The role of hazard and operability study in

risk analysis of major hazard plant

A. R. Qureshi
Snamprogetti Ltd., Snamprogetti House, Basing View, Basingstoke,
Hampshire RG 21 277, UK

Under the CIMAH Regulations and the Seveso Directive the operators of major hazard plant and
storage are required to prepare a safety case. The essential elements of a safety case are: the safety
policy, description of hazards arising from the activity, account of controls to minimize the effects of
these hazards, consequences should these controls fail, on/off site emergency plans etc. The
proven method of hazard identification, called the Hazard and Operability Study, is used extensively
to enhance the safety of plant during design and for existing plant. The study gives a better value
for money in tne art of hazard identification than the checklist approach and may be used for (a)
future modifications; and lb) as a support document for ‘Safety Case’ preparation for identification
of top events and for constructing fault/event trees for further frequency analysis. This paper
highlights how the technique has been used in Snamprogetti Ltd at the design and operational
stages of the plant.
(Keywords: hazard and operability study; safety case; risk analysis)

During the past decade, due to a number of major
accidents around the world and their consequences,
public awareness of the risks posed by major hazard
installations has led to the enactment of the CIMAH
(Control of Industrial Major Accident Hazards)
Regulations, 1984 in the UK and the Seveso Directive
(1982) in the EEC, and increasing involvement of
regulatory authorities in siting and operation of such
plants. Past accidents have shown that industrial
activities involving certain dangerous substances have
the potential to cause serious injury or death beyond the
immediate vicinity of such a plant. The CIMAH regul-
ations and the Health and Safety at Work etc. Act
(HASWA), 1974 place an onus on operators and
designers of such plant to ensure that the employees and
the public at large are not exposed
to an unacceptable degree of risk. This duty requires
that the hazards are identified, and where necessary
quantified. The major hazard plants are defined in the
CIMAH Regulations. Hazard may be defined as a
physical situation with a potential for harm to life, limb,
property or the environment. Risk is defined as the
probability of the realization of the potential of a
hazard and its consequences.
In the UK and to varying extents in EEC countries
three basic elements of control are applied:
0 Identification (Notification of Installations Handling
Hazardous Substances (NIHSS) Regulations, 1982)
Received 2 November 1987
OS?04230/68~020104-06S3.00
0 1988 Butterworth & Co. (Publishers) Ltd
104 J. Loss Prev. Process lnd., 1988, Vol I, A p r i l
l Location (control over siting of major hazard plant);
and
l Assessment (CIMAH Regulations requiring prepara-
tion of a Safety Case and on/off-site emergency
plans).
The requirements of the CIMAH Regulations can be
considered as being at two levels (Figure I ). The general
or low-level requirements apply widely and require the
operator of the industrial activity to take the necessary
precautions to prevent major accidents, to report those
that do arise and to take steps to limit their conse-
quences. The specific or upper level requirements apply
only to potentially more hazardous activities. These
requirements are stringent and require the operator to
carry out a safety assessment of the site and submit a
‘Safety Case’ to the Health and Safety Executive (HSE).
The objectives’ of the Safety Case are:
to identify the nature and scale of the dangerous
substances;
to give an account of the arrangements for safe
operation of the installation, for control of serious
deviations that could lead to a major accident and
for emergency procedures at the site;
to identify the type, relative likelihood and conse-
quences of major accidents that might occur; and
to demonstrate that the manufacturer (operator) has
identified the major hazard potential of his activities
and has provided appropriate controls.
Although the regulatory and stringent development
 Role of hazop in the risk analysis of major hazard plant: R. Qureshi
Is my installation
START HERE excluded (Reg 3) ?
NO ACTION
Does the dangerous
substance come
within the criteria
I I
Is the quantity large
enough to render the
operation capable of
presenting major
accident hazards ?
the threshold in Schedule 3,
column 2 ?
-4
ACTIONS
Reg 7 Reg 8
Provide notification Provide information
to HSE (if activity to HSE on
not already notified significant modifications
under NIHHS Regs) Reg 9
Prepare &submit Provide further
to HSE a written information at request
report (safety case)
of HSE
igure 1 A manufacturer’s guide to the CIMAH regulations (Ref.1)
Is it an industrial activity
NO ACTION
within the meaning of Reg 2 ?
Have I a dangerous
substance within the NO ACTION
meaning of Reg 2 ?
Yes
tI
Is my activity I
EITHER OR
a use specified isolated -
in Schedule 4 ? storage ?
I I
I I
ACTION in the event of
a major accident
Reg 5
Notif major accident to
HSE bf not notified
under NADOR)
Provide information to
HSE on major accident
1
No No IS the dangerous
substance listed
in Schedule 2 ?
,
Yes V
1 ACTION
Reg 4
Demonstrate safe
operation at any time
I \
No
t
I 1
Does the quantity
exceed the threshold
I 7 in Schedule 2, column 2 ?
Yes c
Reg 10 Reg 12
Prepare an on-site Inform the public
emergency plan about the major Yes
accident hazard
Reg 11
plus
Provide information
to local authority to Reg 4
enable them to draw
Demonstrate safe
up an off-site operation at any
emergency plan time
J. Loss Prev. Process Ind., 1988, Vol 1, April 105
Role of hazop in the risk analysis of major hazard plant: R. Qureshi

