SafeGuard ProjectsCapital Projects
OSHA 1910.119Free PSM Resource
A HAZOP is only as good as the team's discipline: one node, one design intent, every guideword, every parameter. Here we run a single node on a real vessel, the steam system pressure vessel that failed at the Loy-Lange Box Company in 2017 and was investigated by the U.S. Chemical Safety Board, and compare what a HAZOP team could have found with what actually happened.
A Hazard and Operability Study breaks a process into nodes. For each node, the team states the design intent, then combines guidewords with process parameters to imagine deviations. For each credible deviation, the team records causes, consequences, existing safeguards, and recommendations.
No · More · Less · As Well As · Part Of · Reverse · Other Than. Combined with a parameter, they create a deviation: "More Pressure," "No Flow," "As Well As Contaminant."
Flow, pressure, temperature, level, composition. Many teams also cover operating modes (startup, shutdown, maintenance) and the integrity of the equipment itself.
A safeguard only counts if it exists, works, and is independent of the cause. A relief valve set above the vessel's rating, or an inspection that never happens, is not a safeguard.
A HAZOP that produces recommendations nobody acts on is paperwork. Tracking each one to closure is where most of the safety value is.
The SCR was a pressure vessel in Loy-Lange's steam system that collected returning condensate and make-up water and fed the steam generator. These are the facts a HAZOP team would gather first. All of them come from the CSB report.
Design intent: Receive deaerated make-up water and returning condensate, hold a stable water level at about 100 psig and 330°F, and supply feedwater to the steam generator, without exceeding 150 psi MAWP and without corroding a vessel built for non-corrosive service.
Seven deviations a team would be expected to raise for this node. The "Existing safeguards" column reflects conditions the CSB documented, and that's where this worksheet gets uncomfortable.
| Deviation | Possible causes | Consequences | Existing safeguards (per CSB) | Recommendations |
|---|---|---|---|---|
| 1. As Well As: dissolved oxygen | Make-up water not fully heated before transfer. Low sulfite dosing. Cooling water re-absorbing oxygen during overnight wet layup. | Oxygen pitting of carbon steel. Vessel has no corrosion allowance, so any wall loss eats into the required thickness. | Weak Sulfite injection, with low scavenger levels recorded in 48 of 88 contractor tests (32 of 34 after 2008). Daily tests logged by hand only. | Set and enforce oxygen scavenger limits. Add extra scavenger at startup per supplier manual. Verify make-up tank temperature before transfer. Trend results and escalate repeat deviations. |
| 2. No Flow: bottom head | Outlet nozzle 1.5 ft above the bottom. Blowdown skipped or infrequent. | Stagnant, oxygen-rich water sits in the bottom head, concentrating corrosion where it can't be seen. | Weak Manual blowdown, rarely done before 2012, weekly after. | Blow down at the frequency the manual specifies, and after each startup. Evaluate a design change to eliminate the dead leg. |
| 3. Less Level: startup | Daily startup draws level from about 14 ft to about 2 ft with make-up isolated and level control in manual. | Large daily batch of make-up water enters at once. If not deaerated, it delivers a daily oxygen load to the vessel. Low level can also starve the feedwater pump. | None written No written startup procedure beyond the generator manual was produced. The CSB relied on interviews. | Write a startup procedure that includes deaeration checks, extra scavenger, level limits, and post-startup blowdown. Train and verify. |
| 4. Less: wall thickness (integrity) | Chronic internal corrosion in a vessel designed for non-corrosive service. | Wall thins below 0.2204 in. Sudden failure of a vessel holding 330°F water at 100 psig causes a BLEVE, blast, and a rocketing vessel. | None No mechanical integrity program, no inspection program, no thickness monitoring. Supplier recommended inspection three times in 2004. | Establish an MI program per NBIC Part 2: internal inspection and UT thickness at defined intervals, a damage mechanism review, and fitness-for-service assessment when thinning is found. |
