Computers chem. Engng Vol.20, Suppl.,pp.

S1589-S1594, 1996

Pergamon

S0098-1354(96)00270-0

Copyright 1996 ElsevierScienceLtd

Printed in Great Britain.All rightsreserved
0098-1354/96 $15.00+0.00

Experience with an Expert System for Automated HAZOP Analysis

Ramesh Vaidhyanathan
Venkat Venkatasubramanian
Laboratory for Intelligent Process Systems
School of Chemical Engineering
Purdue university, West Lafayette, IN 47907

Abstract

Hazard and Operability (HAZOP) analysis is the most widely used and recognized as the preferred safety analysis approach in the chemical process industry. A model-based framework and an
expert system called HAZOPExpert has been developed recently for automating this analysis. The
performance of HAZOPExpert was evaluated on a sour water stripper plant and a hydrotreator plant
case studies. The expert system was found to successfully emulate the human experts reasoning and
identify the hazards similar to the HAZOP team. But, it generated a large number of unrealizable
hazardous consequences compared to the team, due to the strict qualitative reasoning approach implemented. In order to filter and rank the results from HAZOPExpert using additional quantitative
knowledge similar to the team, a semi-quantitative reasoning methodology is developed using the
quantitative design and operating specifications of the process units, and process material property
values. Significant reduction in the number of consequences was obtained using this approach on an
ethylene plant case study.
1

INTRODUCTION

Process Hazards Analysis (PHA) is the systematic identification, evaluation and mitigation of potential process hazards which could endanger the health and safety of humans and cause serious economic losses. The importance of
this activity was underscored by the Occupational Safety and Health Administration's (OSHA) PSM standard Title 29
CFR 1910.119 in the United States (OSHA, 1992), which requires that initial PHAs of all the processes covered by the
standard be completed by no later than May 26, 1997. Hazard and Operability (HAZOP) analysis is the most widely
used and recognized as the preferred PHA approach in the chemical process industry. This analysis is typically performed by a team of experts who has specialized knowledge and expertise in the design, operation, and maintenance
of the plant. The team members examine the process P&ID systematically, identify every conceivable deviation from
design intent in the plant, determine all the possible abnormal causes and the adverse hazardous consequences of that
deviation (CCPS, 1985).
Thus, HAZOP analysis is a laborious, time-consuming and expensive activity that can benefit from automation. An
intelligent system can reduce the time, effort and expense involved in this analysis, make the analysis more thorough
and detailed, minimize human errors, and enable the team to concentrate on the more complex aspects of the analysis which are unique and difficult to automate. Towards that goal, a digraph model-based framework for automating HAZOP analysis, and an expert system called HAZOPExpert, has been developed recendy (Vaidhyanathan and
Venkatasubramanian, 1995). In this paper, we briefly describe the salient features of this framework and summarize
the performance of the HAZOPExpert system on three industrial-scale petrochemical plant case studies.
2

THE MODEL-BASED FRAMEWORK

The overall architecture of the model-based framework is shown in Figure 1. The central ideas in the framework are
the separation of the knowledge required to perform HAZOP analysis into process-specific and process-general knowledge (Venkatasubramanian and Vaidhyanathan, 1994), and the use of generic Digraph-based HAZOP models of the
process units. The process-specific knowledge consists of process material properties (such as corrosivity, flammability, volatility, toxicity, etc.) and the process P&ID. The process-general knowledge consists of the HAZOP-Digraph
(HDG) models of the process units which are signed directed graph based qualitative causal models developed specifically for hazard identification. These HDG models of the process units are developed in a context-independent manner
so that they can be used for performing the analysis of a wide-variety of processes. The inference engine consists of
the method for finding abnormal causes, the method for finding adverse consequences and the method for propagation of process variable deviations. These methods allow for the appropriate interaction of the process-general and
process-specific knowledge components and identify only the abnormal causes and the adverse consequences which
are realizable in the process plant considered. The user interacts with the system through the graphical user interface

S1589

S1590

European Symposium on Computer Aided Process Engineering--6. Part B

(GUI), which consists of the P&ID graphical editor and the graphical HDG model developer for knowledge acquisition
and augmentation.

