HAZOP Studies Under ISO 9000

ABSTRACT

HAZOP studies are now probably the preferred method of Process Hazard Identification worldwide. They normally combine the steps of Hazard Identification and Corrective Action.

Senior management and Authorities in many countries, are asking for HAZOP studies, but many have no idea whether the product they receive is up to scratch. They now need an answer to the question 'Has the team done a good enough job?'

ISO 9000 contains many aspects of value in answering this question. The principles of Responsible Care require us not only to use our best endeavours to identify and cure problems in relation to safety, but also to use the best available technology to assure the quality of those endeavours. However, as with many specialist areas, the application of ISO 9000 to HAZOP is not straightforward. The authors of this paper, both experienced HAZOP leaders, have applied their knowledge of what makes a good study to the formal requirements of the ISO 9000 standard, to ensure that the quality of studies is truly assured.

INTRODUCTION

ISO 9000 is a powerful quality standard, but it is possible to follow it in many areas, including HAZOP Studies, without more than a marginal improvement in the quality of the activity. The basic difficulty that we face in trying to design a quality system to match the HAZOP activity is that the study procedure relies on brainstorming. Even though the guidewords used in HAZOP methodology provide structure to this brainstorming, they do not of themselves ensure that the brainstorming process will produce quality results.

Before DNV Technica could use ISO 9000 to assure the quality of HAZOP Studies, we needed to define a measure of the quality of a study. This in turn required a definition of the objectives of a HAZOP Study. The definition we chose is as follows:

The objectives of a HAZOP study are:

1. To identify all potential causes of process upset scenarios which could lead to significant safety or operability consequences.
2. To decide whether the current design ensures that the risk from each identified scenario is at a suitably low level.
3. If not, to recommend modifications which will reduce the risk to a suitably low level, or specify a further study to investigate the issue, with the objective of identifying a suitable modification.

Unfortunately, this objective set may be sufficient for a consulting company, only responsible for the conduct of the HAZOP Study itself, but it is incomplete for the client company because it does not put HAZOP in the context of a Safety Management Program. We decided to look beyond the HAZOP itself, to the reasons for carrying out the study, and the objectives for the process unit under study.

This then introduces more objectives, which may be the following:

1. To maximise the value of the facilities to the company by reducing process related risks to tolerable levels and to improve operating efficiency.
2. To recommend cost effective risk mitigation measures in line with company targets.
3. To recommend cost effective measures which will improve the profitability of the operation.

These two sets of objectives then allowed us to put forward quality criteria for a specific HAZOP study, bearing in mind that the client company will require a framework policy to regulate when HAZOP studies will be carried out on what facilities. The HAZOP Study quality criteria we have adopted are:

1. All potential scenarios leading to significant safety or operability issues will be identified.
2. Decisions will be made on the acceptability of the risk level from each of these scenarios.
3. Where the risk is intolerable, recommendations for change will be made which will bring the risk level within tolerable limits.
4. Recommendations will be implemented as rapidly as feasible, when justified against client company criteria.
5. An authorised rejection notice will be produced to explain the background to the rejection of any safety recommendation.

It was then necessary to decide which factors could influence these quality objectives, and how our quality system could ensure their achievement.

In addressing these quality objectives, DNV Technica identified the following factors of importance:

Each of these factors is discussed below, with the solution that we have adopted.

Team Composition and Qualifications

In order to meet our quality objective of identifying all significant safety and operability issues, we need a HAZOP Leader well versed in the HAZOP study technique, and capable of assisting the team to meet this objective. DNV Technica expects this qualification to be gained by a combination of training and experience of studies. It is unlikely that the required skills will be gained without in-depth study of the principles of the technique combined with sitting in on sessions run by several skilled HAZOP Leaders. Our internal qualification scheme includes certification of a new Leader after observation by an existing skilled Leader.

The majority of the team members also need experience in previous studies, but we accept that where this is impractical, training may be given to the group before the study proper starts. This may be done by an appropriately skilled Leader.

