At a glance
- Each example starts with the node and its design intent.
- Parameter × guide word gives the deviation, e.g. “no flow” or “more pressure”.
- Consequences are described without safeguards; only then does the team check whether the existing safeguards are sufficient.
- The examples are simplified and fictitious. Values and actions do not apply to any real plant and do not replace a study by a qualified team.
How the examples are structured
A HAZOP study examines a plant node by node. For each node the team states the design intent, combines the relevant parameters with the guide words and follows every meaningful deviation through to a recommendation. The tables below show extracts; a complete study examines many more combinations and ranks risk with the company’s risk matrix.
All examples can be transferred to our free HAZOP template, which also has columns for risk ranking before and after safeguards.
Example 1: centrifugal pump transfer line
Node: transfer line from storage tank T-101 via centrifugal pump P-101 to reactor R-201. Design intent: transfer methanol at 5 m³/h, 20 °C and 4 barg to the reactor.
| Deviation | Cause | Consequence without safeguards | Existing safeguards | Recommendation |
|---|---|---|---|---|
| NO flow | Pump P-101 trips | Feed stops, reaction incomplete; off-spec product | Flow measurement with low-flow alarm | Check that the reactor stays safe on its own when the feed stops |
| NO flow | Discharge valve left closed after maintenance | Pump runs against a closed valve: heating, seal failure, methanol release with fire hazard | None | Minimum-flow line or low-flow pump trip; add the valve line-up to the restart checklist |
| MORE pressure | Pump shut-off head above the line design pressure | Flange leaks, release, fire and explosion hazard | Pressure safety valve relieving to the tank | Verify the relief valve sizing for this case |
| REVERSE flow | Pump stopped while the reactor is at higher pressure than the tank | Reaction mixture flows back into the storage tank; unwanted reaction in the tank | Check valve | Verify the backflow protection and add it to the inspection plan |
Example 2: storage tank for a flammable liquid
Node: atmospheric storage tank T-101 with road-tanker unloading and tank breathing. Design intent: store methanol at atmospheric pressure between 10 % and 85 % level.
| Deviation | Cause | Consequence without safeguards | Existing safeguards | Recommendation |
|---|---|---|---|---|
| MORE level | Unloading from the road tanker without adequate level control | Overfill, release through the vent, pool fire possible | Level measurement with high alarm | Independent overfill protection that stops the unloading |
| LESS pressure (vacuum) | Tank emptied while the breather valve is fouled or iced up | Tank deformed or damaged by vacuum | None | Add breather valves to the inspection and maintenance plan; review vacuum protection |
| AS WELL AS: water in product | Condensate or rainwater enters the tank | Off-spec product; reaction possible in water-sensitive downstream processes | Sampling before dispatch | Define draining and checks |
| OTHER THAN: wrong substance | Wrong product unloaded | Incompatible substances in the tank, reaction | Laboratory release before unloading | Label or key the unloading connections by product |
Example 3: stirred tank reactor with an exothermic reaction
Node: semi-batch reactor R-201 with jacket cooling. Design intent: dose feed B to charge A over four hours at a reaction temperature of 60 °C, with heat removal through the cooling jacket.
| Deviation | Cause | Consequence without safeguards | Existing safeguards | Recommendation |
|---|---|---|---|---|
| NO cooling | Cooling water pump fails | Heat is not removed, temperature rises, runaway reaction with pressure rise and vessel failure possible | Temperature measurement with high alarm | Provide a high-temperature feed trip as an independent safety function; determine its requirements with LOPA or a risk graph |
| MORE flow: feed too fast | Feed control fails | Unreacted feed accumulates; heat release exceeds the cooling capacity | Temperature alarm | Limit the feed rate mechanically; assess accumulation with reaction calorimetry data |
| NO agitation | Agitator fails | Poor mixing, accumulation, violent reaction when the agitator restarts | None | Interlock the feed on agitator failure; restart only after approval |
| OTHER THAN: too early | Feed starts before the charge reaches reaction temperature | Feed accumulates at low temperature and reacts later in an uncontrolled way | Operating instruction | Release the feed only above a minimum temperature (interlock) |
Example 4: shell-and-tube heat exchanger
Node: product cooler E-301, product on the tube side, cooling water on the shell side. Design intent: cool the product from 80 °C to 30 °C; product side 10 barg, cooling water side 4 barg.
