17.1 Hazard Identification Methodologies (HAZOP, FMEA, What-If)

17.1 Hazard Identification Methodologies (HAZOP, FMEA, What-If)

Process safety engineering prevents catastrophic loss of containment of toxic, flammable, and reactive chemicals. On the NCEES PE Chemical Exam, process safety questions test hazard identification methodologies, regulatory requirements, independent safeguards, and quantitative risk evaluation techniques.

---

1. Regulatory Framework: OSHA PSM (29 CFR 1910.119)

The Occupational Safety and Health Administration (OSHA) Process Safety Management (PSM) standard, codified at 29 CFR 1910.119, applies to processes containing threshold quantities of listed toxic and reactive chemicals (e.g., chlorine $\ge 1,500\text{ lbm}$, anhydrous ammonia $\ge 10,000\text{ lbm}$) or flammable liquids and gases stored in quantities $\ge 10,000\text{ lbm}$ (with specific atmospheric fuel storage exemptions). The Environmental Protection Agency enforces a complementary Risk Management Program (RMP) under 40 CFR 68 to protect the off-site public and environment.

OSHA PSM is organized into 14 discrete, legally mandated elements:

---

2. Hazard and Operability Studies (HAZOP)

The Hazard and Operability (HAZOP) study is the most widely applied, rigorous technique for identifying design vulnerabilities and operational hazards in chemical process facilities.

The Node Architecture and Design Intent

A multidisciplinary HAZOP team (comprising process engineers, operators, instrumentation engineers, and safety specialists) divides complex Piping and Instrumentation Diagrams (P&IDs) into discrete Nodes (e.g., a pump suction line, a shell-and-tube reactor preheater, or a high-pressure flash drum). For each node, the team defines the Design Intent (e.g., "Transport $150\text{ gpm}$ of liquid toluene at $75^\circ\text{F}$ and $60\text{ psig}$ from tank TK-101 to reactor R-201").

+-------------------------------------------------------------------------+
|                       HAZOP Systematic Methodology                      |
+-------------------------------------------------------------------------+
|  1. Select Node & Define Design Intent (P&ID, Flow, Temp, Pressure)    |
|  2. Apply Guide Word + Process Parameter = Specific Process Deviation   |
|  3. Identify Credible Initiating Causes                                 |
|  4. Determine Consequences (Assuming NO Safeguards are Functional)     |
|  5. List Existing Safeguards (Independent Interlocks, PRVs, Alarms)     |
|  6. Evaluate Risk & Assign Action Recommendations to Responsible Person |
+-------------------------------------------------------------------------+

Standard Guide Words and Parameter Pairing

Deviations are generated by systematically pairing Guide Words with Process Parameters:

$\mathbf{Deviation} = \mathbf{Guide\;Word} + \mathbf{Process\;Parameter}$

---

3. Failure Modes and Effects Analysis (FMEA) & What-If Protocols

Failure Modes and Effects Analysis (FMEA)

FMEA is a bottom-up, component-level inductive analysis technique commonly applied to complex mechanical hardware, rotating machinery, and safety interlock packages. For every physical component (valves, pumps, transmitters, seals), the team identifies failure modes (e.g., valve fails open, valve fails closed, packing leaks) and determines local and system-wide effects.

Each failure mode is prioritized by calculating the Risk Priority Number (RPN):

$\text{RPN} = S \times O \times D$

Where:

• Severity ($S$, 1 to 10): Measures the consequence severity. $S=1$ indicates negligible impact; $S=10$ indicates catastrophic danger (off-site fatality, severe toxic release) occurring without warning.
• Occurrence ($O$, 1 to 10): Measures the frequency or probability of the failure mode occurring during the operating lifespan. $O=1$ indicates virtually impossible ($< 10^{-6}/\text{yr}$); $O=10$ indicates nearly certain / frequent ($> 1/\text{month}$).
• Detection ($D$, 1 to 10): Measures the likelihood that existing inspection, instrumentation, or alarms will detect the failure mode before the ultimate consequence occurs. Note the inverse scaling: $D=1$ represents absolute certainty of detection (redundant automated interlocks), whereas $D=10$ represents zero detection capability (hidden failure modes detectable only upon catastrophe).