GRAPHICAL
USER [ 1
INTERFACE
HAZOPINFERENCE
ENGINE

HAZOPKNOWLEDGEBASE

t
PROCESSSPECIFIC]
KNOWLEDGE

Figure 1: Architecture of the HAZOPExpert System

HAZOP-Digraph Models
As an example, the HAZOP-Digraph (HDG) model of a heat exchanger is shown in Figure 2. The process variables of
the heat exchanger are represented by the process variable nodes (octagonal icons). These nodes can have the qualitative values "high", "low", "zero" or "normal". The directed arcs connecting these nodes have "positive" or "negative"
gains indicating the qualitative causal influence between the process variables. This qualitative causal model can be
obtained from the steady-state material and energy balances of the heat exchanger. The knowledge about finding the abnormal causes and the adverse consequences are incorporated into the HDG models using abnormal cause and adverse
consequence nodes (rectangular icons) connected to the process variable nodes. These nodes contain the knowledge
about generic unit malfunctions causes and generic adverse consequences of the process variable deviations in a process
unit, respectively.
In addition, predefined generic procedures such as "process-materials-cause", "process-materials-consequence",
and "leak-consequence" are attached to the process variable nodes in the HDG for finding process-specific causes and
consequences of process variable deviations by interacting with process material properties. For example, the "processmaterials-cause" procedure will find the process-specific abnormal causes, "blockage of tubes due to the accumulation of solid materials" and "leak from the tubes due to corrosive process materials", for a "Low Flow" deviation.
The "process-materials-consequence" procedure will find the process-specific adverse consequence, "fire hazard" or
"flashing of volatiles", for a "High Temperature" deviation. Similarly, the "leak-consequence" procedure will find the
process-specific adverse consequences due to the loss of containment of toxic, flammable or corrosive process materials
from a process unit.
3

H A Z O P ANALYSIS USING HAZOPEXPERT

Based on the model-based framework described above, an expert system called HAZOPExpert has been implemented
using the real-time expert system shell G2 marketed by Gensym, Inc. The graphical user interface (GUI) of HAZOPExpert is shown in Figure 3. This figure displays the essential features of the GUI, namely, the process unit HAZOP
model library, the P&ID graphical editor and the HAZOP results windows. HAZOPExpert's model library currently
has generic models for the following 17 process units: surge tank, storage tank with lights skim, settling tank, surge
drum, liquid knockoff drum, accumulator, gas liquid separator, heater, shell and tube heat exchanger, fan condenser,
shell and tube condenser, stripper, centrifugal pump, compressor, flow control valve, non return valve, and pipe. The
user can build a new I-IDG model or add more knowledge to the existing HDG model using the graphical HDG model
developer. The P&IDs of the process and the process materials properties are the process-specific information that are
to be input by the user. If the P&IDs of the process are available in CAD format, they can be automatically imported
into HAZOPExpert. Otherwise, the user can easily draw the P&IDs of the process using the P&ID graphical editor in

European Symposiumon Computer Aided Process Engineering---6.Part B

S1591

C l u u low "~0~ O~contatnrnentdue Io kink kl the

| h d a~de=
Cause h~h "tube n ~ r e In the h~ll ~chi~ler

iTt,~erlals irlto shell s~e due to

tube ru~urs'

Figure 2: HAZOP-Digraph Model of a Heat Exchanger

HAZOPExpert. Once the P&ID is input into the system, the corresponding HAZOP models of the process units in the
P&IDs get connected automatically internally in the appropriate manner. This greatly simplifies knowledge acquisition. Similarly, if the process material property data are available in any database format (MSDS) they can be imported
automatically into HAZOPExpert.
The user can initiate any process variable deviation in any pipeline or process unit. The inference engine of HAZOPExpert propagates the process variable deviations across the plant in the upstream and downstream directions, and
identifies the abnormal causes and adverse consequences by appropriately interacting with the process specific knowledge, using the HDG models of the process units. The HAZOP results are displayed in the results windows of the units
and are also stored in user-defined files which can be automatically imported into spreadsheeting software to generate the standard report tables. These can be further manipulated and formatted in a user-defined manner for meeting
regulatory compliance and other requirements.
4

PERFORMANCE OF HAZOPEXPERT ON INDUSTRIALCASE STUDIES

HAZOPExpert is the first intelligent system, and to date the only system, in the published literature that has been successfully evaluated on various industrial-scalecase studies. In this section, we present the summary of the results obtained by HAZOPExpert on three petrochemical plant case studies as compared with the results obtained by the consultants from the Arthur D. Little, Inc., Cambridge, MA, USA. Detailed descriptions of these case studies and exhaustive
listings and discussions of all the results summarized below are presented elsewhere (Vaidhyanathan, 1995).

