Process Hazard Analysis Methods

Why Process Hazard Analysis Methods Matter

Process Hazard Analysis (PHA) sits at the heart of modern process safety. Catastrophic events such as Bhopal (1984), Flixborough (1974), Texas City (2005) and West Fertilizer (2013) all involved hazards that were either never systematically identified or were identified and inadequately controlled. In response, OSHA codified PHA as a mandatory element of the Process Safety Management standard (29 CFR 1910.119(e)), and the EPA mirrored it in the Risk Management Program rule (40 CFR Part 68). For the Certified Safety Professional (CSP) candidate, PHA methods appear in the Risk Management domain of the BCSP blueprint, and questions typically test whether you can select the right method for a situation, describe how a method works, perform basic calculations (especially for fault trees and LOPA) and recall regulatory requirements such as revalidation frequency and team composition. Mastering this topic is also directly transferable to the job: a CSP is frequently the facilitator, scribe or technical reviewer on PHA teams.

What a Process Hazard Analysis Is

A PHA is an organized, systematic effort to identify and analyze the significance of potential hazards associated with the processing or handling of highly hazardous chemicals. It answers four core questions: What can go wrong? How likely is it? What are the consequences? Are the existing safeguards adequate? Under OSHA PSM, a PHA must address: the hazards of the process; the identification of any previous incident that had a likely potential for catastrophic consequences; engineering and administrative controls and their interrelationships; consequences of failure of those controls; facility siting; human factors; and a qualitative evaluation of the possible safety and health effects of control failure on employees. OSHA requires the PHA to be performed by a team with expertise in engineering and process operations, including at least one employee who has experience and knowledge specific to the process being evaluated, and one member knowledgeable in the specific PHA methodology being used. PHAs must be updated and revalidated at least every five years, and recommendations must be resolved in a timely manner, documented, and communicated to affected personnel.

OSHA lists acceptable methodologies: What-If, Checklist, What-If/Checklist, Hazard and Operability Study (HAZOP), Failure Mode and Effects Analysis (FMEA), Fault Tree Analysis (FTA), or an appropriate equivalent methodology. Other techniques frequently encountered on the exam and in practice include Event Tree Analysis (ETA), Bow-Tie Analysis, Layer of Protection Analysis (LOPA), Cause-Consequence Analysis, Preliminary Hazard Analysis (PrHA) and Human Reliability Analysis (HRA).

How the Major PHA Methods Work

1. Checklist Analysis. An experience-based list of questions or items (derived from codes, standards, past incidents and company practices) is applied to the process. It is quick, inexpensive and useful for ensuring compliance with known requirements, but it only finds what is already on the list. Best suited to simple, well-understood processes or as a complement to a more creative method. It is a qualitative technique.

2. What-If Analysis. A brainstorming method in which an experienced team poses questions beginning with what if (for example, what if the cooling water pump fails?) and records causes, consequences, safeguards and recommendations. It is flexible and relatively fast but unstructured; its quality depends heavily on team experience. Qualitative.

3. What-If/Checklist. Combines the creative brainstorming of What-If with the completeness of a Checklist, offsetting the weaknesses of each. One of the most commonly used methods for lower-complexity processes and for revalidations.

4. HAZOP (Hazard and Operability Study). The most structured and widely used method for continuous chemical processes. The process is divided into nodes (sections of piping or equipment with a defined design intent). For each node, parameters (flow, pressure, temperature, level, composition, phase, reaction, etc.) are combined with guide words (No/None, More, Less, Reverse, Part Of, As Well As, Other Than, Early, Late, Before, After) to generate deviations such as No Flow or More Pressure. For each credible deviation the team identifies causes, consequences, existing safeguards and recommendations, often assigning a risk ranking using a risk matrix. HAZOP is team-based, rigorous and time-consuming, typically requiring a trained facilitator (leader) and a scribe. It is primarily qualitative, though risk ranking introduces a semi-quantitative element.

5. FMEA (Failure Mode and Effects Analysis). A bottom-up, inductive method that examines each component or equipment item, lists its possible failure modes (for example, a valve fails open, fails closed, leaks, or sticks), and identifies the effects on the system. When criticality is added (FMECA), each failure mode is scored for Severity, Occurrence and Detection to produce a Risk Priority Number (RPN = S x O x D). FMEA is excellent for mechanical and electrical systems and for single-point failures but is weak at identifying human errors and combinations of multiple failures.

