Intelligent systems for HAZOP analysis of complex process

Computers and Chemical Engineering 24 (2000) 2291–2302

Intelligent systems for HAZOP analysis of complex process plants

Venkat Venkatasubramanian *, Jinsong Zhao, Shankar ViswanathanLaboratory for Intelligent Process Systems, School of Chemical Engineering, Purdue Uni6ersity, West Lafayette, IN 47907, USA

Abstract

Process safety, occupational health and environmental issues are ever increasing in importance in response to heightening publicconcerns and the resultant tightening of regulations. The process industries are addressing these concerns with a systematic andthorough process hazards analysis (PHA) of their new, as well as existing facilities. Given the enormous amounts of time, effortand money involved in performing the PHA reviews, there exists considerable incentive for automating the process hazardsanalysis of chemical process plants. In this paper, we review the progress in this area over the past few years. We also discuss theprogress that has been made in our laboratory on the industrial application of intelligent systems for operating proceduresynthesis and HAZOP analysis. Recent advances in this area have promising implications for process hazards analysis, inherentlysafer design, operator training and real-time fault diagnosis. © 2000 Published by Elsevier Science Ltd. All rights reserved.

Keywords: Process safety; Environment issues; Occupational health; HAZOP analysis

www.elsevier.com/locate/compchemeng

1. Introduction

Complex modern chemical plants pose major chal-lenges for the systematic analysis and assessment of thevarious process hazards inherent in such plants. This,of course, raises serious environmental, occupationalsafety and health related concerns. Further, the plantsare often operated at extremes of pressure and tempera-ture to achieve optimal performance, making themmore vulnerable to equipment failures. Despite ad-vances in computer-based control of chemical plants,the fact that two of the worst ever chemical plantaccidents, namely, Union Carbide’s Bhopal, India, acci-dent and Occidental Petroleum’s Piper Alpha accident(Lees, 1996), happened in recent times is a troublingdevelopment. Also, industrial statistics show that eventhough major catastrophes and disasters from chemicalplant failures may be infrequent, minor accidents arevery common, occurring on a day to day basis, result-ing in many occupational injuries, illnesses, and costingthe society billions of dollars every year (McGraw-HillEconomics, 1985; Bureau of Labor Statistics, 1998;National Safety Council, 1999).

All these concerns have led the federal agencies in theUS to create safety, health and environmental regula-

tions. The Occupational Safety and Health Administra-tion (OSHA) passed its PSM standard Title 29 CFR1910.119, which requires all major chemical plant sitesto perform process hazards analysis (PHA) (OSHA,1992). In addition, EPA instituted the Risk Manage-ment Program (RMP) in 1995 (EPA, 1995). All theserequire the systematic identification of process hazards,their assessment and mitigation. To analyze processhazards, plant personnel systematically ask questionssuch as, ‘What can go wrong?’, ‘How likely is it tohappen?’, ‘What is the range of consequences?’, ‘Howcould they be averted or mitigated?’, ‘How safe is safeenough?’ and so on in order to evaluate and improvethe safety of the plant. The answers to these and otherrelated questions are sought in what is known as Pro-cess Hazards Analysis (PHA) of a chemical plant.Process Hazards Analysis is the systematic identifica-tion, evaluation and mitigation of potential processhazards which could endanger the health and safety ofhumans and cause serious economic losses.

A wide range of methods such as Checklist, What-IfAnalysis, Failure Modes and Effects Analysis (FMEA),Fault Tree Analysis (FTA) and Hazard and Operability(HAZOP) Analysis are available for performing PHA(CCPS, 1985). Whatever method is chosen, the PHA,typically performed by a team of experts, is a laborious,time-consuming and expensive activity which requiresspecialized knowledge and expertise. For PHAs to be* Corresponding author.

0098-1354/00/$ - see front matter © 2000 Published by Elsevier Science Ltd. All rights reserved.PII: S0098-1354(00)00573-1 转载

http://www.paper.edu.cn中国科技论文在线

V. Venkatasubramanian et al. / Computers and Chemical Engineering 24 (2000) 2291–23022292

thorough and complete, the team can not afford tooverlook even routine causes and consequences whichwill commonly occur in many plants. The importanceof performing a comprehensive PHA is illustrated byKletz (1986, 1988, 1991) with examples of industrialaccidents that could have been prevented if only athorough PHA had been performed earlier on thatplant. Of the various available methods, HAZOP is themost widely used PHA methodology and hence it is theapproach we have chosen to discuss in this paper.

A typical HAZOP analysis can take 1–8 weeks tocomplete, costing over $ 13 000–25 000 per week. By anOSHA estimate, approximately 25 000 plant sites in theUnited States require a PHA (Freeman, Lee & McNa-mara, 1992). An estimated $ 5 billion is spent annuallyby the chemical process industries (CPI) to performPHAs and related activities. The estimated cost ofprocess hazards reviews in the CPI is about 1% of salesor about 10% of profits.

Given the enormous amounts of time, effort andmoney involved in performing PHA reviews, there ex-ists considerable incentive to develop intelligent systemsfor automating the process hazards analysis of chemicalprocess plants. An intelligent system can reduce thetime, effort and expense involved in a PHA review,make the review more thorough, detailed, and consis-tent, minimize human errors, and free the team toconcentrate on the more complex aspects of the analy-sis which are unique and difficult to automate. Also, anintelligent PHA system can be integrated with CADsystems and used during early stages of design, toidentify and decrease the potential for hazardousconfigurations in later design phases where makingchanges could be economically prohibitive. It wouldfacilitate automatic documentation of the results of theanalysis for regulatory compliance. Also these PHAresults can be made available online to assist plantoperators during diagnosis of abnormal situations aswell as to train novice operators.