controls are not universally applicable, incidents at Although the definition implies the use of this technique
Bhopal and Mexico City, among others, have shown for ‘new facilities’ it is equally intended for existing
that in future the designers and operators of such plant plants, as will be demonstrated later on.
irrespective of their location would have to demonstrate It is not the intention to deal with the hazop study
that the plant offers a degree of safety comparable with technique in detail here (for further guidance reference
those located in the Western world*. should be made to Ref. 3 and 4), but to describe its
This paper deals with how a hazard and operability application. For the success of the study it is essential
study differs from other hazard identification tech- that a multi-disciplined team is selected under the
niques and its role in risk analysis of major hazard chairmanship of an independent and experienced
plants for both the design and operational stages of a person.
plant. The team structure depends upon the type of plant
being studied but would normally consist of the designer
(process engineer when an existing plant is undergoing
Hazard identification techniques and their a hazop), client’s representative (for plant being
application
designed), specialists (instrument/mechanical/safety
Until recently, it has been customary to examine a advisor etc.), as and when required. It is best to start
project for inadequacies in design on an ad hoc basis with the raw materials first and work towards the
and any one or a combination of the following tech- products. Each piping and instrument diagram (PID) is
niques have been used for hazard identification either in divided into meaningful sections, and each section is
a team or on an individual basis: systematically examined using guide words how devia-
tions from the desired intention of the design can occur
0 Obvious: for example in the manufacture of ethyl
and whether such deviations can lead to hazardous
oxide, oxygen and ethylene are mixed in proportions
situations. Any means of protection against hazards are
close to the explosive limit, it is also very toxic - the
noted and if there are further requirements for qualita-
hazards are therefore obvious.
tive and quantitative studies these are actioned on
0 See what happens approach.
members of the study team. The need for further action
l Checklist approach: the main disadvantages are that
depends upon the product of consequence and fre-
items not on the list are not considered and plants
quency of occurrence, and is determined by rough and
dealing with new design and chemicals not expe-
ready evaluation. The procedure for study consists of
rienced before are inadequately covered. It is not
the following steps:
possible to produce a checklist which could meet all
situations. 1. definition of the objective and scope of the study;
A more effective way to identify potential hazards is to 2. selection of team;
look at the design in a dynamic manner. The technique 3. preparation for the study;
is known as a hazard and operability (hazop) study 4. carrying out study and recording of results; and
and is defined by the Chemical Industry Association 5. follow up.
(CIA) in their guide3 as follows:
The proceedings of the study are recorded on ‘working
‘The application of a formal systematic critical sheets’ (a specimen is shown in Figure 2), and the
examination to the process and engineering intentions follow up is recorded on another sheet (Figure 3).
of the new facilities to assess the hazard potential of
maloperation or malfunction of individual items of The designer and the operator have very important
equipment and the consequential effects on the facility roles to play in the hazop study which are crucial to its
as a whole’. success. The designer explains the design intention and