The brainstorming technique works best with a minimum core team of four participating members (excluding Leader and Recorder), with a broad range and depth of experience relevant to the study object. It is important that the qualifications of these members include the disciplines necessary to understand the potential hazards of the process under study, and the industry standard methods (including Codes) in use to control these hazards. At least one team member needs a good background knowledge of relevant past accidents on similar facilities, and of the lessons learned from these accidents.

The quality of the team is best judged by the HAZOP Leader, and he must be in a position to require a change of personnel if he is not satisfied. The strongest tell-tale sign of an unbalanced or underqualified team is the proportion of issues raised which require information unknown to the team to draw conclusions either about seriousness, or about suitable recommendations.

It is clear from the above that the procedure for a HAZOP Study must include allowance for the HAZOP Leader to arrange for changes of team members if he is not satisfied with their capabilities. Even if the choice of the team has been made without his input, he should retain this right. He should also be able to postpone a study if the team is not effectively identifying the serious issues. This requires a Leader with enough experience in the industry to recognise some deficiencies himself. These issues cover part of the responsibility of the Leader for the quality assurance of the study under ISO 9000. Naturally exercise of these powers could seriously strain a client/consultant relationship, but the future will show us whether insistence will cause us serious problems.

It goes without saying that a balanced team will be out of balance if a member is absent. Hence our HAZOP procedure states that if a core team member is absent the study will stop until his return or replacement by a suitable substitute. Again the future will show us how much of a problem this gives.

HAZOP Methodology and Guidewords

As explained earlier, the HAZOP method relies on brainstorming. Brainstorming as a technique is very powerful, but it is difficult to ensure that it is sufficiently rigorous to meet our objective of not missing any significant safety or operability issues. One requirement to meet this need has already been discussed, that is the size and capability of the team. The other requirement is a suitable set of 'prompts'.

HAZOP methodology relies on a set of seven guidewords, which should be applied to all the important parameters of the process under study, to identify deviations from design intent which could lead to the issues we seek. The problem of completeness lies in the identification of the 'parameters of importance'. The method adopted by many proponents of the HAZOP technique, including DNV Technica, is first to ask the team to identify this set of 'parameters of importance', then to apply to them the HAZOP guideword list to generate a much longer checklist of guidewords to be used as our 'prompts'.

In practice, for most oil or chemical industry process systems, a single, generic set of some 20-30 guidewords is used, as for example the list of Table 1.

The Leader should always check before using a generic guideword list that the team believes it to be sufficient. When non-standard equipment is involved, or batch operations, or a high level of operator involvement in the process, a special exercise will be required to generate an appropriate guideword set. The use of a guideword set to identify scenarios is illustrated by the flowchart of Figure 1.

The completeness and appropriateness of the guideword set is a key to the completeness of scenario identification, and the choice of guidewords is a mandatory step in our HAZOP procedure.

The leader will divide the equipment under study into 'study sections', and will ensure that these sections are not too large or complex, so that the team does not become confused when applying the guidewords, leading to missed scenarios.

In order to meet our requirement to identify all causes of problems, all guidewords will be applied to each 'study section', and their use will be recorded to aid later quality control. During this process it is vital that the action of all safety systems is ignored by the team, ie that the identification process assumes the failure of safety systems. The reliability and effectiveness of these systems is considered when judging the seriousness and likelihood of each scenario (see the section on Judgement Criteria below).

TABLE 1 Generic HAZOP Guidewords for Continuous Chemical Processes

Figure 1

Completeness of Coverage

We may follow all the procedural recommendations given above, and still not identify all issues within the scope of the study. This can occur if all the Process and Instrumentation Diagrams (P&IDs) in the scope have not been studied, or if not every section of the P&IDs are subjected to study. It is also possible if the P&IDs are out of date, and omit recent changes. Our procedure therefore calls for a statement of scope listing all P&IDs to be studied, and a requirement that only if the team specifically agrees should particular P&IDs not be studied, and that this will require a suitable explanation.

It is normally the Leader's responsibility to ensure that all equipment on each P&ID has been studied, and if this is done by marking each study section on a master file drawing, the completeness of cover is documented, and can be checked later by a QA reviewer.