Despite the obvious importance of this area, therehas only been limited work on developing intelligentsystems for automating PHA of process plants. In thispaper, we will review the past approaches towards theautomation of PHA from the perspective of intelligentsystems. This paper is written as a brief survey of theliterature in this area with an emphasis on the overviewof the results of the Purdue investigations on intelligentsystems for PHA over the past 12 years. Of the variousmethods, HAZOP analysis is the most widely used andrecognized as a preferred PHA approach by the chemi-cal process industries. Hence, the main focus of thispaper will be on HAZOP analysis which primarilyaddresses the hazard identification aspect of PHA. Thisis a practical first step towards automating PHA be-cause the nominal information required for HAZOP,including piping and instrumentation diagrams and op-

erating procedures, is more readily available for everyprocess. The quantitative information required for haz-ard evaluation and mitigation, such as mean time be-tween failures and failure rates and fundamentalmathematical process models, however, are not.

2. Intelligent systems for automating HAZOP analysis

HAZOP analysis was developed in the late 1960s atICI in the UK. The basic principle of HAZOP analysisis that hazards arise in a plant due to deviations fromnormal behavior. A group of experts systematicallyidentify every conceivable deviation from design intentin a plant, find all the possible abnormal causes, andthe adverse hazardous consequences of that deviation.The experts in the study team are chosen to provide theknowledge and experience in different disciplines for allaspects of the study to be covered comprehensively.The procedure involves examining the process P&IDsystematically, line by line or section by section (de-pending on the level of detail required), by generatingdeviations of the process variables from their normalstate. The possible causes and consequences of eachdeviation so generated are then considered, and poten-tial problems are identified. In order to cover all possi-ble malfunctions in the plant, the process deviations tobe considered are generated systematically by applyinga set of guide words, namely, NONE, MORE OF,LESS OF, PART OF, REVERSE, AS WELL AS andOTHER THAN, which correspond to qualitative devi-ations of process variables.

In addition to identifying the hazards in a processplant, the HAZOP study also identifies operabilityproblems which prevent efficient operation of the plant.Detailed descriptions of the HAZOP analysis procedurewith illustrative examples are given in CCPS (1985),Knowlton (1989), Kletz (1986).

Variants on this basic structure of HAZOP analysishave been developed to make the approach more thor-ough. For example, ICI has adopted a six stage HazardStudy methodology which not only embraces HAZOPwithin its Hazard Study 3, but also the appropriateelements of the other PHA techniques (Preston & Tur-ney, 1991). Hazard Study 1 is the key SHE (Safety,Health and Environment) study during process concep-tion, including inherent Safety and Environmental Im-pact. Hazard Study 2 is carried out on the process flowdiagrams to identify top events and the need for furtherquantification, including QRA (frequency/consequence)design modification and hazard elimination/minimiza-tion. Hazard Study 3 relates to the engineering phase asthe classic line by line critical examination of the Engi-neering Line Diagram (ELD) or P&ID prompted byguide words. Hazard Studies 4 and 5 relate to construc-tion and commissioning and Hazard Study 6 is a finalaudit after the plant is in beneficial operation.

中国科技论文在线 http://www.paper.edu.cn

V. Venkatasubramanian et al. / Computers and Chemical Engineering 24 (2000) 2291–2302 2293

Although developed for new plants, the six-stagemethodology is equally applicable to modifications andon-going plant safety reviews. Indeed an adaptation ofHazard Study 2 has been specifically targeted to SHEAssurance requirements of existing plants as ProcessHazard Review (PHR) (Turney & Ruff, 1995) and hasbeen successfully applied to a range of technologies.

One of the important challenges in automatingHAZOP analysis is handling the huge amount of pro-cess specific information which is required as the inputfor performing HAZOP. It is desirable to develop asystem that is context-independent so that it can beused for the HAZOP analysis of a wide variety ofprocesses and will also be able to find the process-spe-cific hazards for the various processes. This was amajor hurdle that posed difficult conceptual and imple-mentational challenges that thwarted the earlier at-tempts towards automation.

As one of the early attempts, Parmar and Lees(1987a,b) used a rule-based approach to automateHAZOP analysis and showed its application for thehazard identification of a water separator system. Theyrepresent the knowledge required for propagating faultsin each process unit using qualitative propagation equa-tions and event statements for initiation and termina-tion of faults. The P&ID of the plant was divided intolines consisting of pipes and other units such as pumpsand valves through which a process stream passes, andvessels. And the control loop which consists of sensor,controller and control valve and its bypass was repre-sented as a single process unit. The starting point ofHAZOP analysis is a process variable deviation in aline. The causes are generated by searching for theinitial events and the consequences by searching theterminal events. But the causes and consequences gen-erated for a process variable deviation are confined tothe line under consideration and the vessel connected toit. Thus this method finds only the immediate causesand consequences, unlike the actual HAZOP analysis inwhich the causes and consequences are propagated tothe end of the process section under consideration tofind all the adverse consequences due to every abnor-mal cause. This automated hazard identification systemwas implemented using Fortran 77 and Prolog. While itwas a commendable early attempt, the system waslimited to the process under consideration as the knowl-edge-based was hardwired for the given process thusmaking it difficult to use for other processes. It was alsolimited to small process configurations and was notsuitable for large-scale plants. These problems plaguedother early attempts such as the ones discussed belowas well.

Waters and Ponton (1989) attempted to automateHAZOP analysis using a quasi steady state qualitativesimulation approach. They found the approach to behighly combinatorial, thus restricting its practical use-

fulness. Their qualitative simulation program was de-veloped in Prolog and implemented on a Sun 3/50workstation. They reported that the time taken toperform qualitative simulation even for simple systemssubstantially exceeded that required for a numericalsimulation involving considerable detail.

A rule-based expert system prototype calledHAZOPEX was developed using the KEE shell byKarvonen, Heino and Suokas (1990). The HAZOPEXsystem’s knowledge base consisted of the structure ofthe process system and rules for searching causes andconsequences. The rules for the search of potentialcauses are of the type, ‘If deviation type AND processstructure/conditions THEN potential cause’. One im-portant drawback of these rules is that the conditionpart of the rules depended on the process structure.This increases the number of rules required as thenumber of process units increases, thereby limiting thegenerality of the system. In HAZOPEX, the identifica-tion of abnormal causes was more emphasized and lesswas said about the adverse consequences, though inHAZOP analysis the identification of adverse conse-quences is given priority. In that sense, this work hadmore of a diagnosis flavor. HAZOPEX’s performancewas evaluated on a small part of an ammonia systemcase study for which HAZOPEX was found to includeuseful knowledge about the potential causes of devia-tions which can be used as a check-list for the user.

