HAZID Studies and the Guidewords That Drive Them

A HAZID is a structured, guideword based team study that identifies hazards at a level broader than process deviation. That last phrase is the whole point of it. A HAZOP asks what happens when flow, pressure, temperature or composition departs from design intent in a defined node. A HAZID asks a different question: what could hurt people, the environment, the asset or the business at all, including the things that have nothing to do with a process line. Loss of containment is in scope, but so are the layout that puts a control room inside a blast footprint, the flood that takes out the substation, the contractor population during a turnaround, and the residues left in a vessel at decommissioning.

This page is written to be used rather than read once. The guideword register further down is the part worth returning to, and it is set out in full so it can be worked through in a session. What follows first is the part that most often goes wrong, which is when the study is held.

What this study delivers

Before the method, the outputs. A HAZID that produces less than this has not been run properly, whatever was discussed in the room.

• A hazard register for the project or the site, with every entry traceable to the study element and the guideword that raised it
• Terms of reference recording which guideword categories were applied, and the justification for any category excluded
• Worksheets carrying the hazardous event, its causes, consequences developed to each receptor, the safeguards that exist today and the risk ranking
• A risk ranked recommendation register with an owner and a date against each entry, tied to the scenario that generated it
• A referral register naming which findings go to HAZOP, LOPA, QRA, facility siting or calorimetry, because those are outputs and not omissions
• The information the design still has to produce before those downstream studies can be run
• A revalidation trigger and interval, so the study has a defined life rather than an issue date

Where HAZID belongs in the lifecycle

HAZID is routinely described as a concept stage technique. That is not quite right, and the imprecision costs studies their value in both directions. Held too early, against a block diagram and a site outline with no material inventory and no preliminary layout, the team has nothing to bite on and produces a list of generic hazards that could have been written without them in the room. Held too late, after detailed design is fixed, the findings arrive when the cheap corrections have already been designed out of reach and the only remaining answers are procedural.

The study wants early design and front end engineering design. By then there is a process description, an indicative material inventory, a preliminary plot plan, a utilities concept and an operating philosophy, which is enough for the team to reason about real hazards while the layout, separation distances, inventory and basis of safety are all still movable. On a capital project the natural placement is at FEED, ahead of the detailed design HAZOP, so that the HAZID defines the hazard set the design has to answer and the HAZOP then examines the design that answers it.

The lifecycle argument is also why HAZID is not only a projects technique. The same method covers technology transfer into an existing site, pilot and kilo scale before a first campaign of new chemistry, layout and facility siting reviews, non process infrastructure such as solvent storage, thermal fluid plant and effluent treatment, and the construction, turnaround, mothballing and decommissioning phases that a design stage HAZOP never looks at.

What separates HAZID from HAZOP

The two are complementary and the boundary between them is not a matter of depth. It is a matter of what the study is systematic about.

• HAZOP is systematic about deviation. It takes a node with a stated design intent and applies guide words to parameters, which is why it needs a firm design and a P&ID to work against.
• HAZID is systematic about hazard source. It takes a study element and applies a hazard category register, which is why it works on a plot plan, a process description and an inventory.
• HAZOP will not systematically raise a flood, a dropped load, an occupied building in a blast footprint, a contractor population, or a demolition sequence. None of those is a process deviation.
• HAZID will not establish that a specific control valve failing open overpressures a specific vessel through a specific relief path. That is what the HAZOP is for.
• A finding can move between them. A HAZID that identifies a loss of containment hazard hands the scenario to the HAZOP, which examines the causes and safeguards line by line.

The guideword register

A HAZID is only as systematic as the register behind it. The set below is applied to every study element in turn, with the facilitator selecting the categories relevant to the scope and lifecycle stage and recording the justification for any category excluded. An excluded category that is never named is the most common way a HAZID quietly loses coverage.

Chemical and reaction hazards

• Flammable materials. Flammable liquids, vapours and gases, flash point relative to process and ambient temperature, inventory, static generation during transfer, inerting adequacy and oxygen monitoring.
• Toxic materials. Acute and chronic toxicity, occupational exposure limits, highly potent compounds, containment strategy, exposure during sampling, cleaning and maintenance, offsite toxic potential.
• Reactive chemistry. Exothermic reactions, onset temperature, adiabatic temperature rise and time to maximum rate, accumulation and delayed initiation, loss of cooling, loss and restart of agitation, wrong order or rate of addition, the stated basis of safety.
• Thermal instability and decomposition. Thermal stability of intermediates and isolated solids, drying and hold time limits, self heating and self accelerating decomposition.
• Incompatible materials. Compatibility matrix, inadvertent mixing, shared lines, vents and drains, cleaning residues, wrong material delivered or charged.
• Combustible dust and powders. Kst, Pmax, minimum ignition energy, minimum ignition temperature and layer ignition, milling, sieving, drying and transfer operations, dust accumulation and secondary explosion, the explosion protection strategy.
• Asphyxiants and inert gases. Nitrogen and other inert gas release into occupied or confined spaces, oxygen depletion monitoring, cryogenic gas vaporisation.
• Corrosive and water reactive materials. Corrosivity to personnel and to materials of construction, water reactive materials, ingress of water or moisture.
• Pressure and stored energy. Compressed gas, hydraulic and pneumatic energy, springs, elevated loads, vacuum collapse, cryogenic expansion.

