Process Hazard Analysis for Ammonia Systems: HAZOP vs. What-If Methodology

The Process Hazard Analysis is OSHA PSM's most demanding intellectual requirement. It's not a checklist or a form — it's a structured, team-based examination of how an ammonia refrigeration process can deviate from its intended design and what those deviations could mean for worker safety and process integrity. Getting it right matters enormously: a superficial PHA that misses significant hazards is arguably worse than no PHA, because it creates documented false assurance.

OSHA 1910.119(e) specifies several acceptable PHA methodologies, but for ammonia refrigeration systems, two dominate: HAZOP (Hazard and Operability Study) and What-If analysis. Understanding when each is appropriate, how to conduct either one rigorously for a refrigeration system, and what OSHA expects to see in the documentation is the focus of this post.

What OSHA Requires From a PHA

Before comparing methodologies, it's useful to be precise about the regulatory requirements. OSHA 1910.119(e)(1) mandates that the PHA address:

• The hazards of the process
• The identification of any previous incident which had a likely potential for catastrophic consequences
• Engineering and administrative controls applicable to the hazards and their interrelationships
• Consequences of failure of engineering and administrative controls
• Facility siting (location of the process relative to occupied areas)
• Human factors
• A qualitative evaluation of a range of the possible safety and health effects of failure of controls on employees in the workplace

The regulation also requires (1910.119(e)(3)) that the PHA team include at minimum one employee with expertise in engineering and process operations, and one employee who has experience with and knowledge of the process being evaluated. For ammonia refrigeration, this means the team must include people who actually operate the system — not just engineers reviewing it from a distance.

HAZOP: Structured Deviation Analysis

HAZOP is a highly structured methodology that examines process deviations using a defined set of guide words applied to process parameters. The guide words — No/Less/More/Reverse/As Well As/Part Of/Other Than — are combined with parameters (Flow, Pressure, Temperature, Level, Composition) to generate specific deviation scenarios for systematic examination.

For example, in a HAZOP of an ammonia recirculation system low-pressure receiver:

• No Flow on the liquid supply line: What happens if no ammonia feeds to the evaporators? (Compressor runs down, potential loss of refrigeration)
• More Level in the receiver: What happens if level rises above design high level? (Liquid carryover to compressor suction — catastrophic consequence)
• Less Pressure in the receiver: What happens if suction pressure drops below normal? (Potential for liquid flash in suction line, impacts compressor inlet conditions)
• More Temperature in the suction gas: What causes superheating beyond normal? (What are the consequences for compressor discharge temperature and oil condition?)

For each deviation, the team examines causes, consequences, existing safeguards, and whether those safeguards are adequate. Where they are not, the team documents a recommendation.

HAZOP Node Development for Refrigeration Systems

The foundation of a HAZOP is the node structure — dividing the system into segments (nodes) that have coherent process intent and defined operating parameters. For an ammonia refrigeration system, a typical node structure might include:

• High-side condensing section: Compressor discharge through condenser to high-pressure receiver
• High-pressure receiver: Vessel with associated controls and relief devices
• High-pressure liquid distribution: Liquid line from receiver to expansion devices
• Each evaporator circuit or zone: Expansion device, evaporator coil(s), suction header
• Low-pressure receiver/accumulator: Including level controls, recirculation pump(s), and relief devices
• Low-side suction header: From low-pressure receiver to compressor suction
• Compressor package(s): Including capacity controls, safety shutdowns, oil system, and economizer if applicable
• Utility systems: Defrost system, purger, oil drains, pump systems

Each node requires a P&ID excerpt with defined study boundaries (process inlet and outlet conditions documented), and the HAZOP examination covers all parameters relevant to that node's function.

When HAZOP Is the Right Choice

HAZOP is the preferred methodology for:

• Large, complex systems with multiple interacting components and control loops
• Systems where subtle control interactions can lead to hazardous conditions — a recirculation system with multiple evaporator circuits, automated defrost, and complex compressor staging qualifies
• New system design review before commissioning, where the P&ID is the study object
• Facilities subject to high regulatory scrutiny where the depth and rigor of the analysis may be closely examined

The limitation of HAZOP is resource intensity. A thorough HAZOP of a large ammonia refrigeration system with multiple compressors and dozens of evaporator circuits may require 40 to 80 hours of team time — multiple sessions over several days. For smaller or simpler systems, that level of investment may not be proportionate.

What-If Analysis: Structured Brainstorming

What-If analysis takes a less rigidly structured approach. The team develops questions beginning with "What if..." and examines each for hazards, consequences, and safeguard adequacy. A good What-If session for an ammonia system might include questions like:

• What if the condenser fan motors fail on a hot summer day?
• What if the operator overfills the high-pressure receiver during refrigerant addition?
• What if the hot gas defrost solenoid sticks open?
• What if power fails to the machinery room during a large heat load?
• What if ammonia is released inside the machinery room and the ventilation system fails to activate?
• What if a contractor inadvertently opens the wrong valve during maintenance?

The questions can be organized by system section, by initiating event type (equipment failure, utility failure, human error, external events), or by consequence category (release, overpressure, liquid carryover). The organization matters less than ensuring comprehensive coverage.