| 5. Other Than: leak from pressure boundary | Through-wall corrosion. Prior leaks in 2004 and 2012 (two in 2012). | A leak is evidence the wall has already failed somewhere. Continued operation risks catastrophic rupture. | None No criteria to shut down. The vessel ran after leaks in 2004, 2012, and on March 31, 2017. | Any pressure-boundary leak means shutdown, isolation, and inspection before restart. Investigate every leak for root cause. |
| 6. More Pressure | Condensate returning near steam system pressure (the generator ran at about 175 psig in steady state). Vent or back-pressure regulator failure. | Pressure above the 150 psi MAWP. Rupture, especially of a thinned wall. | Invalid Relief valve found set at 200 psi, above MAWP. That doesn't meet ASME or NBIC requirements. | Replace the relief valve with one set at or below MAWP. Verify the relief design basis. Bring relief changes under management of change. |
| 7. Other Than: repair / change | Emergency repair that left original corroded material in place. Undocumented weld repairs. No permits. | Repaired vessel returns to service weaker than it looks. A hydrotest at 110 psig doesn't prove remaining wall thickness. | Weak Repair by an R-stamp holder with an Authorized Inspector who witnessed only the pressure test. No thickness measurement beyond a tape measure. | Require UT mapping before and after any repair. Treat repairs and alterations as changes requiring MOC. Act on the repairer's follow-up advice (Kickham proposed replacing the bottom head in December 2012). |
Deviations 1–7 are illustrative team entries. Facts in the "Existing safeguards" column are from the CSB report. A real HAZOP would also rank risk using the company's risk matrix and cover additional parameters and nodes, such as the make-up tank and steam generator.
Mapping the worksheet to the CSB's findings and its four key issues.
| CSB finding | Worksheet row | Comment |
|---|---|---|
| Oxygen pitting and generalized corrosion thinned the bottom head to 0.012 in at the failure point. | 1, 2, 4 | Caught. The oxygen source, the dead leg, and the missing thickness monitoring all show up. |
| Startup practices likely introduced oxygenated water daily. Water treatment was inadequate. | 1, 3 | Caught, if the team covered startup as an operating mode. Teams that only review steady state miss this. |
| No mechanical integrity or inspection program, despite corrosion known since 2004. | 4 | Caught. The safeguards column is empty, which should stop the review cold. |
| Vessel operated with a known leak before the failure. | 5 | Caught, but only if the team asks "what do we do when it leaks?" as well as "what makes it leak?" |
| The 2012 repair left damaged material in place, and the inspector didn't detect it. | 7 | Partly. A HAZOP can flag weak repair practices. It can't see inside a weld. That takes inspection. |
| Relief valve set at 200 psi, above the 150 psi MAWP. | 6 | Caught. The CSB found insufficient evidence of an overpressure at failure, but a HAZOP should never accept an invalid safeguard. |
| Weak process safety culture and management systems. | — | Not directly. A HAZOP depends on these systems to act on its recommendations. The CSB found no evidence that the supplier's 2004 inspection recommendations were acted on. |
The most important deviation here happened during startup, not steady state. Startup, shutdown, and layup belong in every HAZOP.
A relief valve set above MAWP and an inspection that never happens look like safeguards on paper. A good facilitator asks "show me."
Recommendations need owners, due dates, and closure. Without mechanical integrity and follow-through, even a perfect worksheet changes nothing.
SafeGuard PSM facilitates PHAs and HAZOPs that cover every operating mode, challenge every safeguard, and produce recommendations you can actually close.
Talk to Us Read the Loy-Lange Case Study Incident Investigation ExampleU.S. Chemical Safety and Hazard Investigation Board, Pressure Vessel Explosion at Loy-Lange Box Company, Investigation Report No. 2017-04-I-MO, published July 29, 2022. Final report (PDF) · CSB investigation page
HAZOP is a general, widely published hazard analysis technique. The worksheet entries are SafeGuard PSM's illustrative work. Equipment and incident facts are from the CSB report.