
focus operations discipline and protection systems reliability.
Risk requires control, but it is of low impact and its attention can be carried out along with other operations improvements.

and 4 “F” means frequency, C means consequence and R is risk as a
function of “F” and “C”.
One disadvantage of risk ranking before safeguards definition is
that resulting risks usually are found to be High, Intolerable or
Unacceptable. This makes difficult the decision to be made by the
management on what recommendations should be carried out first
and which can wait.
One advantage in risk ranking after safeguards definition is that
it allows to show the management the risk scenario fully classified,
without any tendency for identifying most risk as High (Intolerable
or Unacceptable). In this way, the management will have a good
description on which scenario need prompt attention and thus take
risk to tolerable levels.
There is commercial software for HAZOP methodology, but it
normally requires the user to use his/her risk matrix, since risk
matrix definition represents an extensive knowledge, resources
and consensus to be recognized.
The Mexican case is worldwide unique in HAZOP methodology,
since it uses an agreed and recognized risk matrix and risk priori-
tizing criteria according to local culture and risk understanding for
the oil & gas sector. The risk matrix with corresponding risk levels
took into account political, economical and ethic values.
Advantages in using risk matrix in HAZOP are: they are easy to
understand and to apply; once they are established and recognized
they are of low cost; they allow risk ranking, thus helping risk
reduction requirements and limitations. However, some disad-
vantages in risk matrix use are: it may sometimes be difficult to
separate frequency categories, for instance it may not be easy to
separate low from remote in Table 7. The risk matrix subdivision
may have important uncertainties, because there are qualitative
considerations in its definition. Thus, it may be advantageous to
update Pemex corporate HAZOP standard (PEMEX, 2008) to
consider a 6  6 matrix instead of the current 4  4 matrix.
5. Conclusions
HAZOP studies are not a simple procedure application that as-
sures safe Process systems on its own. It is part of a global design
cycle. Thus, it is necessary to establish beforehand the HAZOP study
scope that should include at least: methodology, type (C  C, D  D,
etc.) report format, acceptance risk criteria and expected results.
Mexico belongs to the reduced number of places where accep-
tance risk criteria has been explicitly defined for HAZOP studies at
national level.

References

Fig. 3. Risk ranking before safeguard definition.
Fig. 4. Risk ranking after safeguards definition.
ABS. (2004). Process safety institute. Course 103 “Process hazard analysis leader
training, using the HAZOP and what-if/checklist techniques”. Houston TX: Amer-
ican Bureau of Shipping.
CCPS (Center for Chemical Process Safety). (2001). Layer of protection analysis:
Simplified process risk assessment. New York, USA: AIChE.
CCPS (Center for Chemical Process Safety). (2008). Guidelines for hazard evaluation
procedures (3rd ed.). New York, USA: AIChE/John Wiley & Sons.
CCPS (Center for Chemical Process Safety). (2009). Guidelines for Developing Quan-
titative Safety Risk Criteria, Appendix B. Survey of worldwide risk criteria appli-
cations. New York, USA: AIChE.
Crawley, F., Preston, M., & Tyler, B. (2008). HAZOP: Guide to best practice (2nd ed.).
UK: Institution of Chemical Engineers.
Crowl, D. A., & Louvar, J. F. (2011). Chemical process safety, fundamentals with ap-
plications (3rd ed.). New Jersey, USA: Prentice Hall.
940 M. Pérez-Marín, M.A. Rodríguez-Toral / Journal of Loss Prevention in the Process Industries 26 (2013) 936e940
Dunjó, J., Fthenakis, V., Vílchez, J. A., & Arnaldos, J. (2010). Hazard and opera-
bility (HAZOP) analysis. A literature review. Journal of Hazardous Materials,
173, 19e32.
Goyal, R. K., & Kugan, S. (2012). Hazard and operability studies (HAZOP) e best
practices adopted by BAPCO (Barahin Petroleum Company). In Presented at SPE
middle east health, safety, security and environment conference and exhibition. Abu
Dhabi, UAE. 2 e 4 April.
Gujar, A. M. (1996). Myths of HAZOP and HAZAN. Journal of Loss Prevention in the
Process Industry, 9(6), 357e361.
Hyatt, N. (2003). Guidelines for process hazards analysis, hazards identification and
risk analysis (pp. 6-7e6-9). Ontario, Canada: CRC Press.
IEC. (1995). IEC 60300-3-9:1995. Risk management. Guide to risk analysis of techno-
logical systems. Dependability management e Part 3: Application guide e Section
9: Risk analysis of technological systems. Geneva: International Electrotechnical
Commission.
IEC. (2001). IEC 61882.Hazard and operability studies (HAZOP studies) e Application
guide. Geneva: International Electrotechnical Commission.
ISO. (2000). ISO 17776.Guidelines on tools and techniques for hazard identification and
risk assessment. Geneva: International Organization for Standardization.
Johnson, R. W. (2010). Beyond-compliance uses of HAZOP/LOPA studies. Journal of
Loss Prevention in the Process Industries, 23(6), 727e733.
Khan, F. I. (1997). OptHAZOP-effective and optimum approach for HAZOP study.
Journal of Loss Prevention in the Process Industry, 10(3), 191e204.
Kuo, D. H., Hsu, D. S., & Chang, C. T. (1997). A prototype for integrating automatic
fault tree/event tree/HAZOP analysis. Computers & Chemical Engineering, 21(9e
10), S923eS928.
Lawley, H. G. (1974). Operability studies and hazard analysis. Chemical Engineering
Progress, 70(4), 45e56.
Mannan, S. (2012). Lee’s loss prevention in the process industries. Hazard identifica-
tion, assessment and control, Vol. 1, 3rd ed., Elsevier, (pp. 8e31) .
NOM. (2005). NOM-028-STPS-2004. Mexican National standard: “Norma Oficial
Mexicana”. In Organización del trabajo-Seguridad en los procesos de sustancias
químicas: (in Spanish), published in January 2005.
PEMEX. (2008). Corporate Standard: “Norma de Referencia NRF-018-PEMEX-2007
“Estudios de Riesgo” (in Spanish), published in January 2008.
Venkatasubramanian, V., Zhao, J., & Viswanathan, S. (2000). Intelligent systems for
HAZOP analysis of complex process plants. Computers & Chemical Engineering,
24(9e10), 2291e2302.