Process and containment hazards

• Loss of containment. Leak, rupture, overflow, overfill, tube failure, seal and gasket failure, hose failure during transfer, sample point release, drain and vent misrouting.
• Overpressure and underpressure. Blocked outlet, thermal expansion, external fire, gas breakthrough, vacuum collapse during cool down or drain, adequacy of relief and vent routing.
• Extreme temperature. Loss of heating or cooling, thermal shock, cryogenic embrittlement, hot surfaces and personnel contact.
• Utility failure. Loss of electrical power, instrument air, nitrogen, cooling water, chilled water, steam, vacuum, ventilation and extraction, DCS or PLC, including partial failure and restoration transients.
• Relief, vent and abatement. Relief routing and discharge location, scrubber and thermal oxidiser capacity and failure, back pressure, liquid carryover, effluent handling.
• Equipment integrity. Corrosion, erosion, fatigue, vibration, dead legs, low points, unregistered equipment, temporary hoses and connections, end of life assets.
• Interface and battery limit. Interfaces between units, between contractor and operating areas, and between the site and third party supply, and who owns each one.
• Simultaneous operations. Concurrent maintenance, construction and operation, conflicting permits, shared access and escape routes.

Fire, explosion and emergency response

• Ignition sources. Electrical equipment and area classification, static, hot work, mechanical sparks, hot surfaces, self heating, vehicle movements.
• Fire scenarios. Pool fire, jet fire, flash fire, warehouse and storage fire, escalation to adjacent equipment and buildings, fire duration and firewater demand.
• Explosion scenarios. Vapour cloud explosion, confined explosion, dust explosion, BLEVE, congestion and confinement, blast effect on occupied buildings.
• Detection and alarm. Fire and gas detection coverage, alarm audibility and visibility, detection of toxic and asphyxiant release, time to detect.
• Fire protection. Passive protection, sprinkler, deluge and suppression adequacy, firewater supply and containment of contaminated firewater, accessibility for the fire service.
• Emergency response. Alarm and evacuation arrangements, muster points and their own exposure, escape routes, rescue from height and confined space, on site response capability and mutual aid, medical response.
• Escalation and domino effect. Effect on adjacent units, storage, control rooms and neighbouring facilities, and loss of safety systems during the event.

Layout, facility siting and occupancy

• Plant layout and separation. Separation between hazardous inventory and occupied areas, congestion, drainage and bunding, segregation of incompatible storage.
• Occupied buildings. Control rooms, offices, laboratories and canteens and their exposure to fire, explosion and toxic release, building ingress of hazardous vapour, blast resistance.
• Occupancy and staffing. Number and location of people during routine and non routine work, shift patterns, contractor populations during turnaround and construction.
• Access and egress. Emergency vehicle access, escape routes and their exposure, single points of access, obstruction by construction or laydown.
• Neighbours and public. Adjacent site hazards affecting the facility and the reverse, public receptors, schools, roads and watercourses, regulatory notification obligations.
• Traffic and logistics. Tanker delivery and offloading, vehicle impact on process equipment, forklift and material movement, pedestrian and vehicle segregation.

External and natural hazards

• Extreme weather. High wind and storm, extreme cold and freezing of lines and instruments, extreme heat, snow and ice loading, effect on outdoor plant and relief systems.
• Flooding and water. Surface water, drainage capacity, groundwater, watercourse proximity, firewater and spill containment overflow.
• Lightning and electrical storm. Direct strike, induced surge, loss of power and control systems, effect on tanks and vents.
• Seismic and ground. Ground movement, settlement and subsidence and their effect on tanks, pipe racks and buried services.
• Loss of site infrastructure. Loss of grid power, water supply, telecoms or gas supply, failure of standby generation, and the duration of the outage.
• External impact. Aircraft, vehicle and construction plant impact, adjacent site incident, and malicious act, identified here and referred to the site security process for assessment.
• Extended loss of resource. Prolonged loss of key personnel or contractor availability and its effect on safe operation and on the maintenance of safety critical equipment.

Occupational, environmental and organisational

• Occupational health. Inhalation, dermal and ingestion exposure, highly potent compound handling, noise, vibration, ergonomics and manual handling, heat stress.
• Confined space and work at height. Vessel entry, pit and duct entry, roof and platform access, rescue arrangements.
• Isolation and intervention. Energy isolation, line breaking, residual chemical, verification of isolation, permit quality.
• Environmental. Air emissions, abatement failure, effluent and drainage, contaminated firewater, spill to ground or watercourse, waste classification and disposal, noise and odour.
• Human factors. Task complexity and workload, alarm burden, interface and labelling, shift handover, supervision of contractors, fatigue, procedure usability and availability.
• Competency and organisation. Training and competency of operators, maintenance and contractors, unclear ownership, organisational change, loss of experienced people.
• Management systems. Adequacy of management of change, pre startup review, permit to work, inspection and maintenance and process safety information for the scope, and whether the hazard depends on a system that is not yet in place.
• Cyber impact on process safety. Failure or manipulation of control or safety systems as an initiating cause, identified here and referred to information security for assessment.