Nagel (1991) developed an inductive and deductivereasoning based approach to automatically identify po-tential hazards in chemical plants caused by hazardousreactions, the requisite conditions that enable the occur-rence of these reactions, and the design or operationalfaults. This is a reaction-based hazard identificationapproach limited to only such hazards, and thus is notas general or as useful as conventional PHA ap-proaches. The potential top level reaction hazards areidentified by considering all the possible reactions usingan inductive reasoning approach. A language forChemical Reactivity is used to describe chemicals,properties and reactions. The modeling language devel-oped by Stephanopoulos, Henning and Leone (1990a,b)is used to describe processing systems, unit operations,operating conditions and behavior. Topological faulttrees are constructed based on the generated results.

Catino and Ungar (1995) developed a prototypeHAZOP identification system, called Qualitative Haz-ard Identification (QHI). QHI works by exhaustivelypositing possible faults, automatically building qualita-tive process models, simulating them, and checking forhazards. QHI matches a library of general faults suchas leaks, broken filters, blocked pipes and controllerfailures against the physical description of the plant todetermine all specific instances of faults that can occurin the plant. For some of these faults, simulation andhazard identification were completed in seconds while



for many others it took days. Moreover, for some faultsthe memory on a Sun SparcStation was exhausted andthe QHI could not identify the hazards. This disadvan-tage prevented QHI from practical industrialapplications.

Suh, Lee and Yon (1997) developed a knowledge-based prototype expert system for automated HAZOPanalysis. This system comprises of three knowledgebases: unit knowledge base, organizational knowledgebase and material knowledge base, and three hazardanalysis algorithms: deviation, malfunction and acci-dent analysis algorithm. This system has been devel-oped using object-oriented language — C+ + basedon PC. However, only models of CSTR, pipe, valve,heat exchanger, tank, mixer, control valve and pumphad been developed. Models for other process unitswere under programming. This approach and the onediscussed next are similar in their conceptual frame-work to the earlier model-based object-orientedmethodology demonstrated by Venkatasubramanianand Vaidhyanathan (1994, 1996) and Vaidhyanathanand Venkatasubramanian (1995, 1996) which is de-scribed later in the paper.

Faisal and Abbasi (1997) proposed a knowledge-based software tool, called TOPHAZOP, for conduct-ing HAZOP. The knowledge base consists of two mainbranches: process-specific and general. The process-spe-cific knowledge base has been classified in two maingroups: objects (process units) and its attributes, causes,and consequences. The objects are developed in framestructure with attributes while causes and consequenceare developed in rule networks attached to the frame.The general knowledge is classified in generic causesand generic consequences. However, the interactionsbetween parameters and deviation propagation to thedownstream process units were not indicated, whichmight lead to incomplete HAZOP analysis.

A quantitative model-based approach for processsafety verification of hybrid system was proposed byDimitradis, Shah and Pantelides (1997). In their ap-proach, a state transition network was used to representhybrid behavior. Using the state transition representa-tion, a mathematical model of the system in the discretetime domain was constructed which expressed the sys-tem behavior in terms of equality and inequality con-straints. The inputs to the system may indeedcorrespond to typical process inputs, but may addition-ally be used to represent possible disturbances enteringthe process or possible failure models of the equipment.The safety verification problem requires the system toidentify disturbance profiles which could lead to haz-ards. The mathematical formation results in a mixedinteger optimization problem. For industrial scale prob-lems, therefore, the resulting optimization problemsmay be difficult to solve, particularly if significantnon-linearities are present in the system model. In

addition, even when the solution of the mathematicalprogram indicates that the system is safe for the timehorizon considered, in the presence of local optima,there is no guarantee that none of the hazards consid-ered in the analysis can occur.

To overcome shortcomings of purely quantitativeand qualitative HAZOP analysis methods, Srinivasanand Dimitradis (Srinivasan, Dimitradis, Shah &Venkatasubramanian, 1998) proposed a hybrid knowl-edge-based mathematical programming frameworkwhere the overall features of a particular hazardousscenario are extracted by inexpensive qualitative analy-ses. If necessary, a detailed quantitative analysis is thenperformed to verify the hazards with ambiguity cap-tured by the qualitative analysis. The results of thisframework are compared to those of purely qualitativereasoning using an industrial case study

Turk (1999) presented a procedure for the synthesisof a non-timed discrete model which captures the rele-vant continuous dynamic and sequential phenomena ofthe chemical process for the given specifications. Theproposed procedure focuses the construction of discretemodels with the aid of the given specifications. Thespecifications identify the relevant causal paths in thechemical process. The procedure searches backwardalong these causal paths in building the transition rela-tions for the state variables from the physical system,control systems, operating procedures, and operatorbehavior. Therefore, the proposed procedure builds adiscrete model for verifying the safety and operabilityof the chemical process.

Most of the above approaches to automated hazardsanalysis were demonstrated on small-scale processes oracademic prototypes. They were, in general, limited tothe process that was under consideration and weredifficult to modify and apply to a wide-variety ofindustrial-scale process plants. In the following, we willreview the two major efforts in developing intelligentsystems for the HAZOP analysis of continuous pro-cesses and batch processes, namely, the HAZOPExpertand Batch HAZOPExpert (BHE) projects at PurdueUniversity, which have been applied successfully tonumerous real-life industrial process plants.