[!IMPORTANT] FMEA Prioritization Rule: RPN scores range from 1 to 1,000. When prioritizing corrective action, Severity ($S$) always takes precedence over RPN. A failure mode with $S=10, O=2, D=2$ ($\text{RPN}=40$) demands immediate engineering redesign over a failure mode with $S=4, O=5, D=4$ ($\text{RPN}=80$), because catastrophic life-safety hazards cannot be tolerated regardless of low frequency.

What-If / Checklist Analysis

A What-If Analysis is a structured brainstorming technique where experienced personnel pose speculative questions starting with "What if...?" (e.g., "What if the instrument air supply header fails?", "What if raw material feed is contaminated with water?"). It is frequently combined with standardized industry checklists (such as API or NFPA checklists) to ensure comprehensive review of smaller modifications or early-stage preliminary plant designs.

---

4. Layer of Protection Analysis (LOPA) & Safety Instrumented Systems (SIS)

Quantitative LOPA Methodology

Layer of Protection Analysis (LOPA) is a semi-quantitative risk assessment tool used to evaluate whether existing safeguards provide adequate risk reduction against high-consequence event scenarios identified in a HAZOP. LOPA calculates the Mitigated Event Frequency ($f_{\text{ME}}$):

$f_{\text{ME}} = f_{\text{IE}} \times \prod_{i=1}^n \text{PFD}_i$

Where:

• $f_{\text{IE}}$ = Initiating Event Frequency (events per year, $\text{yr}^{-1}$).
• $\text{PFD}_i$ = Probability of Failure on Demand for the $i$-th Independent Protection Layer (IPL) (dimensionless, representing the probability that the barrier fails when called upon).
• $f_{\text{ME}}$ = Mitigated Event Frequency (events per year, $\text{yr}^{-1}$).

   +-------------------------------------------------------------+
   |                  Onion Skin of Protection Layers            |
   +-------------------------------------------------------------+
   |   [Community Emergency Response]                             |
   |     [Plant Emergency Response & Deluge]                     |
   |       [Physical Relief Devices: PRVs & Rupture Disks]       |
   |         [Safety Instrumented Systems: SIF / Interlocks]     |
   |           [Operator Intervention via Alarms & Annunciators] |
   |             [Basic Process Control System: BPCS]            |
   |               [Inherent Process Design & Material Choice]   |
   |                 ===> CORE HAZARD / PROCESS CORE <===        |
   +-------------------------------------------------------------+

Core Rules for Independent Protection Layers (IPLs)

To qualify as an IPL under CCPS (Center for Chemical Process Safety) standards, a protection layer must satisfy four strict validation criteria:

1. Independence: The layer must function completely independently of the initiating event and independently of any other credited IPL. (For example, if the initiating event is failure of a Basic Process Control System [BPCS] loop, no control loop inside that same BPCS can be credited as an IPL!).
2. Functionality: The layer must be capable of fully preventing or mitigating the consequence within the available process response window.
3. Integrity: The device must be designed to withstand process conditions (temperature, pressure, corrosion) and tested regularly.
4. Auditability: The safeguard must be periodically tested and documented under a formal mechanical integrity program.

Typical industry PFD credits allocated in LOPA:

• Human operator response to dedicated alarm ($> 10-20\text{ min}$ response window): $\text{PFD} \approx 0.10$ ($10^{-1}$).
• Basic Process Control System (BPCS) independent control loop: $\text{PFD} \approx 0.10$ ($10^{-1}$).
• Pressure Relief Valve (PRV) or Rupture Disk: $\text{PFD} \approx 0.01$ ($10^{-2}$).

Safety Instrumented Systems (SIS) and SIL Levels

A Safety Instrumented System (SIS) consists of dedicated field sensors (transmitters, switches), logic solvers (safety PLCs), and final control elements (fail-safe emergency shutdown valves, de-energizing relays) that perform one or more Safety Instrumented Functions (SIFs).