Sour Water Stripper Plant

The P&ID of the sour water stripper plant as drawn in HAZOPExpert is shown in Figure 3. This process consists of
26 pipes, 5 flow control valves, 5 non-return valves, 5 pumps, 1 surge drum, 1 storage tank, 1 stripper, 1 condenser,
1 stripper overhead accumulator and 6 controllers. In this process, the slop oil is separated from a refinery sour water
stream and the ammonia and hydrogen sulfide are steam stripped from the water. Hydrocarbon oil is a flammability
hazard and hydrogen sulfide and ammonia are toxic hazards. The release of these materials is a safety concern for the
plant. Also, if there is poor separation of hydrocarbon oil from the sour water, the oil will escape into the stripper. This
can gum-up the stripper which will cause operational problems.
For this case study, the HAZOP team reported 32 abnormal causes and 42 adverse consequences for 32 process
deviations considered. The team consisted of a leader and four members and took a week for completing the analysis.
Thus, 200 expert-man hours are spent for performing this analysis. The conservative estimate for the team's cost is
$13,000 per week. HAZOP analysis was performed using HAZOPExpert for these process variable deviations and
the expert system identified 64 causes and 90 consequences for these deviations. As an example, the results found
by HAZOPExpert for the process variable deviation, "low interface level in sw-surge-drum" are shown in the results
windows of the process units in Figure 3. It should be noted that HAZOPExpert has propagated the deviation all the way
downstream to the stripper and has found the ultimate consequence, "gumming up of the stripper due to high amounts

$1592

European Symposium on ComputerAided Process Engineering----6.Part B

==
P~F'

i,,

Z~
B&BI-PROE~.UNIT
~
TANK

V,iA~LVE

/~
HE~T.EXCHANQER

CONDE~gEe EIE~ILEll
/~
,~
~E'TTUNC~TA#K ~ ow-covcrnOL-V,~LVE STCe,M~iFT~:n
eU~OE,D~M

ud N

SWS4=iD

[]

HAZOP-LWIT-LIB

Da~l ~d Tkn.; ~/11/19~1~SATURDAY, 13~6

[]

HAZOP-PROCEDUREg

Odgkll HAZOP detd~n: LOW INTERFACE k

SW-gURGE-DRUM

NO~I~V~V E

~,
~1"O~~OE-T~41.~Ltl Q~T8-8IOU

BTRiPPI~OVHO~ ~CUUU LAT(~

/,~
~'~OCE~M ATERI&L

~l

Date =midT ~ e ; ,4flEllSCJ4,SATURDAY,

Odgbal HAZOP deviofiqn: LOW [,ITERFACE

SW-$URQE-DRUM
The c~ae fqr LOW =~unt of SOUR-WATER In
REFINERY-UNITSl= LOW =meuntof SOURWATER FROM UPSI~EAM UNITS l=*mg
itto REFINERY-UNITS

mm z:~

=nacluenc f~r HIGH nlntr=bn d 14C'OlL ~1 gW-S'I'ORAGE is HIGH

CONCENTRATION of H-C-OIL i~t= b"WFROk4-$TORAGE-PIPE

/~

HA~F-CC4~NECTION-PO~
I~;
/~
~ Unit N ~

Unit h l ~ & D; REFINERY-UNITS

ID sw

ID: SW-SU~GE-DflUM

Date e,'ld Time; 0/1EII99o.,SATURDAY, 13;~5

Unit Heeoe & ID: SW-$TRIPPER

Odibal I'IAZOP davlalkln: LOW INTERFACE b

~;W-gURGE4~RUM
he cause lot low bted~l in $W-SURGEDRUM I~ the LEVEL SENSOR HC-LS FA
LOW
"~e cue= ~r LOW mte~ce kvel b SWSURGE-DRUM is LOW CONCENTRATION of
SOUR-WATER h the inter ~',~ tQ gW-SURQEDRUM from SURQE-DHUM-FEED-PIPE

