HAZOP, short for Hazard and Operability study, is a structured, team-based method for finding process hazards and operating problems by examining how a system could deviate from its design intent. It is a widely used qualitative risk-analysis technique standardized in IEC 61882 and recognized by OSHA process-safety rules.
A Harvard risk-analysis lesson once used a deliberately alarming example: dihydrogen monoxide can be dangerous in excess. The reveal is that dihydrogen monoxide is water. The point is not that ordinary water is secretly terrifying, but that risk depends on context, exposure, and controls. HAZOP gives a team a disciplined way to ask what could change, what could follow, and what should prevent harm.
- What is HAZOP?
- How to conduct a HAZOP
- Where did HAZOP come from?
- Who uses HAZOP?
- How to implement HAZOP with Process Street
What is HAZOP?
A HAZOP study examines a defined process or system one node at a time. A cross-functional team states the node’s design intent, applies guidewords to relevant process parameters, identifies credible deviations, and records possible causes, consequences, existing safeguards, and follow-up actions. The result is a traceable analysis rather than an informal brainstorming session.
A hazard is a source or situation with the potential to cause harm. Risk combines the likelihood of an unwanted event with the severity of its consequences. HAZOP helps reveal hazards and operability problems; the team’s risk-ranking method then helps decide which findings need action first.
The basic principle behind HAZOP is that normal conditions are considered safe and hazards emerge when there is a meaningful deviation from those normal conditions. A HAZOP strives to seek out those deviations and assess the consequent hazards according to how likely they are to happen and how severe the outcome could be. This makes it both a hazard-identification technique and a structured way to examine operability.
Ian Greenwood, a retired chemical engineer and works engineer at Huntsman Tioxide, Greatham Works, participated in hundreds of HAZOPs. He described the method as one that identifies “hidden hazards” while also generating a wealth of practical improvements that can make a process more productive. His second point is just as important: a strong HAZOP is a learning conversation among people who understand design, operation, maintenance, control, and safety. It should not become a tick-the-box exercise.
HAZOP guidewords
Guidewords prompt the team to consider specific departures from design intent. Typical guidewords include No, More, Less, As well as, Part of, Reverse, and Other than. The team combines them with a parameter such as flow, pressure, temperature, level, composition, or time. “No flow,” “more pressure,” and “reverse flow” are deviations worth testing against the actual node.
Guidewords are prompts, not answers. A team should use the combinations that make physical or operational sense, document why a deviation is credible, and avoid forcing every word onto every parameter. A valve, for example, might fail open, fail closed, leak, be operated at the wrong time, or be isolated incorrectly. Those cases lead to different causes, consequences, safeguards, and actions.
Guidewords are a set of words that prompt the HAZOP team to question all elements of the system or process they are assessing. They are derived from the behavior of the elements that interact to make up a particular system. An electrical system HAZOP might include guidewords around energy, current, and voltage, whereas a call-center review might focus on communication flows, understanding, and error handling.
The questions posed by a HAZOP team might include: What would happen if the valve was opened too late? What if it was opened too early? What would happen if the pressure at this valve was too high, or unexpectedly low? Assuming elements can deviate higher or lower, occur earlier or later, and change direction relative to the expectation or design gives the team a disciplined route through possible variations. The leader still has to encourage the group to think beyond past experience and resist the assumption that something cannot happen simply because it has not happened so far.
Once the team has listed the credible cause and consequence of each discovered deviation, it can propose the safeguards needed to lower the risk of identified hazards and operational failures. Catching unseen issues makes for a more robust and safer design. It can also avoid expensive modification after the process is running, when changes cost materials, engineering time, disruption, and lost output.
The HAZOP study record
A useful worksheet preserves the reasoning behind each decision. At minimum, record the node and design intent, parameter and guideword, resulting deviation, credible causes, consequences, safeguards, risk rank, recommendation, action owner, target date, and closure evidence. Include assumptions and references to the drawings or procedures used in the review. If the team decides that no further action is needed, capture that rationale too.
