HAZOP Explained: Nodes, Guidewords and Deviations

By the Aetso Technical engineering team · Reviewed November 2026 · 9 min read

The Hazard and Operability study — HAZOP — is the most widely used method for systematically identifying hazards in process plants. It was developed in the chemical industry in the 1960s and 1970s, and it remains the method of choice for complex continuous processes because of one powerful idea: instead of asking a team to imagine everything that could go wrong, give them a structured way to generate deviations from the design intent.

The core mechanism

A HAZOP divides the process into sections called nodes. For each node, the team states the design intent, then combines guidewords with process parameters to generate deviations:

For each meaningful deviation, the team records causes, consequences assuming safeguards fail, existing safeguards, a risk ranking and any recommendations. Many studies also use "parameters" such as level, composition, reaction, mixing, and "operational" topics such as startup, shutdown, maintenance, sampling and loss of utilities. You can try combinations on our interactive HAZOP explorer.

Choosing good nodes

Node selection quietly determines the quality of a HAZOP. Nodes that are too large mix several design intents, so deviations become vague and specific causes are missed. Nodes that are too small make the study repetitive and slow. A practical rule is that a node should have a single, clearly stated design intent — for example, "transfer liquid from the feed tank to the reactor at a controlled rate." Major equipment items, changes in operating conditions and changes in composition are natural node boundaries.

Consequences without safeguards

A key discipline is to describe the consequence of a deviation as if the safeguards had failed. Only then can the team judge whether the safeguards are adequate. Teams that write "none — high-level trip prevents overflow" in the consequence column have skipped the analysis that tells them whether the trip is essential, and how reliable it must be.

Safeguards that really count

Not every item listed as a safeguard is effective for the cause in question. Common errors include crediting an alarm from the same transmitter whose failure caused the deviation, crediting a relief valve that is not sized for the scenario, or listing procedures and training as though they were engineered barriers. Where consequences are severe, scenarios are often carried forward to Layer of Protection Analysis for a more rigorous test.

Keeping a HAZOP productive

• Prepare. Verify P&IDs, define nodes and gather data before the sessions start.
• Get the right people. Operations and maintenance knowledge is essential; so is an experienced facilitator and a dedicated scribe.
• Limit session length. Quality falls off sharply with fatigue; shorter, focused sessions are more productive.
• Record as you go. Live recording with the team watching avoids disputes later.
• Don't design in the room. Record what needs to be achieved and leave detailed solutions for engineering follow-up.
• Cover non-routine modes. Startup, shutdown and maintenance are where many incidents occur.

Writing recommendations

A good recommendation states the scenario it addresses, the intent ("prevent overfill of the receiver on loss of level control"), and leaves room for engineering to choose the solution. It should be specific enough that someone can verify when it has been completed.

HAZOP and regulation

OSHA's PSM standard lists HAZOP among acceptable PHA methodologies for covered processes, and requires the PHA to be revalidated at least every five years. Guidance on HAZOP practice is available from CCPS, among others; IEC 61882 is an international standard describing HAZOP application.