The Leader in the study of an existing plant who is informed that a P&ID is not up to date (by a team member) must put that drawing aside until it can be accurately marked up or updated. He should not accept that a team member mark up the drawing in the study: physical checking is essential. This is a mandatory part of our procedure.

For batch systems, it is also necessary to ensure that all sections are studied for each process step. This can normally only be checked against the log sheets.

Judgement Criteria

Before the HAZOP team makes a recommendation for change, it should decide whether the current situation is acceptable. Not to do so can mean a very productive team measured by the number of recommendations produced, but we do not consider this to be a true measure of quality! The process of making the decision is often a difficult one, as there are rarely suitable criteria against which to make a judgement.

For safety issues the question 'is this consequence too serious to tolerate?' can normally generate a simple answer, but the following question 'is the likelihood too great to tolerate?' is sometimes very difficult to answer (see Flowchart of Figure 2). This is the area where the assistance of a company safety specialist may be required to help the team to determine suitable criteria. A Risk Index approach can sometimes be used to advantage, but is normally too time consuming to be used more than occasionally.

Figure 2

For operability issues the criteria are much simpler, being based on cost/benefit principles. Again judgement is required, but often as long as the benefit looks worthwhile the team will be justified in recording the recommendation for management consideration.

As far as procedures are concerned, we have chosen only to include that the question of acceptability is addressed, and that a judgement is made by the team.

Categorisation of Recommendations

Our objectives made it clear that we expected the decision making on recommendations to be influenced by whether the consequence identified was a safety issue or not. In many situations identifying environmental consequences can also be of importance in decision making. Our procedure therefore has to ensure that the correct categorisation is applied to each recommendation, and passed on to management. We also require our HAZOP Leader to carry out 'off-line' checks for this while checking the recommendations against their objectives.

Testing of Recommendations Against Objectives

While it should be part of the thought process of all team members, Leader and Recorder, it is quite difficult during a study to remember to check that each recommendation does match with the objective of reducing the risk from the scenario under study to an acceptable level. DNV Technica have therefore incorporated into their HAZOP procedure an 'off-line' check by the Leader at the time when he and the recorder are expanding the record to make the recommendations stand-alone (ie understandable in isolation from the log sheet). This is normally done immediately after each HAZOP session, and allows the Leader to come back at the beginning of the next session to resolve any problems. Again this is exercise of the Leader's QA responsibility under ISO 9000.

Decision Making and Follow-up

This activity is part of the framework within which the HAZOP procedure operates, and therefore the responsibility for it falls upon the client company in a consultant/client relationship. In order to achieve the objectives 4 and 5 of our list, the framework procedure needs to address time guidelines for decision making and further study activities. It will also need to specify the requirements for rejection of safety recommendations, and place responsibility for all these activities on particular job-holders within the company.

Continuous Improvement of the HAZOP Process

From the Leader's standpoint there needs to be continuous improvement in the methodology and the effectiveness of the brainstorming activity. Many strides have been taken over the years to improve these areas. Examples include the use of LCD panels and computerised recording software to allow the team to interface with the record on-line; the use of checklists of possible causes of problems; the use of a qualified leader as Technical Recorder to improve team efficiency and help the leader concentrate on the brainstorming activity; the attention given to human factors issues.

From the company management standpoint there is a continuing need to help HAZOP teams to make better risk and business decisions. Defining and periodically upgrading risk criteria that are well understood by team members is crucial to reaching this goal. There is also an obligation to have in place continually improving management systems to address the HAZOP recommendations in a timely and responsible manner. In order to make significant improvement to the overall process, it is often necessary to provide additional expertise to the teams either from other areas of the company, or from outside.

Conclusion

DNV Technica has set up a procedure for HAZOP Studies designed to ensure their quality under ISO 9000. However, to meet all the desired quality objectives, a client company will also require to have in place a Process Safety Management framework procedure into which this procedure fits. The major components of our HAZOP Procedure are as follows:

The client company's Process Safety Management framework will need to address: