Why Process Safety Management Fails Quietly
A HAZOP study is accurate on the day it is signed. Each modification afterwards is a small bet that nothing relevant has changed.
A snapshot that ages
A hazard and operability (HAZOP) study examines a process node by node, recording the equipment, the operating envelope and the safeguards as they were when the team signed off. From that day the plant keeps changing and the study does not.
Regulation anticipates this. In the United States, OSHA's Process Safety Management standard requires a process hazard analysis to be revalidated at least every five years, and it also requires a management-of-change (MOC) procedure. MOC is meant to be the everyday control, with the five-year cycle as the backstop. Chemical plants elsewhere work to comparable expectations under their own regulators and under guidance from bodies such as the Center for Chemical Process Safety.
How drift accumulates
The gap between study and plant rarely opens through one bad decision, and more often builds from changes that each seem minor.
Exhibit 1: Typical modifications that outrun a HAZOP study, and why each escapes review.
| Modification | Why it looks minor | What the original study assumed |
|---|---|---|
| A bypass line added for a temporary campaign | It was meant to be removed | The line did not exist |
| A control system upgrade | Like-for-like replacement of old hardware | Specific response times and alarm behavior |
| An operating envelope widened in steps | Each step was small and separately approved | The original limits |
| A safety interlock bypassed during maintenance | Temporary, with restoration planned | The interlock in service |
| A change of feedstock or catalyst supplier | Same specification on paper | Composition and impurities of the original material |
The person approving each change is usually solving an operating problem and not thinking about the hazard analysis. Without a prompt, the question of whether the HAZOP still holds is never asked.
More frequent studies are not the answer
One response is to run full HAZOP studies more often. They are expensive, they take experienced people away from the plant, and they still miss whatever changes between cycles, because a calendar cannot keep up with modifications.
The better control sits at the moment of change. Any modification that meets a defined hazard-relevance test triggers a review of the affected node or system only, and because it is scoped, it is quick enough to do every time.
The change cannot be closed without process safety sign-off, however small it appeared to the person who asked for it, which turns revalidation from a judgment call into a required step.
What good looks like
- The MOC form asks a short set of screening questions that decide whether a hazard review is needed.
- Temporary changes carry an expiry date and an owner for removal.
- Interlock bypasses need authorization and are tracked until restored.
- Drawings and the HAZOP record are updated as part of closing the change.
- Someone audits a sample of closed changes each quarter.
In one composite engagement, a petrochemical producer found that a bypass line, a control upgrade and a revised reactor envelope had all gone ahead without revalidation. After the change process was rebuilt around a mandatory scoped review, no undocumented interlock bypass was recorded. Read the HAZOP and MOC case study.
This article is about change control. Whether individual barriers still work is a separate check, covered in process safety beyond the checklist, and whether people report what they see is covered in when near-miss reports stop.
Key takeaways
- Pull the last ten closed change requests and check how many had a documented hazard review.
- Walk one unit with its piping and instrumentation diagrams and note what does not match.
- List every safety interlock currently bypassed, with the date and the person who authorized it.
- Add process safety sign-off as a required field before any change can be closed.
Check your studies against the plant
We can revalidate HAZOP studies for modified units and redesign your management-of-change process so reviews are triggered by each change.
When Near-Miss Reports Stop: A Process Safety Warning Sign
A falling near-miss count at a chemical plant usually means operators no longer believe reporting achieves anything. Supervisors can see the signs first.
Contractor Oversight Standards for Publicly Funded Programs
One procurement policy can still produce a different oversight practice on every project. In a public program, a finding at one site is a finding against all of them.
Process Safety and Asset Integrity Beyond the Checklist
A procedure on file and a barrier that works are different things. Bowtie analysis shows which one you have.