HAZARD AND OPERABILITY STUDY WORKING S H E E T S

TITLE ..,_.................................
DATE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
REFERENCE DOCUMENTS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
SHEET ,......_........ of . . . . . . . . . . . . . . . . . .
TEAM MEMBERS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

N O D E S ; PARAMETER ; POSSIBLE CAUSE ; CONSEQUENCES 1 PROTECTION MEANS ; NOTES & ACTIONS REQD.
, DEVIATION , I I I
I I I I I
I I I I I
I I I I I
I I I I I
I I I I I
I I I I I
I I I I I
I I I I I
I I i I I
I I I I I
I I I I I

Figure 2 Hazard and operability study working sheets

106 J. Loss Prev. Process Ind., 1988, VoJ 1, April

 Role of hazop in the risk analysis of major hazard plant: .R. Qureshi

DATE ............... VENUE ......................... SHT .......... OF .......... (b) estimating the consequences to employees, members
THOSE PRESENT ................................................................................ of the public and plant/profits; and
(c) comparing the results of (a) and (b) with a target or
HAZ. OP. ; DESCRIPTION ; I set criteria to decide the appropriate course of
SHEET , OF ACTION RESPONSE ; ACTION BY
action.
P.I.D. I REQUIRED ; I
The information for items (a) and (b) may be derived
from hazop, incident and failure rate and chemical data
banks, meterological conditions etc. Information on
random failure and the extent of gaseous and liquid
releases can be generated from well-documented hazop
study working sheets.
Figure 3 Action/response on hazop study
An experienced chairman, using his subjective judge-
ment, can eliminate the need for numerical analysis in a
the operator elaborates the operational philosophy/ large proportion of events.
constraints and historical data relevant to the plant, as
such information is not readily available. In their
absence one may have to spend a lot of time going Application of hazop in Snamprogetti Ltd
through operating instructions, management philos- As mentioned earlier, hazop can be conducted on a
ophy etc., and even then the quality of information plant under design or on an existing plant. Snamprogetti
would not be the same.
Ltd has applied the technique on both categories of
plants and our experience is briefly described in this
Risk analysis section.
In our experience, contrary to common belief, hazop
General risk analysis consists of the following steps:
does not take any longer than reviews based on the
(a) the likelihood of a specified undesired event occurr- checklist approach, provided it is conducted under the
ing within a specified period or in specified circum- Chairmanship of an experienced and independent
stances. It may be either frequency (number of person and the team members are proficient in their
occurrences per unit time) or probability (scale O-l) discipline. It does. however, take time in producing
depending on circumstances5; typed versions of the hazop working sheets.

To process

Ammonium
FCV NO nitrate
solution
NO W

Demin water make up

Ammonia A

KEY. Nitric acid

*
Added as a result of HAZOP
BJ Valve with actuator and failure mode shown
G Pumps (working/standby)
NO,NC Normally open/closed
FCV,LCV Flow and level control valves
QVI ,QV2 Quench valves
TV Trip valve
Figure 4 Ammonium nitrate reactor quench water System

J. Loss Prev. Process Ind., 1988, Vol I, April 107

Role of hazop in the risk analysis of major hazard plant: R. Qureshi

by Dow Chemical & TN0 and ICI Mond6 as a first

l-lUncontrollexJ
temperature rise
in reactor
evcntslvear
analysis of major hazards and should not be a replace-
ment for more detailed and sophisticated hazard assess-
ment and consequence analysis. Either method can be
used at any phase of design of a new plant or on an
existing plant to highlight those areas where hazard
levels are comparatively high and which require an
in-depth study. The methods can be applied to a wide
range of processes, storage installations, loading/
unloading operations, and failure of pipes handling
flammable as well as toxic substances. The toxicity
index does not take into account all the possible effects
on the human body, therefore care should be exercised
when formulating recommendations based on this
methodology.
The plant is divided into units. A unit is defined as
part of a plant that can be readily and logically char-
acterized as a separate entity. It may consist of a portion
of the plant which is (or could be) separated from the

pi$Egg$qpj&iq
remainder of the plant either by distance or by fire
barriers, walls or bunds etc. The portion of the plant
selected as a unit will normally be the area where a
particular process and/or material hazard exists which is
somewhat different to those present in other units
Figure 5 Basic fault tree for uncontrolled temperature rise in nearby.
ammonium nitrate reactor
There are two ways of ranking various units on a site