That record matters because the meeting is only one moment in the process lifecycle. Operations and maintenance teams need to understand the basis of safeguards, engineers need to know which assumptions supported a decision, and future reviewers need to see which scenarios were considered. A clear record also prevents the same finding from being debated from scratch every time the process changes.
How to conduct a HAZOP
A useful HAZOP needs a clear scope, current process information, the right disciplines in the room, and a facilitator who can keep the study systematic. The team normally works from process flow diagrams, piping and instrumentation diagrams, operating descriptions, cause-and-effect logic, equipment data, and prior incident or maintenance information.
The main objective is to find situations that could pose a hazard to, or limit the operability of, a particular process or system, whether new or existing. The process is broken down into sections. Each section is dissected, questioned, and discussed by experts from different parts of the organization. The team considers possible scenarios and potential deviations from normal operation to identify what might go wrong.
The four-step HAZOP process
- 1. Form the HAZOP team and define scope. Use people from the relevant parts of the organization. The team needs a broad range of experience and knowledge, plus an acute understanding of the system or process being assessed. Set boundaries, assumptions, design intent, and study objectives.
- 2. Identify the elements and nodes. Split the system or process into sections that can be examined by the HAZOP team. For each section, identify the planned design or operating parameters at that point.
- 3. Consider possible variations. For each identified parameter, consider the effects of a deviation from normal. Apply relevant guidewords and record credible causes, including equipment failure, human error, utility loss, control failure, and external events.
- 4. Identify hazards, failure points, and actions. Document concerns, estimate the impact and likelihood of a failure, describe the safeguards, and rank the risk. Write specific recommendations, name an owner, set a due date, capture evidence, review the response, and verify closure.
A HAZOP team is cross-functional, not merely cross-sectional. The exact roles depend on the process, but the group often includes operations, process engineering, maintenance, instrumentation or controls, safety, quality, and a trained facilitator. Specialists should join when the node involves their expertise. OSHA guidance likewise emphasizes an appropriate methodology, qualified participants, documented findings, and a schedule for resolving actions.
For a simple worked example, imagine a feed line supplying a heated reactor. The design intent is a controlled forward flow at a specified pressure and composition. “No flow” could result from a closed valve, blocked filter, failed pump, or bad control signal. Consequences might include loss of cooling balance or an off-spec batch. Safeguards could include a low-flow alarm and interlock. If the remaining risk is unacceptable, the action needs an owner, deadline, and closure evidence.
Common HAZOP mistakes
Studies lose value when the scope is vague, the drawings are out of date, or key operators and maintainers are absent. Other common mistakes include recording only a risk score without the reasoning, crediting a safeguard that is not independent or maintained, writing recommendations with no accountable owner, and closing actions on a promise rather than evidence. Rushing through familiar nodes can be as damaging as overanalyzing implausible scenarios.
A well-run HAZOP process encourages participants to share their experiences and improve the design for future operations. That can seem daunting at first, especially when a plant has many nodes and parameters. Breaking the work into a reliable framework helps the team discuss hazards, identify critical safety and improvement points, and assign actions without losing the reasoning behind each concern.
The quality of the discussion also depends on operator awareness and a strong safety awareness culture. Participants need enough trust to raise war stories, near misses, abnormal operations, and concerns that may not be obvious from the drawings alone.
The facilitator should keep the team centered on design intent and credible deviation logic. Participants should distinguish causes from consequences, challenge assumptions respectfully, and name the actual safeguard rather than writing a vague phrase such as “operator action.” When a question cannot be resolved in the room, assign a bounded action to obtain the missing information instead of guessing.
Where did HAZOP come from?
HAZOP grew from the “critical examination” techniques used at Imperial Chemical Industries in the 1960s. Teams systematically challenged design decisions and operating intentions instead of waiting for a failure to reveal a weakness. Trevor Kletz later described an early four-month examination of a new plant as the first recognizable hazard and operability study. His writing and teaching helped make the method more widely understood.