What-If Checklists

For ammonia refrigeration specifically, What-If analysis is frequently combined with a checklist to ensure coverage of standard refrigeration hazard categories. IIAR provides guidance on relevant hazard categories, and experienced practitioners develop facility-specific checklists that address:

• Pressure excursions (loss of condensing, blocked discharge)
• Low-pressure conditions (loss of charge, valve failure)
• Liquid carryover scenarios
• Release scenarios (seal failure, pipe failure, vessel failure)
• Utility loss scenarios (power, cooling water, instrument air)
• Human error scenarios (valve misoperation, overfilling)
• Maintenance and start-up scenarios

When What-If Is the Right Choice

What-If is appropriate for:

• Smaller or simpler systems where the full structure of HAZOP is disproportionate
• PHA revalidations of well-studied systems where the goal is to identify what has changed and whether new hazards have been introduced, rather than comprehensively re-examining every element
• Section-level analysis when a specific portion of a larger system is being modified and needs focused review
• Facilities newer to the PHA process where HAZOP's structured guide word approach may create unnecessary complexity before the team has developed PHA proficiency

Team Composition: Who Must Be in the Room

The regulatory minimum — one engineering expert and one process-experienced employee — sets a floor, not a ceiling. An effective PHA team for an ammonia refrigeration system should include:

• Lead facilitator: An experienced PHA facilitator who understands HAZOP or What-If methodology. The facilitator's job is process management, not technical expertise — ensuring systematic coverage, keeping the team on track, and capturing findings accurately.
• Process engineer: Someone with deep knowledge of refrigeration engineering — heat transfer, thermodynamics, control systems.
• Operations representative: An experienced operator who knows how the system actually behaves in practice, including non-standard conditions and workarounds. This is the employee participation requirement made real.
• Maintenance representative: A technician who understands equipment failure modes, common maintenance activities, and where the system has historically had problems.
• Safety or PSM coordinator: To ensure regulatory requirements are addressed and findings are captured in the required format.

For larger systems, additional specialists may join for specific sessions — an electrical/controls engineer for the automation node, a contractor representative for a recently installed section.

PHA Revalidation Every Five Years

OSHA 1910.119(e)(6) requires that each PHA be updated and revalidated at least every five years following the initial PHA. This is not an optional schedule — facilities that allow the revalidation to lapse are in violation, and OSHA inspectors check revalidation dates as a matter of routine.

Revalidation has a specific regulatory meaning: it is not simply a review of whether prior recommendations were implemented (though that is part of it). Revalidation requires that the PHA methodology be applied to the process as it currently exists, capturing all changes since the last study and reexamining the hazard landscape with fresh eyes.

A revalidation approach that simply checks off prior findings without genuinely reexamining the process — particularly if the system has been modified since the last study — will not satisfy the regulatory standard or provide real safety value.

The revalidation record must document:

• The date of the revalidation
• The methodology used
• The team members
• A summary of changes since the prior PHA
• All new findings and their resolution status
• Confirmation that prior findings were addressed (or explanation if not)

What OSHA Looks for in PHA Documentation

OSHA inspectors reviewing PHA documentation look for evidence of genuine analysis, not checkbox compliance. Specific things they examine:

• Date of the most recent revalidation relative to the five-year requirement
• Team roster — was an experienced operator included? Was the facilitator qualified?
• Coverage of the P&ID — do the nodes in the PHA cover the full scope of the process, including relief devices, control systems, and utility connections?
• Finding documentation — are recommendations specific and actionable, or vague ("improve procedures" without specifying what)? Is there a finding number tied to a tracking system?
• Resolution of findings — for each recommendation from the current and previous PHA cycle, is there a documented resolution: either implementation of the recommendation or a documented rationale for rejection?
• Incident and near-miss integration — does the PHA team's work reflect lessons from any incidents that occurred since the last study?

A red flag that regularly draws scrutiny: a PHA where all findings are marked "acceptable risk" with no recommendations. In a real hazard analysis of an ammonia refrigeration system, a trained team will always generate recommendations — the absence of them suggests the analysis wasn't conducted in good faith.

Tracking and Resolving PHA Findings

Every finding the PHA team generates must be entered into a tracking system and driven to resolution. The resolution options are:

• Implement the recommendation (and document what was done and when)
• Reject the recommendation with documented rationale (the team determined the existing safeguards are adequate, and that determination must be supported by reasoning, not simply asserted)
• Assign to further study (for technically complex issues requiring engineering analysis before a decision can be made — this must have a due date)

The tracking system connects directly to the Management of Change process: if a PHA recommendation results in a physical change to the system, that change requires an MOC before implementation.

Under 1910.119(e)(5), findings and recommendations from PHAs must be resolved and communicated to operating, maintenance, and other employees whose work assignments are in the process. This communication requirement is frequently inadequately implemented — a PHA recommendation that drives a procedure change doesn't satisfy the standard unless the affected operators were actually told about the change and its rationale.

---

Questions about PHA methodology, revalidation scheduling, or finding resolution for your ammonia facility? Contact NH3Edge for a consultation.