What is CHAZOP?
To understand the weaknesses of a control system and its potential for failure, a number of steps may be required. Each of these steps can be termed CHAZOP, although the term CHAZOP is most commonly applied to the second step:
- Calculate a predicted failure rate for the control system, using FMEA/FMEDA.
- Perform a workshop study to assess the risks and impact of a control system failure on the process, using a What-If/Checklist style approach.
- Perform software criticality analysis on the application software implemented in the control system.
- Perform human factors analysis to find opportunities to optimize the interaction efficiency between operators and the control system.
- Perform cyber security assessment to understand the vulnerability of the control system to attack.
- All these results can then feed into RAMS, giving you a complete picture of plant availability.
What does a CHAZOP study entail?
A CHAZOP workshop study is a deep dive into the detailed workings of the control equipment, looking for any potential points of failure, especially single-point failure. Aspects to be considered include power supplies, hardware failure, software bugs, human factors, maintainability, non-normal operating conditions, and diagnostics, among others. In each case, the team asks the questions:
- What can go wrong?
- If it goes wrong, what is the potential impact on the process? (This often requires input from a previous HAZOP study.)
- What protective measures are in place to avoid or mitigate the consequences?
- What further action or study is required?
The CHAZOP report shows all the cases considered, and lists prioritized actions for improvement or further study.
Case Study: Gas Metering Plant
In a recent CHAZOP study performed by the xSeriCon team, a client desired to perform a study to find vulnerabilities in the control system of a gas metering plant. The study was commissioned following a trip incident caused by a hardware maintainability problem, which led to shutdown of a gas-fired power station nearby.
The study found a number of unexpected issues for further investigation, including:
- Trip of a specific circuit breaker in a third-party facility some distance away could cause loss of supply from the metering station.
- Fault behaviour of the diagnostics in the on-site UPS was unknown, and could potentially lead to a spurious shutdown.
- The impact of loss of utility supply (instrument air and hydraulic pressure) to a critical control valve was not well understood and, again, could lead to a shutdown.