Construction, commissioning and decommissioning

This category is the one most often dropped, and it is the one a design stage HAZOP will never recover. The hazards below exist only while the plant is being built, started, stopped or taken apart, which is precisely when the protective systems the design relies on are incomplete or defeated.

• Construction interface with live plant. Excavation near buried services, hot work adjacent to hazardous inventory, scaffolding and access affecting escape routes, temporary isolation of safety systems.
• Lifting and heavy transport. Crane lifts over live plant, load paths, ground bearing, exclusion zones, wind limits.
• Temporary systems. Temporary power, hoses, connections and ventilation, temporary buildings and their siting, removal and reinstatement.
• Commissioning and first fill. First introduction of hazardous material, leak testing, purging and inerting, incomplete safety systems, an operating team unfamiliar with the plant.
• Shutdown and turnaround. Draining, purging and decontamination, simultaneous work fronts, large contractor population, degraded protective systems.
• Mothballing. Preservation of equipment, residual inventory, continued integrity management, reinstatement hazards.
• Decommissioning and demolition. Residual and adhered materials, asbestos and other legacy hazards, isolation from live systems, demolition sequence and structural stability, waste route.

What the worksheet has to record

A HAZID that is not recorded properly cannot be revalidated, and revalidation is where most of its long term value sits. The worksheet is the study, not a summary of it.

• The study element and the guideword that raised the entry, so coverage can be demonstrated rather than asserted
• The hazardous event stated as an event, not as a topic, since a row reading only fire cannot be risk ranked or closed
• Causes and hazard sources, separated from the event itself
• Consequences developed to a stated receptor, covering people, environment, asset and business continuity rather than defaulting to one
• Existing safeguards, with prevention and mitigation distinguished, and only those that actually exist at the time of the study
• Risk ranking against the organisation's matrix, applied consistently across the study rather than drifting as the team tires
• Recommendations tied to the scenario that generated them, so a later reader can see what the action was for
• Where the finding is referred onward, and to which technique
• Attendance for every session and the document revisions the team actually worked from

When a finding leaves HAZID

A HAZID is qualitative or semi quantitative. It is not the place to demonstrate that a risk has been reduced to a tolerable level, and a facilitator who tries to settle that inside the study is doing the wrong work. The useful discipline is to recognise the referral and record it.

• A containment scenario against a firm design goes to HAZOP, which examines causes and safeguards line by line.
• A scenario where the safeguards need crediting goes to LOPA, and from there to SIL determination where an instrumented function is the answer.
• A scenario whose consequence reaches people offsite or an occupied building goes to consequence modelling, QRA or facility siting.
• A reactive chemistry question the team cannot answer from data goes to calorimetry, not to judgement.
• An occupational task hazard goes to task risk assessment rather than being carried in the process register.

Team, competency and independence

The output of a HAZID is decided by who is in the room more than by which register is used. The facilitator should be independent of the design and of the operation of the system under review, which is the single control that keeps a study from confirming the decisions already made. Beyond that the team needs process and operations knowledge of the kind of plant being assessed, engineering and layout input, chemistry or reaction hazard input where the process warrants it, maintenance and integrity history, and control and automation. For a construction or decommissioning HAZID it also needs the people who will do the work, not only those who planned it.

When a HAZID is required

• At early design and FEED on a capital project, ahead of the detailed design HAZOP
• At pilot or kilo scale before the first campaign of new or significantly modified chemistry
• On technology transfer into a site, before the transfer is accepted, to find the hazards new to that site
• Before construction within or adjacent to an operating facility, covering simultaneous operations and contractor exposure
• Before shutdown, turnaround, mothballing or decommissioning
• For non process infrastructure with real hazard potential, including solvent and gas storage, thermal fluid plant, cryogenic and bulk gas systems, refrigeration, effluent treatment and hazardous warehousing
• Following a significant incident, an external learning event, an audit finding or a regulatory request
• To establish or refresh a site hazard inventory where one is needed to classify and prioritise the process safety programme

The failure modes we see most

• Held at concept, against a block diagram with no inventory or layout, so the team produces hazards that could have been listed without them
• Held after detailed design, when the cheap corrections are already unreachable and only procedural answers remain
• Categories silently excluded, most often construction and decommissioning, with no record that they were considered
• Hazardous events recorded as topics rather than events, which cannot be ranked or closed
• Consequences developed only for people, leaving environment, asset and continuity unassessed
• Safeguards credited that are planned rather than installed
• Findings closed inside the study that should have been referred to HAZOP, LOPA or QRA
• A facilitator drawn from the design team, which turns the study into a review of decisions already taken

If you are planning a HAZID and want the register and terms of reference checked against your scope and lifecycle stage before the team is assembled, send us the scope and the document list. We will come back with the categories that apply, the ones that do not and why, and the information the study will need in the room to be answerable.