The process variable matters first: pressure, temperature, flow, inventory, and response time determine whether a valve or human action can move the plant past a safe limit. A manual valve in the wrong position can block flow or create an unintended path; a passing non-return valve (NRV) can permit reverse flow; a passing pressure safety valve (PSV) can transfer material into the relief system. This is stored energy and timing, not a documentation technicality.
A blanket NOT CONSIDERED entry for manual-valve failures, operator error, and passing NRVs or PSVs is defensible only when each scenario has a documented basis for exclusion or a traceable assessment elsewhere. The HAZOP record must identify that assessment, its boundaries, and the controls on which it relies.
Process Limits Behind the Exclusions
Start with the quantity that can exceed a limit. For each excluded failure, identify the physical deviation before debating methodology. Closing a manual valve can produce no flow, low flow, deadheading, or blocked-in thermal expansion. Opening one can produce high flow, loss of containment, contamination, or depressurization. NRV leakage introduces reverse flow or pressure migration. PSV leakage creates a continuous path to the relief header or downstream system.
| Number that matters | Decision limit | Where to read it |
|---|---|---|
| Upstream and downstream pressure | Applicable equipment or system pressure limit | Approved design basis, equipment datasheet, and piping documentation |
| Temperature and trapped-liquid expansion | Applicable temperature and pressure limits | Operating envelope and relief-design documentation |
| Forward, reverse, or leakage flow | Maximum tolerable transfer or contamination rate | Process design basis and consequence assessment |
| Shutdown response time | Time available before the process crosses its limit | Cause-and-effect documentation, trip records, and safety-system test results |
| Operator response time | Time between detection and required corrective action | Operating procedure, alarm-response procedure, and validated scenario record |
If the study cannot connect an exclusion to these quantities, the exclusion is not technically resolved.
Available Scope Treatments
Three treatments can be valid: assess the failure directly in the HAZOP, assign a specialized analysis, or screen it out with a documented technical basis. The choice depends on whether the failure creates a credible single initiating cause, requires detailed reliability modeling, or lies outside the defined study boundary.
| Treatment | Best use | Required record | Main weakness |
|---|---|---|---|
| Direct HAZOP assessment | Manual-valve position errors, operating errors, NRV passing, or PSV leakage that causes a guideword deviation | Cause, consequence, existing safeguards, recommendation, and risk disposition | Can oversimplify complex combinations or human-performance dependencies |
| Separate FMEA, fault-tree, human-factors, relief, or security assessment | Failure modes needing component detail, logical combinations, task analysis, relief-system evaluation, or deliberate acts | Named assessment, scope boundary, responsible owner, completion status, and cross-reference | Interfaces can disappear between studies unless ownership is explicit |
| Documented exclusion | Scenario demonstrably outside the node, lifecycle phase, or agreed methodology | Technical reason, approving authority, and affected drawings or assumptions | A vague exclusion can conceal an unassessed single failure |
The recommended treatment is direct HAZOP assessment whenever one valve failure or one credible operating error can create a process deviation. Use a separate study when its method fits the hazard better, but keep a cross-reference in the HAZOP so the scenario cannot fall between scopes.
Failure-Mode Classification
“Valve failure” is too broad for useful analysis. Separate each device by state, function, and consequence path.
- Manual valves: evaluate failed open, failed closed, left open, left closed, wrong valve operated, and inability to operate when demanded where each condition is physically credible.
- Operator actions: evaluate omitted, late, premature, incorrect, and out-of-sequence actions tied to startup, shutdown, transfer, maintenance, and abnormal operation. Deliberate sabotage belongs in a security risk assessment, not ordinary operating-error analysis.
- NRVs: treat passing or failure to seat as a reverse-flow path. Determine the source pressure, receiving system, transferred material, and whether isolation or shutdown detects the condition.
- PSVs: distinguish leakage or passing from failure to open on demand. Passing can itself initiate a deviation; failure to relieve changes whether the device may be credited as protection.
A shutdown sequence does not erase the initiating failure. It is a safeguard whose effectiveness depends on detection, logic, final elements, utilities, response time, and testing. Record the unprotected consequence first, then evaluate the shutdown function under the study’s risk method.
Structured Review Procedure
- Read the HAZOP scope, node boundaries, assumptions, guidewords, and definition of
NOT CONSIDERED. Resolve whether the phrase means excluded entirely, assessed elsewhere, or rejected as an additional concurrent cause. - List every affected manual valve, NRV, and PSV by process function. Use the approved drawings and operating procedures rather than a generic equipment checklist alone.
- Map each credible state to a deviation such as no flow, reverse flow, high pressure, low pressure, contamination, or loss of containment.
- Calculate or retrieve the pressure, temperature, flow, inventory, and time-to-limit values that determine consequence severity. Where a value is missing, assign retrieval from the governing design or relief document.
- Identify safeguards separately from causes. For an automatic shutdown, trace sensing, logic, final action, utilities, independence, response time, and proof-test evidence.
- Check whether any scenario was dismissed as “double jeopardy.” A single manual-valve error or a single passing NRV is not a double failure. If the scenario requires two independent initiating failures, document both and apply the project’s stated combination rules.
- For work allocated elsewhere, record the assessment type, exact scope, owner, status, and closure reference in the HAZOP action register.
- Reclassify unsupported exclusions as open actions until the direct assessment or cross-referenced study is complete.
Verification and Closure Evidence
Closure requires more than a statement that the plant will shut down. Walk the scenario from initiating failure to final process state. Confirm that the initiating condition is detected before the process crosses its limit, the shutdown reaches the required valve or equipment state, and the credited devices have test records covering the demanded function.
For operator-dependent protection, verify that the indication is observable, the alarm identifies the required response, the procedure contains the action, and the available response time has been validated. Training alone does not define the reliability of an action.
Review the completed scope against the applicable process-hazard framework selected by the organization. References identified for that check include OSHA 29 CFR 1910.119, API 750, API 580, and the AIChE-CCPS Guidelines for Hazard Evaluation Procedures. These documents guide the scope review; they do not automatically justify a particular exclusion.
Recurring Scope Pitfalls
The most common failure is confusing a safeguard with removal of the cause. Another is excluding all human error because a separate operating manual exists; a manual describes intended work but does not by itself analyze deviations or consequences. A third is treating all relief-device behavior as outside HAZOP, even when leakage creates a process deviation inside the node.
Checklist use also needs discipline. A checklist can prompt valve and human-action cases, but experienced operations, design, maintenance, control, and process-safety participation remains necessary to identify plant-specific interactions. Record dissent and unresolved assumptions as actions rather than silently deleting the scenario.
Frequently Asked Questions
Why does a HAZOP need to consider manual valve failure?
A manual valve left open, left closed, or unavailable on demand can independently create no flow, reverse flow, overpressure, contamination, or loss of containment. Assess each credible state against the valve’s normal position and process function.
Why does operator error belong in a HAZOP?
Omitted, late, incorrect, or out-of-sequence actions can initiate the same deviations as equipment failures. Use a separate human-factors assessment when task detail requires it, then cross-reference its scope and actions in the HAZOP.
Why does an automatic shutdown not justify excluding the cause?
The shutdown is a safeguard, not removal of the initiating event. Credit it only after checking detection, logic, final elements, utilities, response time, and test evidence against the time available before the process exceeds its limit.
When should a HAZOP exclusion be escalated?
Stop closure when no technical basis, alternate-study reference, responsible owner, or verification record exists. Escalate the item to the facility’s process-safety authority and, where a credited safety function depends on supplied equipment, use the manufacturer’s official support channel to resolve device behavior or test requirements.