Flixborough and the cost of weak change control
The 1974 Flixborough disaster became a defining process-safety case. A temporary dog-leg bypass was installed after a reactor developed a crack. The UK Health and Safety Executive account records that the modification lacked a complete drawing, calculations, pressure testing, and a full assessment of the consequences. The bypass failed, releasing cyclohexane and creating a vapor cloud that exploded.
Flixborough was a small UK town known for a chemical plant that produced raw materials for nylon. The process circulated large quantities of cyclohexane through six reactors under elevated pressure and high temperature. When one reactor developed a substantial crack, it was removed and a dog-leg-shaped bypass pipe was installed to keep the remaining reactors connected and the circulation of cyclohexane going.
In a bid to keep the plant operational, the temporary modification moved ahead without the necessary engineering discipline. There was no complete drawing of the bypass, no adequate calculation of the forces arising from its shape, and no pressure test of the complete assembly before it was fitted. The bypass ruptured, a large amount of cyclohexane escaped, and the resulting vapor cloud exploded.
HSE reports 28 deaths, 36 injuries onsite, and 53 reported injuries outside the site. Fires continued to hamper rescue work for days. The lesson is broader than a single component: temporary modifications need the same engineering discipline, multidisciplinary review, and operating controls as permanent plant. A HAZOP does not guarantee safety, but it can expose abnormal conditions and overlooked interactions before a change enters service.
Kletz did not invent HAZOP by himself, and the method was already developing inside ICI, where he spent 38 years. Often called the father of inherent safety, his lasting contribution was to advocate for systematic process-safety thinking and communicate it across the whole industry. The method became a central tool because it turns operational experience into a structured challenge of design intent.
The concept grew out of critical examination, a technique used within ICI during the 1960s for examining management decisions. Applied to the design of a new chemical plant, the method pulled apart and questioned every aspect of the design over several months. The exercise uncovered potential hazards and operating problems and became recognizable as a hazard and operability study.
After Flixborough, management of risks associated with chemical operations became a central focus on the corporate agenda. Kletz became a strong advocate, writing books and papers and speaking at conferences about the benefits of risk management and safety processes. That work helped systematic hazard identification spread through the chemical industry without turning HAZOP into a guarantee or a substitute for sound engineering.
HAZOP and management of change
Flixborough also illustrates why HAZOP belongs inside a wider management-of-change system. The study can reveal hazards in a proposed modification, but the organization still needs controlled drawings, engineering calculations, defined authorization, testing, training, startup checks, and updates to operating procedures. The analysis and the change process reinforce each other: one identifies what could go wrong, while the other controls how the approved change is designed and introduced.
The same principle applies after startup. Temporary bypasses, altered alarm limits, new raw materials, software logic changes, and revised operating modes can invalidate earlier assumptions. Teams should screen changes for process-safety impact and decide whether the existing HAZOP remains valid, needs a focused review, or must be repeated for the affected nodes.
Who uses HAZOP?
HAZOP began in chemical processing, but IEC 61882 applies the technique broadly to systems where deviations from intended operation can create hazards or performance problems. It is common in oil and gas, petrochemicals, pharmaceuticals, power, utilities, food and beverage, water treatment, and other process industries. The method can also support control-system, procedural, and batch-process reviews when the scope and guidewords fit the system.
Although HAZOP is widely adopted within the chemical industry, it is not exclusive to chemical plants or organizations with the potential for major disasters. Food and water operations use deviation analysis for contamination, hygiene, dosing, temperature, and flow hazards. Pharmaceutical companies use it for industrial health and safety, batch integrity, utilities, cleaning, and process controls. The scope must remain specific to the equipment, materials, environment, and decisions under review.