2.1. HAZOPExpert: a model-based intelligent systemfor HAZOP of continuous processes

HAZOPExpert is a model-based, object-oriented, in-telligent system for automating HAZOP analysis devel-oped by Venkatasubramanian and Vaidhyanathanduring 1990–1994 for continuous processes. In theirapproach, they recognized that while the results of aHAZOP study may vary from plant to plant, theapproach itself is systematic and logical, with manyaspects of the analysis being the same and routine fordifferent process flowsheets. It turns out that about



70% of time and effort is spent on analyzing theseroutine process deviations, their causes, and conse-quences. Hence, they focused on these routine cause-and-effect analyses by developing generic models whichcan be used in a wide variety of flowsheets, thus makingthe expert system process-independent. They also rec-ognized that the process-specific components of knowl-edge, such as the process material properties andprocess P&IDs, have to be flexibly integrated with thegeneric models in an appropriate manner. To addressthis integration, they developed a two-tier knowledge-based framework by decomposing the knowledge baseinto process specific and process general knowledge,represented in an object-oriented architecture.

Process-specific knowledge consists of informationabout the materials used in the process, their properties(such as corrosiveness, flammability, volatility, toxicity,etc.) and the P&ID of the plant. The process-specificknowledge is likely to change from plant to plant and isprovided by the user. Process-general knowledge com-prises of the process unit HAZOP models that aredeveloped in a context-independent manner, which re-mains the same irrespective of the process plant underconsideration. The HAZOP model of a process unitconsists of its class definition and generic qualitativecausal model-based methods for identifying and propa-gating abnormal causes and adverse consequences ofprocess variable deviations. Based on this framework,an expert system called HAZOPExpert has been imple-mented using Gensym’s G2 real-time expert systemshell. HAZOPExpert’s inference engine allows for theinteraction of the process-general knowledge with theprocess-specific knowledge to identify the valid abnor-mal causes and adverse consequences for the givenprocess variable deviations for the particular HAZOPstudy section of the plant under consideration.

HAZOPExpert is not meant to replace the HAZOPteam. It’s objective is to automate the routine aspects ofthe analysis as much as possible, thereby freeing theteam to focus on more complex aspects of the analysis

that can not be automated. It can be used in aninteractive mode or fully automated batch mode.

2.1.1. HAZOP-Digraph (HDG) modelsThe initial version of HAZOPExpert was modified

into a HAZOP-Digraph (HDG) model-based frame-work to facilitate model development and refinementby the users as well as to tackle more complex processconfigurations (Vaidhyanathan & Venkatasubrama-nian, 1995). The overall architecture of the HDGmodel-based HAZOPExpert system is shown in Fig. 1.The HDG models are modified signed directed graphs(SDG) developed for the purpose of hazard identifica-tion. A framework for automated development of SDGmodels of chemical process units has been proposed byMylaraswamy, Kavuri and Venkatasubramanian(1994).

Hazard-Digraphs provide the infrastructure forgraphically representing the causal models of chemicalprocess systems in a transparent manner to the user.The knowledge about finding the abnormal causes andthe adverse consequences are incorporated into thesedigraphs. The HDG models of the process units areused for propagating the process variable deviationsand for finding abnormal causes and adverse conse-quences by interacting with the process specific knowl-edge. The HDG models are developed in acontext-independent manner so that they are applicableto a wide variety of flow sheets. The user can build anew HDG model or add more knowledge to the exist-ing HDG model using the graphical HDG model devel-oper. A graphical HAZOP-Digraph model buildingtool is provided for this purpose.

The graphical user interface (GUI) of HAZOPExpertis shown in Fig. 2. This figure displays the essentialfeatures of the GUI, namely, the process unit HAZOPmodel library, the P&ID graphical editor and theHAZOP results windows. HAZOPExpert’s model li-brary currently has generic models for process unitssuch as pump, tank, surge drum, heat exchanger, con-denser, accumulator, reboiler, stripper, controller,valve, pipe, etc. The P&IDs of the process and theprocess materials properties are the process-specific in-formation that is to be supplied by the user. If theP&IDs of the process are available in CAD format,they can be automatically imported into HAZOPEx-pert. Otherwise, the user can easily draw the P&IDs ofthe process using the P&ID graphical editor inHAZOPExpert. Similarly, if the process material prop-erty data are available in any database format they canbe imported automatically into HAZOPExpert. Oncethe P&IDs and the process materials property data areinput into the system, the corresponding HAZOP mod-els of the process units in the P&IDs get connectedautomatically internally in the appropriate manner.This greatly simplifies knowledge acquisition.Fig. 1. Structure of HAZOPExpert



Fig. 2. GUI of HAZOPExpert

The user can initiate any process variable deviationin any pipeline or process unit. HAZOPExpert willsystematically perform HAZOP analysis for the processvariable deviation both upstream and downstream untilthe end points of the P&ID are reached. The HAZOPresults are also stored in user-defined files which can beautomatically imported into spreadsheeting softwaresuch as Microsoft Excel, or relational databases such asOracle, or word-processing software such as MicrosoftWord to generate the standard HAZOP review tables.These can be further manipulated and formatted in auser-defined manner for meeting regulatory complianceand other requirements.

2.1.2. Performance of HAZOPExpert on industrialcase studies

HAZOPExpert is the first intelligent system in thepublished literature that was found to be successful onreal-life, industrial-scale, HAZOP case studies byHAZOP professionals. It has been tested on a numberof actual process systems of varying degrees of com-plexity by HAZOP consultants at the Arthur D. LittleCompany, Cambridge, MA, USA. In this section, wewill present results from one such case study, namely,the sour water stripper plant case study that has beenreported by Vaidhyanathan and Venkatasubramanian(1995). The consultants from Little had performed aHAZOP review for this process earlier and their results

were used to compare with the expert system’s perfor-mance. In this process, there are 26 pipes, five flowcontrol valves, five non-return valves, five pumps, onesurge drum, one storage tank, one stripper, one con-denser, one stripper overhead accumulator and six con-trollers. This process contains a refinery sour waterstream that is separated in a surge drum to remove slopoil from the sour water. The sour water is pumped intoa storage tank where any carried over slop oil can beskimmed off. From the storage tank the sour water ispumped through a heat exchanger to a steam stripperwhere ammonia and hydrogen sulfide are stripped fromthe water. Hydrocarbon oil is a flammability hazardand hydrogen sulfide and ammonia are toxic hazards.The release of these materials is a safety concern for theplant. Also, if there is poor separation of hydrocarbonoil from the sour water, the oil will escape into thestripper. This can gum-up the stripper packing whichwill cause operational problems.