6. Fault Tree Analysis (FTA). A top-down, deductive method. It starts with a defined undesired top event (for example, a reactor runaway) and works backward through logic gates to identify the combinations of basic events (equipment failures, human errors) that can cause it. AND gates require all inputs to occur; OR gates require any one input. If independent probabilities are known, FTA can be made quantitative: the probability output of an AND gate is the product of the input probabilities, while an OR gate is approximately the sum of the inputs for small probabilities (exactly, P = 1 minus the product of (1 minus each input)). Minimal cut sets are the smallest combinations of basic events that cause the top event; single-event cut sets indicate a lack of redundancy. FTA is powerful for complex systems and for determining where added protection yields the greatest reduction in top-event frequency.

7. Event Tree Analysis (ETA). A forward-looking, inductive method that begins with an initiating event (such as a loss of containment) and branches through the success or failure of each safeguard or safety function in sequence, yielding a set of possible outcomes with associated frequencies. Each branch point typically has a success path and a failure path; outcome frequency equals the initiating-event frequency multiplied by the branch probabilities along the path. ETA is useful for analyzing the effectiveness of layered protection and emergency response.

8. Cause-Consequence Analysis. Combines a fault tree (to analyze causes of the initiating event) with an event tree (to analyze consequences), producing a complete picture of how a scenario develops.

9. Bow-Tie Analysis. A visual method placing the top event (loss of control) at the center of the diagram. On the left, threats and their preventive barriers; on the right, consequences and their mitigative barriers. Escalation factors that can defeat barriers are also shown. Bow-tie is highly effective for communicating risk to management and the workforce and for linking barriers to specific critical tasks and performance standards.

10. LOPA (Layer of Protection Analysis). A semi-quantitative, order-of-magnitude method used after a qualitative PHA (usually HAZOP) to determine whether the independent protection layers for a specific scenario are sufficient. For each cause-consequence pair, the team assigns an initiating event frequency (for example, 0.1 per year for a BPCS loop failure), applies enabling conditions and conditional modifiers, and credits Independent Protection Layers (IPLs), each of which must be independent, effective (specific), auditable and dependable. Each IPL is assigned a Probability of Failure on Demand (PFD); a typical relief valve or basic process control loop credit is 0.1 (one order of magnitude). Mitigated event frequency equals initiating frequency multiplied by the PFDs of all IPLs. The result is compared to a corporate risk tolerance criterion; if the gap remains, a Safety Instrumented Function (SIF) at a given Safety Integrity Level (SIL) may be specified: SIL 1 corresponds to a PFD of 0.1 to 0.01, SIL 2 to 0.01 to 0.001, SIL 3 to 0.001 to 0.0001.

11. Preliminary Hazard Analysis (PrHA or PHA in the system safety sense). Performed early in design when details are limited; identifies major hazards, hazardous materials and energy sources so that they can be designed out. Note the acronym collision: in MIL-STD-882 system safety, PHA often means Preliminary Hazard Analysis, whereas in OSHA PSM it means Process Hazard Analysis.

12. Human Reliability Analysis (HRA). Examines task sequences and estimates human error probabilities using techniques such as THERP; typically used to supplement other methods where operator action is a key safeguard.

Selecting the Right Method

Method selection depends on the process complexity, the stage of the life cycle, the type of information needed and available resources. Early design: Preliminary Hazard Analysis or Checklist. Detailed design or operating continuous process with complex interactions: HAZOP. Mechanical or electrical equipment with discrete components: FMEA. Investigating a specific catastrophic top event or justifying redundancy: FTA. Evaluating the adequacy of layered safeguards after an initiating event: ETA or LOPA. Simple, well-understood or batch processes and revalidations: What-If/Checklist. Communication to non-technical audiences and barrier management: Bow-Tie. Inductive (forward, from cause to effect) methods include What-If, FMEA, ETA and HAZOP; the classic deductive (backward, from effect to cause) method is FTA.