O(It~l Ild T'lml; ~1511cJ<}4~SATURDAY, I]~5

Odgi~=l HAZOP davi=li=n; LOW NTERFACE b
SW-SURQE-DRUM
"nlt conglquenct ~r high wnaunt ~ H-C-OIL
gW-S'rRIPPER El GUMMFNGUP OFgWSTRIPPER LEADING TO OPERATIONAL
PROBLEMS

The consaquence for I ~ btedt= level k gWSURGE-DRUM I~ OVERFLOW of H-C-OIL k

t= SOUR-WATER k~lng la high
cancent~on of H-C-O[ In 8W-OUT-PIPE

Figure 3: Graphical User Interface of HAZOPExpert

of hydrocarbon oil entering the stripper". For a human team, it is often difficult for the team members to propagate the
consequences through all the downstream units as far as HAZOPExpert does.

Hydrotreator Plant
The P&ID of the hydrotreator plant is shown in Figure 4. This process consists of 4 heat exchangers, 1 condenser,
2 fan condensers, 3 strippers, 1 heater, 1 separator, 2 compressors, 2 pumps, 1 hydrotreator, 15 flow control valves,
15 controllers, 16 sensors, 1 surge drum, 3 liquid knockoff drums, and 68 pipes. This process removes the sulfur,
nitrogen and oxygen compounds from the heavy gas oil by catalytic reaction with hydrogen in the hydrotreator. Heavy
gas oil is a flammable raw material, and the reactant hydrogen is flammable and toxic. The impurities, ammonia and
hydrogen sulfide are toxic, corrosive and flammable. Hence, the release of any of these materials will lead to fire, toxic
exposure or environmental violation consequences. For this case study, a team of five experts spent 2 weeks to identify
the 75 causes and 90 consequences for 56 process deviations considered. For these process variable deviations, HAZOP
analysis was performed using HAZOPExpert and the expert system identified 140 causes and 190 consequences.
For both these case studies, the HAZOP results from the expert system included those obtained by the team. But,
HAZOPExpert identified more number of causes and consequences as compared to the team. This is partly due to
the more thorough nature of the propagation of the process deviations and the analysis performed by HAZOPExpert.
In addition, HAZOPExpert provides explanations of process variable deviation propagation along with the causes and
consequences and these results for a deviation are identified in a few seconds on a Sun sparcl class machine. Thus from
a computational perspective, HAZOPExpert is quite fast. The HAZOP analysis for the entire sour water stripper plant
was performed in about 2 hours and the hydrotreator plant in about 4 hours in an interactive mode using HAZOPExpert.
This time requirement is much lower than the time spent by the team for the analysis. Thus, HAZOPExpert can be used
to obtain significant savings in performing PHAs. The purpose of the expert system is not to replace the conventional
team of experts entirely. But, the goal is to synergistically minimize the team's time and effort enabling the team to
focus on more complex aspects of the analysis that can not be automated. HAZOPExpert can be used in an interactive
batch mode with the team or a fully automated mode.

European Symposium on Computer Aided Process Engineering---6. Part B

S 1593

Figure 4: P&ID of the Hydrotreator Plant

5

USING QUANTITATIVE KNOWLEDGE IN H A Z O P ANALYSIS

An important drawback of this first version of HAZOPExpert is the strict qualitative nature of the analysis implemented
in the system. Due to this, HAZOPExpert assumes the worst case scenario and identifies more number of consequences
compared to the team, with increasing complexity of the processes. The HAZOP team will filter these worst case consequences using additional quantitative information in the form of design and operating specifications of the process
units and quantitative process material property values. For example, while considering a process deviation of 'high
temperature' in a process unit, HAZOPExpert will find the consequence "fire hazard", if a flammable process material
is present in that unit. But, when the experts perform the analysis, they will compare the operating temperature of the
unit with the auto-ignition and flash-point temperatures of the process materials and report a fire hazard consequence
only if it exceeds a threshold value. Similarly, the team will filter the worst case consequences for the deviations, "High
Flow", and "High Pressure", such as leak and rupture leading to release of hazardous chemicals, and fire hazard due to
release of flammables, etc.
In order to automatically filter and rank the adverse consequences identified by HAZOPExpert similar to the team,
a semi-quantitative reasoning methodology was developed by appropriately integrating the qualitative HDG models
and the additional quantitative information. This methodology uses quantitative "threshold values" for comparing the
design and operating values of the process variables and the process material property values in order to decide whether
a particular adverse consequence will occur in a process unit in the given process plant. The threshold values used by
the filtering methodology can be specified by the user, thus controlling the number of consequences generated by the
expert system. The additional quantitative knowledge is also used to automatically detect any major errors in the basic
design of the process, like the set point pressure of the relief valve for a vessel set higher than the design pressure of the
vessel thus "blowing the vessel in order to protect the relief valve", and any operating hazards like operating too close
to or higher than the design values of the process units. In addition, the hazardous consequences found by the expert
system are ranked based on their severity. Also, some of the qualitative ambiguities encountered during the propagation
of qualitative process variable deviations can be resolved by performing order-of-magnitude comparisons among the
quantitative operating values of the process variables.