HAZOP analysis was performed using HAZOPEx-pert for all conceivable process variable deviations in allthe units and pipes in the sour water stripper plant. Inany process unit, there are three deviations for flow(high, low, zero), two deviations for temperature (high,low), two deviations for pressure (high, low), threedeviations for level (high, low, zero), and three devia-tions for each process material concentration (high,low, zero). Thus, HAZOP analysis was performed for a



total of 734 deviations in all the process units in thesour water stripper plant. It identified 100 abnormalcauses and 90 adverse consequences for these devia-tions. HAZOPExpert has propagated the deviationall the way downstream to the stripper and has foundthe ultimate consequence, ‘gumming up of the stripperdue to high amounts of hydrocarbon oil enteringthe stripper’. For a human team, it is often difficult forthe team members to propagate the consequencesthrough all the downstream units as far as HAZOPEx-pert does.

When a team of personnel perform the conventionalHAZOP analysis it is not possible for them to considerthe process variable deviations in each of the pipes,valves and pumps separately, a total of 734 deviations.So, they would group a number of connected pipes,valves, and pumps and other units into study nodes andperform HAZOP for these study nodes. This way, thetotal number of deviations considered by the HAZOPteam will be far less. In the sour water stripper casestudy performed by the HAZOP team, 135 total pro-cess variable deviations were considered for HAZOPanalysis, and 32 abnormal causes and 32 adverseconsequences were reported. All these causes andconsequences were identified by HAZOPExpert. Inaddition, it had identified a number of other causesand consequences. Many of these were judged to beas less important by the human team. The generationof excessive number of causes and consequences isdue to the qualitative nature of the HAZOP analysisprocedure implemented in HAZOPExpert. In con-ventional HAZOP analysis, experts filter their initialHAZOP results using additional quantitative infor-mation in the form of the design specificationsand normal operating conditions of the processunits, and the quantitative properties of the processmaterials.

To incorporate these aspects of expert’s reasoning,Vaidhyanathan and Venkatasubramanian (1996) pro-posed a semi-quantitative reasoning methodology forfiltering and ranking HAZOP results in HAZOPExpert.This methodology used quantitative threshold valuesfor comparing the design and operating values of theprocess variables and the process material propertyvalues in order to decide whether a particular adverseconsequence would occur in a process unit in the givenprocess plant. The HAZOPExpert with semi-quantita-tive filtering identified fewer consequences than withpurely qualitative analysis. The filtered results however,included all the causes and consequences that wereidentified by the team.

The performance on other case studies were similar,except in some cases the system missed certain causesand consequences as they had not been modeled as apart of the HDG models library.

2.2. Batch HAZOPExpert: a model-based intelligentsystem for HAZOP of batch processes

Batch HAZOPExpert (BHE) is a model-based intelli-gent system for automating HAZOP analysis for batchprocesses based on HAZOPExpert. It was first devel-oped by Srinivasan and Venkatasubramanian(1998a,b), and improved later by Zhao, Viswanathan,Venkatasubramanian, Vinson and Basu (1998) by con-sidering batch control, dynamic propagation of materi-als concentration and quantitative process information.For a batch process, HAZOP analysis is more complexbecause of the discrete-event character, which raisesissues about its temporal nature. The status of the plantis constantly changing in some established discrete se-quence. Since the P&ID does not sufficiently define thesystem, a set of operating instructions and some formof sequence chart are also needed. In batch plants,these sequence and instructions are called productrecipe. Product recipe consists of a series of tasksoccurring at discrete instants of time. In each task,many subtasks are executed to achieve the task. Differ-ential equation based mathematical model, therefore, isnot enough to describe batch chemical processes. Toolsfor describing discrete systems such as Petri nets (Peter-son, 1981) are often used to represent batch processes(Srinivasan & Venkatasubramanian, 1998a).

In BHE, the product recipe is represented with two-layered Petri Nets-Recipe Petri Net (RPN) and TaskPetri Net (TPN). RPN indicates the sequence of thetasks while TPN demonstrates the sequence of thesubtasks in each task. Associated with each subtask,there is a digraph model which qualitatively capturesthe general cause-effect relationships between the vari-ables of the subtask. Currently, about 40 subtaskdigraph models have been established in the modellibrary to cover most of batch operations such as heat,cool, and filtration and so on. Fig. 3 shows a Petrinet-based knowledge representation of a simple productrecipe containing three tasks-reaction, filtration anddrying.

To improve the reliability of HAZOP analysis results,various techniques are used in the inference engine.Batch control and conditional interactions among pro-cess variables are modeled in deviation propagation,which results in filtering out consequences with lowpossibility. Batch control prevents propagating devia-tions of the control variables further to downstream.Conditional interactions reflect the sensitivity degree ofinteractions among variables. For example, for a heatsubtask in the normal operating state, high agitationcan not cause high temperature, but low agitation canlead to low temperature. The semi-quantitative reason-ing methodology used in HAZOPExpert is also usedhere to mimic the HAZOP analysis of human HAZOPexperts.



The HAZOP team normally ranks the adverse conse-quences found in a study based on the frequency andseverity of the hazards they cause in the plant. Conse-quences with high frequency of occurrence and highseverity will have a high priority of mitigation. Rankinghazards can help the user focus on those severe hazardswith higher ranks. A methodology for ranking processhazards according to the severity level of the conse-quences was proposed by Vaidhyanathan and Venkata-subramanian (1996). A similar method is used here torank the hazards in batch processes. In addition, safe-guards are also recommended for most adverseconsequences.

Information including operating parameters andquantitative hazard-critical properties of materials andequipment is used during semi-quantitative reasoning toreduce the number of impossible consequences. Mate-rial and equipment databases are therefore connectedwith this system to get necessary quantitativeinformation.