Application of hazop to plant under design Table 1 The Fire & Explosion and Toxicity Indices
While conducting hazop on a fertilizer plant design in Hazard category FEI TI
which the client representative was a team member it
was discovered that the ammonium nitrate reactor was a Ill less than 65 less than 6
II 65-95 6610
critical item where runaway reaction could give disas- I above 95 above 10
trous consequences. By keeping operational parameters
under control the situation could be avoided, but once Kategory I being the most hazardous)
realized, the only way the reaction can be arrested is by
quick introduction of water. The water for this purpose
was supplied from a demineralized water supply system Table 2 The Mond index
which normally fed the process stream and the boiler.
Hazard category Index R
The system is shown in Figure 4 (the hazop recom-
mendations are also marked). Because of the very Ill up to 500
serious nature of the problem the client requested a II between 500 and 2500
I above 2500
reliability analysis of the quench water to be carried
out to ensure that is was within acceptable limits. It was (Category I being the most hazardous)
found that the system availability was considerably The extent of safety analysis is determined as per Table 3
enhanced by taking account of the recomendations of
the hazop study (a basic fault tree is shown in Figure 5).
It has been experienced time and time again that a Table 3 Safety analysis to be applied
properly conducted hazop improves considerably the
Hazard categories
plant design and saves time on detailed assessment.
Extent of safety analysis I II Ill

Level 1 X
Application to existing plants Level 2 X
Level 3 X
Conducting a hazop study on existing plant could be an
expensive and laborious exercise and it should, there- The levels are defined as follows:
fore, be selectively applied. It may be that part of the Level 1: Qualitative (hazard and operability study) and quantita-
plant is giving problems or a number of incidents have tive treatment
occurred in certain parts of the plant to warrant hazop. Level 2: Qualitative (hazard and operability study) and offset
Mend Index R2 (Mend Index which takes into account
The classification of units of major hazard plants can operational aspects)
be done on the basis of an integrated method proposed Level 3: Offset Mond Index R2 only

108 J. L OSS P r e v . P r o c e s s lnd., 7988, Vol I, A p r i l

 Role of hazop in the risk analysis of major hazard plant: R. Qureshi
and these are briefly described as follows:
(a) Using the Fire 8z Explosion Index (FEI) and
Toxicity Index (TI). From the values of FE1 and TI
(Table I), Hazard Categories are assigned and the
extent of safety analysis to be applied is determined
from Table 3 .
(b) Using the Mond Index R6. This is a slightly longer
method and the value of R determines the Hazard
Category (Table 2) and the extent of the safety
analysis to be applied is determined from Table 3 .
Acknowledgements
The author is grateful to Snamprogetti Ltd for the
preparation and presentation of this paper and for
providing secretarial and graphical services.
References
I A guide to the Control of Industrial Major Accident Hazards
Regulations, 1984, HS(R) 21
Z Qureshi, A. R. and Grille, P., Health and Safety at Work,
September 1987
3 A Guide to Hazard and Operability Studies, Chemical lndusrries
Association, 1985
4 Kletz, T. A., ‘Hazop and Hazon - Notes on the Identification and
Assessment of Hazards’, IChemE, Rugby,
5 ‘Nomenclature for Hazard and Risk Assessment in the Process
Industries’ IChcmE, Rugby, 1985
6 Snamprogetti Ltd. ‘Internal Procedures Technical Information’,
RISK 13 and 15
J. Loss Prev. Process Ind., 1988, Vol 7, April 109