The required risk reduction factor is defined as:

$\text{RRF} = \frac{1}{\text{PFD}_{\text{avg}}} = \frac{f_{\text{unmitigated}}}{f_{\text{target}}}$

International standards IEC 61508 / IEC 61511 classify safety functions into four Safety Integrity Levels (SIL):

(Note: In the commercial process industries, SIL 4 is virtually never implemented due to extreme economic and complexity constraints; inherent safety redesign is mandated instead).

---

5. Comparative Overview of Hazard Identification Methodologies

---

6. Comprehensive Worked Numerical Example

Problem Statement

An exothermic continuous stirred tank reactor (CSTR) carries out a highly reactive liquid-phase nitration. A PHA team evaluates a catastrophic vessel overpressure and explosion scenario caused by a sudden loss of cooling water flow.

1. LOPA Assessment: The initiating event is the mechanical failure of the cooling water circulation pump, with an initiating frequency of $f_{\text{IE}} = 0.25\text{ yr}^{-1}$ (once every 4 years). The corporate risk tolerance policy mandates that the mitigated frequency for a catastrophic reactor rupture must not exceed $f_{\text{target}} = 2.5 \times 10^{-5}\text{ yr}^{-1}$. The team credits two existing independent safeguards:
   • An independent high-temperature alarm that alerts the operator to manually inject cold inhibitor within a validated 20-minute window ($\text{PFD}_1 = 0.10$).
   • A certified ASME Section VIII pressure relief rupture disk designed to vent vapor to a quench tank ($\text{PFD}2 = 0.020$). Determine the mitigated frequency with existing safeguards. If an additional Safety Instrumented Function (SIF) is required to meet the target frequency, calculate the maximum allowable $\text{PFD}{\text{SIF}}$ and determine the minimum required Safety Integrity Level (SIL).
2. FMEA Evaluation: The team analyzes the emergency inhibitor injection pump seal. The failure mode "catastrophic seal rupture during emergency demand" is assigned a Severity score of $S = 9$ (toxic release, failure of emergency function), an Occurrence score of $O = 4$ (moderate probability based on maintenance data), and a Detection score of $D = 5$ (no continuous seal pressure transmitter; checked only during quarterly operator rounds). Calculate the current RPN. If the engineering department adds a dual pressurized mechanical seal pot with a continuous pressure transmitter and low-pressure control room alarm ($D_{\text{new}} = 2$) and upgrades seal face metallurgy ($O_{\text{new}} = 2$), compute the new RPN and percentage risk reduction.

---

Step 1: LOPA Calculations

Calculate the unmitigated frequency through the existing credited protection layers:

$f_{\text{existing}} = f_{\text{IE}} \times \text{PFD}_1 \times \text{PFD}_2$ $f_{\text{existing}} = (0.25\text{ yr}^{-1}) \times (0.10) \times (0.020) = 5.0 \times 10^{-4}\text{ yr}^{-1}$

Comparing $f_{\text{existing}}$ to the corporate target:

$f_{\text{existing}} = 5.0 \times 10^{-4}\text{ yr}^{-1} > f_{\text{target}} = 2.5 \times 10^{-5}\text{ yr}^{-1}$

The existing safeguards are insufficient; an additional SIF must be integrated into the Safety Instrumented System. Calculate the maximum allowable $\text{PFD}_{\text{SIF}}$:

$f_{\text{target}} \ge f_{\text{existing}} \times \text{PFD}_{\text{SIF}}$ $\text{PFD}_{\text{SIF}} \le \frac{f_{\text{target}}}{f_{\text{existing}}} = \frac{2.5 \times 10^{-5}\text{ yr}^{-1}}{5.0 \times 10^{-4}\text{ yr}^{-1}} = \mathbf{0.050} = 5.0 \times 10^{-2}$

Calculate the required Risk Reduction Factor ($\text{RRF}$):

$\text{RRF} = \frac{1}{\text{PFD}_{\text{SIF}}} = \frac{1}{0.050} = \mathbf{20}$

Determine the SIL level from the SIL classification table:

• SIL 1 covers $10^{-2} \le \text{PFD} < 10^{-1}$ ($\text{RRF} = 10 \text{ to } 100$).
• Since $\text{PFD}_{\text{SIF}} = 0.050$, the system requires a SIL 1 rated Safety Instrumented Function.