However, the input of the Petri nets with dozens orhundreds of subtasks is a time-consuming process if itis manually done by users. To reduce the effort of usersin using BHE and apply BHE at the design stage, anintelligent tool for operating procedure synthesis(iTOPS) is integrated with BHE by Viswanathan, Zhaoand Venkatasubramanian (1999).

Operating procedure synthesis (OPS) is to generatethe detailed sequence of instructions an operator needs

to manage a batch process. iTOPS uses grafchart-basedconcepts to model the process at the four levels-proce-dure, unit procedure, operation and phases as identifiedin S88 (ISA, 1995). It uses a hierarchical planningtechnique to synthesize the operating procedures.iTOPS starts with information about the process mate-rials, equipment, and chemistry to synthesize the proce-dures, unit procedures, operations, and phases for theprocess. The operating procedures are then generatedbased on the phases. The framework of OPS in iTOPSis shown in Fig. 4. The knowledge base of iTOPSincludes the procedural knowledge, declarative knowl-edge and inferred knowledge. Procedural knowledge isrepresented using Grafchart procedures. The basic com-ponents of Grafchart are steps and transitions. Declara-tive knowledge contains information on processmaterials, equipment, chemistry and block process se-quence diagram (PSD). Block PSD is a high leveldescription of a batch process. It represents the se-quence of main tasks. The declarative information isthe input from users. Inferred knowledge stores theinformation of the generated PSD and master opera-tion record (MOR). The inference engine used iniTOPS includes the algorithms for path search, equip-ment assignment, preliminary sequencing operationsand the logic for OPS. iTOPS was the first intelligentsystem that was put to use in an industrial facility. Ithas been in routine use since January, 1998 at theMonsanto Pharma facility (G.D. Searle) in Skokie, IL,

Fig. 3. Hierarchical petri-net-based knowledge representation of a simple product recipe.



Fig. 4. Framework of iTOPS.

and was used to develop more than 60 pharmaceuticalbatch processes. Its usage resulted in about 50% savingsin time and effort. Details of iTOPS can be foundelsewhere (Viswanathan, Johnsson, Srinivasan,Venkatasubramanian & Erik, 1998a,b).

Fig. 5 shows the framework of the integration sys-tem. In the framework, the information on materialinteraction, hazard critical material properties andequipment design parameters is directly obtained fromdatabase. The process chemistry, including the informa-tion on reactions and separations, still needs to be inputby users. To specify a reaction, the user has to deter-mine the reactants, products and solvent and so on. Tospecify a separation, the user has to determine thematerials in the input flow and the output flows. Whenthese specifications are finished, OPS is performed.Then the Grafchart-based Block PSD and PSD gener-ated by iTOPS are converted through the OPS-PHAinterfaces to Petri net-based RPN and TPNs requiredby BHE. When the conversion is completed, BHE canperform HAZOP analysis in batch mode. The PHAresults then are used to make MOR safer by modifyingthe instructions.

2.2.1. Performance of batch HAZOPExpert onindustrial case studies

Batch HAZOPExpert is the only intelligent systemthat has been successfully applied to batch chemicalplants. It has been tested on 18 industrial batch pro-cesses with our industrial partners. In this section, wewill present results from one such case study, namely,the Step-2 process at Monsanto’s Searle Pharma facility

in Skokie, IL, that has been reported by Zhao,Viswanathan and Venkatasubramanian (2000a). Due tothe proprietary nature of the process, specific details ofthe product recipe and process conditions are not pre-sented here. However, the exact values of the processconditions are not crucial to illustrate the effectivenessof BHE. Values for temperature, pressure, amount ofreactants, and other variables which would be consid-ered reasonable for similar process chemistry are there-fore used.

The P&ID of this step are shown, respectively in Fig.6. In this step, the following reaction is performed inreactor R1:

A+B+C�D

E+F+G+H

The gas product F is purged to scrubbers S1 and S2.After this reaction is finished, the other materials aretransferred to containers R2 and R3 where the productE get crystallized. The crystal product E is separated in

Fig. 5. Integration framework of HAZOP and OPS.



Fig. 6. P&ID of Step-2.

Besides the above two consequences, BHE capturedtwo more consequences as follows:� Possible runaway reaction.� Flammability hazard due to flammable material F

and L above flash point.

In addition, three causes for this deviation, hazardseverity and safeguard are provided by BHE.

More results on industrial applications of BHE canbe found in the literature (Zhao et al., 2000a; Zhao,Viswanathan, Zhao, Mu & Venkatasubramanian,2000b).

After generating the HAZOP results, efficiently man-aging the results and quickly getting the required infor-mation to help make decisions is important. Thefollowing kind of questions are often asked after ob-taining the HAZOP analysis results:� What are the upsets that result in a fire hazard?� What are the hazards in Node two?� What hazards are due to Chemical F?� How many hazards have a severity greater than one?

To promptly answer the above questions, a dialog andspreadsheet based result database management systemwas built in BHE. Its interface is shown in Fig. 7. Thefour columns in the upper section of Fig. 7 are tables bywhich the user can perform some queries. The spread-sheet in the lower section on the dialog lists the queryresults. By clicking the button Save, the query results canbe saved in a comma separated text file that can befurther managed by MS office software such as MS Wordor Excel. For example, the user can get all runawayreaction hazards in Task-1 by selecting Op-1: R1 in theNodes table, and runaway reaction in the Classes table.With the improved result structure, users can easilycommunicate with the HAZOP analysis results, andtherefore quickly get the information they want.

3. Conclusions and future directions

Process safety, occupational health and environmen-tal issues are among the top priorities of all chemical,pharmaceutical and specialty chemicals companies.They collectively spend billions of dollars every year inthe US on process hazards analysis to address theseconcerns. The current tedious manual approaches toPHA can benefit significantly from the appropriate useof intelligent systems.