Ethylene Plant
The performance of the semi-quantitative reasoning approach for filtering and ranking of the consequences was tested
on an ethylene plant case study. The P&ID of the ethylene plant section is shown in Figure 5. This plant section consists
of the tertiary waste heat recovery using quench water wash in a stripper, primary compression, acid-gas removal using
caustic wash in a scrubber and secondary compression of the pyrolysis gas. There are 5 compressors, 5 compressor
intercooler condensers, 5 liquid knockoff drums, 2 strippers, 2 pumps, 1 quench water cooler heat exchanger and 1
quench water heavy oil separator surge-drum in this process.
For this case study, the HAZOP results for a sample of 5 process deviations were considered for evaluation. For

S1594

a:..L

European Symposium on Computer Aided Process Engineering---6. Part B

-- ~

, ;= --2--, "&

" :

Figure 5: P&ID of the Ethylene Plant

these deviations, the HAZOP team had identified 11 causes and 11 consequences. The strictly qualitative HDG modelbased HAZOPExpert system identified 21 causes and 50 consequences. The HDG model-based HAZOPExpert with the
semi-quantitative filtering identified 21 causes and 24 consequences. Thus, there is significant reduction in the number
of consequences due to the semi-quantitative filtering approach. Also, the filtered results from HAZOPExpert included
the causes and consequences that were identified by the team. The additional results found by HAZOPExpert after
filtering, which were not listed by the team, are realizable causes and consequences which can occur in the process units
considered. Thus, the semi-quantitative filtering methodology eliminates only the unrealizable consequences using the
additional quantitative information, while being able to identify the causes and consequences that were found by the
team.
6

CONCLUSIONS

A model-based expert system for automating HAZOP analysis called HAZOPExpert has been developed. The following key techniques and novel concepts were utilized in order to make this automation feasible and useful: the identification and the separation of the knowledge required to perform HAZOP into process-specific and generic components, the
use of context-independent HAZOP-Digraph models of process units, appropriate interaction among these components
to cover the process-specific aspects of the analysis, and a semi-quantitative reasoning methodology for filtering and
ranking the HAZOP results using additional quantitative information in the form of design and operating specifications
of the process units and process material property values. The performance of HAZOPExpert was successfully evaluated on three industrial scale petrochemical plant case studies by comparing with the HAZOP team's results. These
successful results suggest that the technology of automating PHA of chemical process plants using intelligent systems
is now beyond proof of concept and is ready for industrial applications.
ACKNOWLEDGMENTS

The authors gratefully acknowledge the National Institute of Occupational Safety and Health which supported this work
in part through the grant R01 OH03056. The authors also acknowledge Mr. Frederick T. Dyke, Senior Consultant,
Arthur D. Little, Inc., Cambridge, MA., for his assistance with the case studies and the evaluation of HAZOPExpert.
REFERENCES

CCPS (1985). Guidelines for hazard evaluation procedures. Center for Chemical Process Safety, AIChE, New York.
OSHA (1992). Process safety management of highly hazardous chemicals; explosives and blasting agents; final rule,
29 cfr 1910.119. 6356-6417, Federal Register, Department of Labor, United States.
Vaidhyanathan, R. (1995). A Model-Based Frameworkfor Automating HAZOP Analysis of Continuos Process Plants.
PhD thesis, School of Chemical Engineering, Purdue University.
Vaidhyanathan, R. and Venkatasubramanian, V. (1995). Digraph-based models for automated hazop analysis. To appear
in Reliability Engineering and System Safety.
Venkatasubramanian, V. and Vaidhyanathan, R. (1994). A knowledge-based framework for automating hazop analysis.
AIChE Journal, 40, 496-505.