---

Step 2: FMEA RPN Evaluation

Calculate the baseline Risk Priority Number:

$\text{RPN}_{\text{initial}} = S \times O \times D = 9 \times 4 \times 5 = \mathbf{180}$

Calculate the improved RPN following seal pot and metallurgy redesign ($S = 9, O_{\text{new}} = 2, D_{\text{new}} = 2$):

$\text{RPN}_{\text{improved}} = S \times O_{\text{new}} \times D_{\text{new}} = 9 \times 2 \times 2 = \mathbf{36}$

Compute the percentage risk reduction:

$\%\;\text{Reduction} = \frac{\text{RPN}_{\text{initial}} - \text{RPN}_{\text{improved}}}{\text{RPN}_{\text{initial}}} \times 100\% = \frac{180 - 36}{180} \times 100\% = \frac{144}{180} \times 100\% = \mathbf{80.0\%}$

---

7. Safety Data Sheets as Design Inputs

Every hazard identification study begins with chemical hazard data, and the primary source is the Safety Data Sheet (SDS). Under OSHA's Hazard Communication Standard (29 CFR 1910.1200), aligned with the Globally Harmonized System, a manufacturer must supply an SDS in a fixed 16-section order, and the employer must keep it readily accessible to employees.

Three sections carry the data a process engineer actually designs against:

The remaining sections cover identification, hazard classification, composition, first aid, fire fighting, accidental release, handling and storage, toxicological data, ecological data, disposal, transport, regulatory information, and revision date. Sections 12 through 15 fall outside OSHA's jurisdiction but must still appear.

How this connects to PSM. The process safety information element, (1910.119(d)), requires documented information on the hazards of the chemicals in the process — toxicity, permissible exposure limits, physical data, reactivity data, corrosivity data, thermal and chemical stability data, and the hazardous effects of inadvertent mixing of different materials. The standard states this information may be obtained from Safety Data Sheets, provided they contain it.

The limit an engineer must recognize. An SDS describes a chemical as supplied, at ambient conditions, in its container. It does not describe the mixture inside your reactor at (180^\circ\text{C}) and (20\text{ bar}), and it does not supply the heat of reaction, the onset temperature of a runaway, or the adiabatic temperature rise. Those come from reactive chemical testing — differential scanning calorimetry, accelerating rate calorimetry — and feed the non-isothermal reactor analysis of Section 14.2. Treating an SDS as a complete process hazard characterization is a recognized and recurring failure.

8. Critical PE Exam Traps & Pitfalls

[!WARNING] Trap 1: Crediting Non-Independent Protection Layers in LOPA
The most common conceptual trap on the PE Chemical exam is claiming an automated control loop inside the Basic Process Control System (BPCS) as an IPL when the initiating event itself is a failure of that BPCS control loop or instrument. An IPL must be completely independent of the initiating mechanism. If the temperature controller fails wide open, you cannot credit high-temperature override control within the same DCS/PLC as a protective barrier.

[!WARNING] Trap 2: Misinterpreting FMEA Detection Scoring
Remember that Detection ($D$) scales inversely with detection efficacy. A score of $D = 1$ means almost certain detection before damage occurs, whereas $D = 10$ means undetectable until the disaster unfolds. Never invert this scale when calculating RPN.

[!WARNING] Trap 3: RRF vs. PFD Inversion in SIL Determination
Be careful not to confuse the Probability of Failure on Demand with the Risk Reduction Factor. Candidates often see $\text{RRF} = 200$ and accidentally match it to $0.02$ (SIL 1) instead of computing $\text{PFD} = 1/200 = 0.005$ ($5.0 \times 10^{-3}$), which falls into SIL 2.