Key Process Steps Common to All PHAs

1. Define scope, boundaries and the process safety information required (P&IDs, chemical data, design basis, relief design, previous incidents). 2. Assemble a multidisciplinary team with a trained facilitator. 3. Select the methodology appropriate to the complexity and life-cycle stage. 4. Systematically identify hazard scenarios, consequences and safeguards. 5. Rank risk, usually with a likelihood-severity matrix. 6. Develop recommendations, track them to closure with documented resolution, and communicate to affected employees. 7. Revalidate at least every five years, and update after significant changes through Management of Change (MOC). 8. Retain PHA documentation for the life of the process.

Exam Tips: Answering Questions on Process Hazard Analysis Methods

Tip 1 - Know the inductive versus deductive distinction cold. FTA is deductive and top-down (starts with the undesired event and reasons back to causes). FMEA, ETA, What-If and HAZOP are inductive and bottom-up or forward-looking. If a question describes starting with a system failure and working backward, the answer is Fault Tree Analysis.

Tip 2 - Match the method to key vocabulary. Guide words, nodes, deviations, design intent point to HAZOP. Failure modes, RPN, Severity-Occurrence-Detection, component-level point to FMEA. Top event, AND/OR gates, minimal cut sets point to FTA. Initiating event, branches, success/failure of safeguards point to ETA. IPL, PFD, order of magnitude, SIL point to LOPA. Threats, barriers, escalation factors point to Bow-Tie.

Tip 3 - Memorize the OSHA PSM PHA requirements. Revalidation at least every 5 years; team must include at least one person with experience and knowledge of the process and one knowledgeable in the methodology; PHA must address facility siting and human factors; recommendations must be documented, resolved and communicated; records retained for the life of the process. Questions often test the five-year figure and the team composition rule.

Tip 4 - Be ready for simple probability math. For an AND gate with independent inputs of 0.01 and 0.02, output probability is 0.0002. For an OR gate with the same inputs, output is approximately 0.03 (exactly 0.0298). For LOPA, multiply initiating frequency by each IPL PFD: 0.1 per year initiating event with two IPLs at 0.1 each gives 0.001 per year. Remember that IPLs must be independent of the initiating cause and of each other; a question asking whether a safeguard counts as an IPL usually hinges on independence.

Tip 5 - Recognize the strengths and weaknesses asked about most often. Checklist: fast but limited to known hazards. What-If: flexible but dependent on team experience. HAZOP: thorough but resource-intensive, best for continuous processes. FMEA: good for single-point hardware failures, poor for human error and multiple-failure combinations. FTA: handles multiple-failure combinations and can be quantified, but requires skilled analysts and good data.

Tip 6 - Watch the life-cycle context. If the stem says conceptual or early design, choose Preliminary Hazard Analysis or Checklist. If it says detailed design or operating plant with complex interactions, choose HAZOP. If it says after HAZOP to decide whether additional safeguards are needed, choose LOPA.

Tip 7 - Distinguish hazard identification from risk assessment. Hazard identification methods (What-If, Checklist, HAZOP, FMEA) answer what can go wrong. Risk assessment methods (FTA, ETA, LOPA, QRA) add how likely and how severe. Questions asking for a quantitative method should steer you to FTA, ETA, or LOPA (semi-quantitative), not HAZOP or What-If.

Tip 8 - Read for the single best answer. BCSP questions often list several valid-sounding methods. Eliminate those that do not fit the described information (for example, you cannot run a meaningful FMEA with no component-level design detail) and choose the method whose defining feature matches the scenario.

Practice Scenario 1: A team divides a distillation column into sections and applies the words more, less and reverse to flow and pressure. Which method is being used? Answer: HAZOP.

Practice Scenario 2: A safety engineer wants to determine the combinations of valve failures and operator errors that could lead to an overpressure rupture of a vessel. Answer: Fault Tree Analysis.

Practice Scenario 3: Following a HAZOP, management asks whether the existing relief valve and high-level alarm are enough to reduce a tank overflow scenario to the corporate tolerable frequency. Answer: Layer of Protection Analysis.

Practice Scenario 4: A PHA for a covered process was completed in June 2019. By when must it be revalidated under OSHA PSM? Answer: June 2024 (within five years).

Bottom Line

For the CSP exam, treat PHA methods as a toolkit: understand what each tool is designed to do, the vocabulary that identifies it, whether it is inductive or deductive, qualitative or quantitative, and where in the process life cycle it fits. Combine that with the OSHA PSM requirements for team composition, content, revalidation and documentation, and you will be well prepared to answer any question on Process Hazard Analysis Methods.