This paper has reviewed how manual hazards analy-sis techniques and methodologies can be leveraged byan intelligent systems approach to reduce the time,effort and cost involved, and to improve the consis-tency and thoroughness of the analysis. Such systemsare not meant to replace the human team but to assistthem in improving the overall efficiency and productiv-ity of the team. Of the various PHA methodologies, the

filter F1. The wet crystal product is dried in dryer D1,and the other solvents are transferred to receivers R4,R5 and R6. There are 17 process materials includingreactants, solvents, products and by products, 11 pro-cess equipment such as reactor, filter, dryer and scrub-ber, ten tasks such as reaction, crystallization, filtration,and drying, and 93 subtasks such as charge, purge,heat, stir, crystallize and so on. The process chemistryincludes reaction, filtration, crystallization and dryingand so on. Among the process materials, solvents L, Mand D, and product F are flammable. Also for propri-etary reasons, their flash points and auto-ignitionpoints are not available in this paper. B, D, M and Fare toxic. C can be decomposed under high tempera-ture. Product E can be racemized at high temperatureor due to longer than normal time of operation.

There are 718 possible deviations at the subtask level(126 deviations at the task level). These were analyzedwith BHE, such as deviations of high and low tempera-ture, high and low pressure, long and short time in eachsubtask and so on. 90 causes at the subtask level and 40consequences at the task level were obtained by BHE.The HAZOP team analyzed 161 deviations at the tasklevel. 23 consequences at the task level were obtained.They did not consider causes. BHE not only capturedall the 23 consequences obtained by the HAZOP team,but also reported some more useful and importantconsequences, as illustrated by the following example.

The deviation is high temperature during a heatsubtask in Task-1. In fact, the heat operation is used tostart an exothermic reaction with a gas product. Theconsequences reported by the HAZOP team are:� Operator exposed to hot reaction mixture during

sampling which may result in severe burns.� High reaction temperature may expedite product

racemization, evolve gas faster and possibly decom-pose material F.



Fig. 7. Built-in result management system.

HAZOP analysis is the prime one for automation usingintelligent systems due to its wide spread usage in theprocess industry and its systematic and comprehensivenature. The iTOPS, HAZOPexpert and Batch HAZOP-expert intelligent systems developed at Purdue Univer-sity are now well beyond proof of concept and areready for industrial applications and commercialexploitation.

In addition to routine PHA, such systems can facili-tate HAZOP reviews at an early stage of process devel-opment and design. This means that problems can beidentified and rectified during detailed design or whileformulating operating procedures. Making changesonce a plant is built are very expensive compared withchanges at the design stage (Skelton, 1997). Early iden-tification of hazards will also lead to effective avoidanceor control of such hazards. HAZOP at this stage willalso help to develop confidence that the desired processis safe. Along these lines, the longer-term aim may wellbe to move towards process conception and synthesis tocreate inherently safer designs and operating plants thattend towards zero defects. A more immediate develop-ment could be the use of online hazard reviews for thetraining of operators for abnormal situation manage-ment. The online hazard models can also be adaptedfor fault diagnosis applications.The application of theintelligent systems framework for complex problemssuch as process hazards analysis, which were formerlysolved only by human teams, has come a long waysince its modest beginning in the 1980s. Intelligent

systems are now well poised to make significant contri-butions to PHA in real-life industrial settings thusimproving the quality of the analyses while reducing thetime and effort involved.

Acknowledgements

The lead author gratefully acknowledges the Na-tional Institute of Occupational Safety and Healthwhich supported this work in part through the grantR01 OH03056. He is also grateful to Messrs FredDyke, Scott Stricoff and David Webb of the Arthur D.Little, Inc., Cambridge, MA, Jonanthan Vinson, AnandJanardhan, Prabir Basu of G.D. Searle, a Monsantocompany, Malcolm Preston and Alistair Struthers ofthe Imperial Chemical Industries, UK, for their techni-cal and financial support.

References

Bureau of Labor Statistics (1998). Occupational injuries and illnessesin the United States by industry. Washington, DC: GovernmentPrinting Office.

Catino, C., & Ungar, L. H. (1995). Model-based approach to auto-mated hazard identification of chemical plants. American Instituteof Chemical Engineering Journal, 41(1), 97–109.

Center for Chemical Process Safety (CCPS) (1985). Guidelines forhazard e6aluation procedures. New York: American Institute ofChemical Engineering.



Dimitradis, V. D., Shah, N., & Pantelides, C. C. (1997). Model-basedsafety verification of discrete/continuous chemical processes.American Institute of Chemical Engineering Journal, 43(4), 1041–1059.

EPA 40 CFR Part 68 (1995). Risk management programs for chemicalaccident pre6ention pro6isions. Washington, DC: EnvironmentalProtection Agency.

Faisal, I. K., & Abbasi, S. A. (1997). TOPHAZOP: a knowledge-based software tool for conducting HAZOP in a rapid, efficientyet inexpensive manner. Journal of Loss Pre6ention in ProcessIndustries, 10(5–6), 333–343.

Freeman, R. A., Lee, R., & McNamara, T. P. (1992). Plan HAZOPstudies with an expert system. Chemical Engineering Progress,88(8), 28–32.

Instrument Society of America (ISA) (1995). ISA-S88.01, batch con-trol, part 1: models and terminology.

Karvonen, I., Heino, P., & Suokas, J. (1990). Knowledge-based ap-proach to support HAZOP studies. Technical Research Center ofFinland: Research Report.

Kletz, T. A. (1986). HAZOP & HAZAN notes on the identificationand assessment of hazards. Rugby, UK: The Institution of Chem-ical Engineers.

Kletz, T. A. (1988). What went wrong? — case histories of processplant disasters (2nd ed., pp. 189–196). Houston, TX: Gulf Pub-lishing Chapter 18.

Kletz, T. A. (1991). Incidents that could have been prevented byHAZOP. Journal of Loss Pre6ention in the Process Industries, 4,128–129.

Knowlton, R. E. (1989). Hazard and operability studies: the guideword approach. Vancouver: Chematics International Company.