It is not the best method for every risk question. Early project screening may use HAZID to identify broad hazards before detailed design exists. A HAZOP is more granular and usually examines defined nodes and deviations against a design intent. Failure mode and effects analysis starts from component or function failures. Layer-of-protection analysis or quantitative risk assessment may follow when the team needs to evaluate scenario frequency or risk reduction in greater depth.
Sector-specific HAZOP scope
In continuous chemical processing, nodes often follow vessels, piping sections, utilities, and control loops. A pharmaceutical or food batch review may focus more heavily on sequence, timing, contamination, cleaning, composition, and operator interventions. Water and utility studies may emphasize loss of flow, reverse flow, dosing errors, pressure excursions, and common-cause failures. The method stays recognizable, but the parameters, evidence, and specialists must match the process.
Procedural HAZOP variants can examine human and organizational steps, while control-system reviews may apply guidewords to signals, commands, states, and timing. Those adaptations should have a clear method and competent facilitator. Calling any informal risk workshop a HAZOP weakens the value of the term and makes study records hard to compare.
Use HAZOP when the process is complex enough that interactions, abnormal conditions, or operating deviations deserve disciplined review. Avoid treating specialist engineering judgment as a software function. Tools can organize the study, control records, and track actions, but competent people remain responsible for the analysis and decisions.
Manufacturers that need to connect controlled instructions with recurring operational execution can also review manufacturing workflow software alongside their engineering systems.
How to implement HAZOP with Process Street
Process Street is a single Compliance Operations Platform with Docs and Ops capability areas plus built-in AI. Docs gives teams a governed home for policies, procedures, and study guidance. Ops turns that guidance into assigned work with conditional routing, due dates, approvals, evidence, and an audit history. Built-in AI can help teams draft and maintain operational content inside the same product.
Process Street is not specialist HAZOP calculation or process-simulation software. It supports the operational layer around the study: preparing inputs, coordinating participants, recording the agreed method, assigning recommendations, collecting closure evidence, approving responses, and keeping the resulting procedure changes controlled. Teams can connect that work with more than 5,000 integrations without making middleware the center of the process.
In practice, process owners can assign tasks to individual participants, set deadlines with dynamic due dates, restrict sensitive work with task permissions, and use conditional logic to show the right questions for each deviation. Approval tasks give an accountable reviewer a clear decision point, while role assignments keep ownership aligned when the named person changes. Evidence, comments, and the embed widget can sit alongside the run instead of being scattered across messages.
Start by documenting the study scope, node list, roles, guideword set, risk-ranking rules, and required records. Run an Ops workflow for each study or node, use conditional paths for credible deviations, assign every action to one owner, and require evidence before approval. When a recommendation changes an operating procedure, update the controlled Doc and link it back to the study record.
The HAZOP template above provides a practical starting point. Related templates remain available as ordinary resources: risk management process, FMEA, office risk assessment, and sustainability risk management.
Related guidance can help teams place HAZOP inside a wider program for risk management, risk mitigation, ISO 31000, and enterprise risk management. The HAZOP record should connect to that program without losing the technical detail of the node, deviation, cause, consequence, and safeguard.
A strong HAZOP ends when its actions are verified, not when the meeting finishes. Give each recommendation a clear owner, due date, rationale, evidence requirement, and approval step. Revisit the analysis when the process or design changes, and retain a traceable record of what the team decided and why.
HAZOP FAQs
What does HAZOP stand for?
HAZOP stands for Hazard and Operability study. The method systematically examines deviations from the intended operation of a process or system.
Is HAZOP qualitative or quantitative?
HAZOP is primarily qualitative. Teams may add a risk matrix, layer-of-protection analysis, or quantitative assessment when a scenario needs deeper evaluation.
When should a HAZOP be repeated?
Repeat or revalidate the study after material changes and on the cadence required by the applicable process-safety program. In the United States, OSHA process-safety rules require covered process hazard analyses to be revalidated at least every five years.