| Deviation | Cause | Consequence without safeguards | Existing safeguards | Recommendation |
|---|---|---|---|---|
| NO flow: cooling water | Cooling water supply fails | Product is not cooled; hot product flashes in the downstream tank, pressure builds up | Temperature measurement downstream with alarm | Review a high-temperature trip of the product feed |
| AS WELL AS: tube leak | Tube corrosion | Product enters the cooling water because of the higher pressure: environmental impact, fire hazard in the cooling circuit | None | Monitor the cooling water for product; define bundle inspection intervals |
| MORE pressure: cooling water side | Cooling water side blocked in while hot product keeps flowing | Trapped water expands, overpressure, shell failure possible | None | Provide thermal relief on the cooling water side |
Example 5: distillation column
Node: column C-401 with overhead condenser and steam-heated reboiler. Design intent: separate a solvent mixture at 1.2 bara with a reflux ratio of 2.
| Deviation | Cause | Consequence without safeguards | Existing safeguards | Recommendation |
|---|---|---|---|---|
| NO cooling in the condenser | Cooling water failure | Vapour is not condensed, column pressure rises | Pressure measurement with alarm; relief valve at the column top | Trip the reboiler heating on high pressure; verify relief valve sizing for loss of cooling |
| MORE heat input | Steam control valve fails open | Column overloads and floods, pressure rises | Pressure alarm, relief valve | Limit the steam supply; high-pressure trip of the heating |
| LESS reflux | Reflux pump fails | Top product off-spec, temperature rise at the top | Top temperature measurement | Divert off-spec product automatically to an intermediate tank |
| MORE level in the sump | Bottoms draw-off blocked | Liquid backs up into the column, flooding, pressure surges | High-level alarm | Trip the reboiler heating on high sump level |
Example 6: hydrogen buffer storage downstream of an electrolyser
Node: buffer vessel V-501 between electrolyser and compressor. Design intent: store hydrogen from the electrolyser at 25–30 barg and supply it to the compressor.
| Deviation | Cause | Consequence without safeguards | Existing safeguards | Recommendation |
|---|---|---|---|---|
| MORE pressure | Pressure control fails while the compressor is stopped | Design pressure exceeded, vessel failure, hydrogen release | Electrolyser pressure trip; relief valve to the vent system | Verify the relief valve and the safe discharge of the vent stream |
| AS WELL AS: oxygen in hydrogen | Gas crossover in the electrolyser, e.g. membrane damage | Flammable mixture in the vessel | Oxygen-in-hydrogen analyser with trip | Review limits, sampling point and response time of the analyser; define a purge concept |
| REVERSE flow | Electrolyser shut down while the vessel pressure is higher | Hydrogen flows back into the electrolyser | Check valve | Add a positive isolation for standstill |
| AS WELL AS: external leak | Leaking fitting after maintenance | Hydrogen release, ignition, explosion hazard in enclosed areas | Gas detection; outdoor installation | Require a leak test after maintenance; review the hazardous-area classification |
What the examples teach
- A specific design intent: numbers for flow, pressure and temperature make deviations unambiguous.
- One cause per row: different causes have different likelihoods and often different safeguards.
- Consequences without safeguards: only then is it visible how much risk the safeguards actually cover.
- Specific recommendations: with an owner and due date they are followed up instead of forgotten.
- Further assessment: scenarios with severe consequences often move on to LOPA or SIL determination.
HAIZOP prepares worksheets like these from the P&ID, plant profile and substance data as reviewable drafts. The team decides what to accept, change or reject. Read more in AI HAZOP.
Frequently asked questions
Can you explain HAZOP with a simple example?
Take a pump transfer line with the design intent “transfer 5 m³/h of methanol to the reactor”. Applying the guide word NO to the parameter flow gives the deviation “no flow”. Cause: a discharge valve left closed. Consequence: the pump runs against the closed valve, the seal fails and methanol is released. Recommendation: a minimum-flow line or a low-flow pump trip.
Why are consequences recorded without safeguards?
So that the unmitigated risk stays visible. Only afterwards does the team check whether the existing safeguards are effective and sufficient. Crediting safeguards too early underestimates the risk.
What is a node in a HAZOP study?
A node is a section of the plant that is examined as a unit, such as a line between two major equipment items or one step of a batch procedure. Each node has a design intent against which deviations are examined.
Can I use these examples for my plant?
No. The examples are simplified and fictitious. They show the structure of a HAZOP worksheet but do not replace a study of your plant by a qualified, multidisciplinary team.