Lees, F. P. (1996). Loss pre6ention in the process industries: hazardidentification, assessment and control (2nd ed.). UK: Butterworth-Heinemann.

McGraw-Hill Economics (1985). Sur6ey of in6estment in employeesafety and health. New York: McGraw-Hill.

Mylaraswamy, D., Kavuri, S. N., & Venkatasubramanian, V. (1994).A framework for automated de6elopment of causal models for faultdiagnosis. San Francisco: American Institute of Chemical Engi-neering Annual Meeting.

Nagel, C. J. (1991). Identification of hazards in chemical processsystems. Ph.D. Thesis. USA: Massachusetts Institute ofTechnology.

National Safety Council (1999). Injury Facts 1999 Edition. Chicago:National Safety Council.

OSHA (1992). Process safety management of highly hazardous chemi-cals; explosi6es and blasting agents; final rule, 29 CFR 1910.119.Federal Register, February 24, pp. 6356–6417.

Parmar, J. C., & Lees, F. P. (1987a). The propagation of faults inprocess plants: hazard. Reliability Engineering, 17, 277–302.

Parmar, J. C., & Lees, F. P. (1987b). The propagation of faults inprocess plants: hazard identification for a water separator system.Reliability Engineering, 17, 303–314.

Peterson, J. L. (1981). Petri net theory and the modeling of systems.New Jersey: Prentice-Hall.

Preston, M. L., & Turney, R. D. (1991). The process systems contri-bution to reliability engineering and risk assessment. Proceedingsof COPE-91, Barcelona, Spain: Elsevier, pp. 249–257.

Skelton, B. (1997). Porcess safety analysis: an introduction. Houston:Gulf Publishing.

Srinivasan, R., Dimitradis, V. D., Shah, N., & Venkatasubramanian,V. (1998). Safety verification using a hybrid knowledge-basedmathematical programming framework. American Institute ofChemical Engineering Journal, 44(2), 361–371.

Srinivasan, R., & Venkatasubramanian, V. (1998a). AutomatingHAZOP analysis of batch chemical plants: Part I. The knowledgerepresentation framework. Computers & Chemical Engineering,22(9), 1345–1355.

Srinivasan, R., & Venkatasubramanian, V. (1998b). AutomatingHAZOP analysis of batch chemical plants: Part II. Algorithmsand application. Computers & Chemical Engineering, 22(9), 1357–1370.

Stephanopoulos, G., Henning, G., & Leone, H. (1990a).MODEL.LA: a modeling language for process engineering. I. Theformal framework. Computers & Chemical Engineering, 14(8),813–846.

Stephanopoulos, G., Henning, G., & Leone, H. (1990b).MODEL.LA: a modeling language for process engineering. II.Multifaceted modeling of processing systems. Computers & Chem-ical Engineering, 14(8), 813–846.

Suh, J. C., Lee, S., & Yon, E. S. (1997). New strategy for automatedhazard analysis of chemical plant. Part 1 & 2. Journal of LossPre6ention in the Process Industries, 10(2), 113–134.

Turk, L. A. (1999). E6ent modeling and 6erification of chemical processusing symbolic model checking. Ph.D. Thesis. USA: CarnegieMellon University.

Turney, R. D., & Ruff, M. F. (1995). Improving safety, health andenvironmental protection on existing plants: process hazards re-view. Proceedings of the Eighth International Symposium on LossPre6ention and Safety Promotion in the Process Industries (PP.93–105). Antwerp, Belgium.

Vaidhyanathan, R., & Venkatasubramanian, V. (1995). Digraph-based models for automated HAZOP analysis. Reliability Engi-neering & System Safety, 50(1), 33–49.

Vaidhyanathan, R., & Venkatasubramanian, V. (1996). A semi-quan-titative reasoning methodology for filtering and ranking HAZOPresults in HAZOPExpert. Reliability Engineering & System Safety,53, 185–203.

Venkatasubramanian, V., & Vaidhyanathan, R. (1994). A knowledge-based framework for automating HAZOP analysis. AmericanInstitute of Chemical Engineering Journal, 40, 496–505.

. HAZOPExpert: a model-based expert system for HAZOP analysis.American Institute of Chemical Engineering Spring NationalMeeting, Atlanta.

Viswanathan, S., Johnsson, C., Srinivasan, R., Venkatasubramanian,V., & Erik, A. K. (1998a). Automating operating proceduresynthesis for batch processes: part I. Knowledge representationand planning framework. Computers & Chemical Engineering,22(11), 1673–1685.

Viswanathan, S., Johnsson, C., Srinivasan, R., Venkatasubramanian,V., & Erik, A. K. (1998b). Automating operating proceduresynthesis for batch processes: part II. Implementation and appli-cation. Computers & Chemical Engineering, 22(11), 1687–1698.

Viswanathan, S., Zhao, J., & Venkatasubramanian, V. (1999). Inte-grating operating procedure synthesis and hazards analysis au-tomation tools for batch processes. Computers & ChemicalEngineering, Supplement, S747–750.

Waters, A., & Ponton, J. W. (1989). Qualitative simulation and faultpropagation in process plants. Chemical Engineering Research &Design, 67(4), 407–422.

Zhao, J., Viswanathan, S., Venkatasubramanian, V., Vinson, J., &Basu, P. (1998). Automated process hazard analysis of batch chem-ical plants. American Institute of Chemical Engineering AnnualMeeting, Miami:, USA.

Zhao, J., Viswanathan, S., & Venkatasubramanian, V. (2000a). In-dustrial applications of intelligent systems for operating proceduresynthesis and hazards analysis for batch process plants. Computer-Aided Chemical Engineering 8 (ESCAPE-10 Proceedings), 787–792.

Zhao, J., Viswanathan, S., Zhao, C., Mu, F., & Venkatasubrama-nian, V. (2000b). Computer-integrated tools for batch processdevelopment. 7th International Symposium on Process SystemEngineering (PSE 2000), Keystone, Colorado, USA.


Documents

Intelligent systems for HAZOP analysis of complex process