Surveyors spend a lot of time near hazards without being the people who study them. We position rigs next to live platforms, survey pipelines that carry gas under pressure, and mark routes where excavators will dig. HAZOP and HAZID studies are usually something the process and safety engineers do in a meeting room, and the surveyor reads the action list afterwards. I joined a HAZOP and HAZID training to see that work from the inside. The course covered risk management basics, process safety, hazard identification methods and worked case studies on an onshore gas receiving facility. This article is my summary of what I took from it, written from a surveyor's point of view. The course material belongs to the organiser, so this is my own understanding rather than a copy of the slides. Client, facility and trainer details are left out. Start with the words The first useful thing was getting the vocabulary straight, because people mix these words up all the time: - A hazard is something with the potential to cause harm: gas under pressure, a heavy load, work at height. - A threat is what can release the hazard: corrosion, overpressure, human error, a digger hitting a pipe. - The top event is the moment control is lost, such as a loss of containment. - A consequence is the worst outcome that follows: fire, explosion, injury, pollution, damage, loss of reputation. - Risk combines how likely the event is with how severe the consequence would be. The course grouped consequences under four headings: people, environment, assets and reputation, often shortened to PEAR. Every hazard is judged against all four, not just against injuries. People safety and process safety The course drew a clear line between two kinds of safety. People safety is about the individual at work: personal protective equipment, safe behaviour, ergonomics, training and emergency response. It is what most of us think of when we hear "HSE". Process safety is about preventing major accidents involving hazardous materials and processes: fires, explosions and large releases. Its tools are design, engineering controls, safety instrumented systems, emergency shutdown, and structured studies such as HAZID and HAZOP. A site can have an excellent personal safety record and still have a weak process safety position. Low injury numbers do not prove that the pipeline will not leak or the vessel will not overpressure. That was one of the main messages of the course. Barriers, Swiss cheese and the bowtie Two pictures came up again and again. The Swiss cheese model shows each safeguard as a slice of cheese with holes in it. Design, procedures, alarms, inspections and training are all slices. No slice is perfect, and an accident happens when the holes line up. The point is not to find a perfect barrier, but to have enough independent ones that the holes rarely line up. The bowtie puts the top event in the middle. On the left are the threats that could cause it, each with control barriers that stop the threat from reaching the top event. On the right are the consequences, each with recovery barriers that limit the damage once control is lost. It is a simple way to see whether a hazard is protected on both sides, or whether everything depends on one barrier. ALARP and residual risk No real facility is risk-free. The course explained ALARP, "as low as reasonably practicable": a risk is acceptable when the cost of reducing it further is grossly out of proportion to the benefit. Showing ALARP means documenting the options considered, why some were adopted and others not, and how the remaining risk compares with the company's tolerance. What remains after the barriers are in place is the residual risk. One point stayed with me: control and recovery barriers reduce the likelihood or the outcome, but they do not remove the hazard itself. The gas is still under pressure. If a barrier is removed or fails, the risk goes back up. The hierarchy of controls The preferred order for dealing with a hazard is: - Eliminate it, completely or partly. - Substitute something less hazardous, for example an electric drive instead of a diesel engine in a gas plant. - Engineer it out, with a design that is inherently safer. - Control it administratively, with procedures and permits. - Use personal protective equipment as the last line. Procedures and PPE are at the bottom because they depend on people doing the right thing every time. That is worth remembering when a method statement relies entirely on "the crew will be careful". Why pipelines fail For a surveyor this was the most directly relevant part. Pipeline failure causes were grouped in three ways: - Time-dependent: external corrosion, internal corrosion and stress corrosion cracking. - Stable: manufacturing defects, welding and fabrication defects, and equipment. - Time-independent: third-party or mechanical damage, incorrect operation, and weather and outside forces. Third-party damage is where survey work makes a real difference. An accurate as-built position, a clear route survey, good marker posts and correct location data given to anyone who plans to dig are all barriers against someone hitting a pipeline by mistake. Weather and outside forces include ground movement, and that connects to settlement and subsidence monitoring. HAZID: hazards by area and activity HAZID is a structured brainstorm to list the hazards of a facility or an activity, usually early in a project. The method we practised was: - Divide the project into nodes, meaning areas or activities small enough to review properly. - State what each node is meant to do. - Work through a list of guidewords, chosen from an industry standard and adapted to the project, to prompt each type of hazard. - For each hazard, record the causes and consequences, first without any safeguards. - Record the existing safeguards, rank the risk on a matrix, and recommend extra safeguards where the risk is not acceptable. The inputs are the layout, plot plan, piping and cable routing, the process and utility flow diagrams, hazardous area classification, escape routes and fire protection layouts, and the risk matrix. The case study was a HAZID for the construction of a liquid separator inside an existing gas receiving facility. Construction next to live plant is exactly the kind of work where a survey crew is on site. HAZOP: deviations from design intent HAZOP is more detailed and is done on the piping and instrumentation diagrams. Each node is a section of the process. The team picks a parameter such as flow, pressure, temperature or level, applies a guideword such as more, less, no or reverse, and asks what could cause that deviation and what would happen. The worksheet records causes, consequences, safeguards and recommendations for every deviation. The worked example was a pig receiver at an onshore receiving facility. The questions are simple and powerful: what can cause high pressure here, what happens if the pressure control valve fails to close, and how severe would a vessel rupture be. The discipline of asking the same questions for every node is what makes HAZOP thorough. The exercises The practical exercises were the best part. One looked at a fire water system that was out of service because ground subsidence had forced a main line flange to be separated. We had to identify the threats, consequences, control and recovery measures, rank the risk and propose a remedial action plan. Others covered pipeline welding and excavation for pipeline installation. The subsidence case was a reminder that ground movement is not just a survey statistic. It can quietly disable a safety system. What I took from it - Learn the vocabulary. Hazard, threat, top event and consequence are different things, and mixing them up makes any risk discussion vague. - Judge consequences against people, environment, assets and reputation, not injuries alone. - Look for barriers on both sides of the bowtie. A hazard that relies on one barrier is a weak point. - Procedures and PPE are the last options, not the first. - Survey data is a safety barrier. Accurate as-built positions and clear route information protect pipelines from third-party damage. - Use the HAZOP habit in survey planning. Breaking a job into nodes and asking "what if" for each step is a good way to write a method statement.