botminds.aiRequest a demo
WorkflowHSE, Process Safety & OT Security

PHA Revalidation

PHA revalidation prep that pins the history since the last study to its nodes, tests each closed recommendation, and leaves the rows to the team.

See the demoBook a demo
Follow session four from 08:02 to 09:22 ↓
The problem

The weeks before a PHA revalidation go on finding what changed

The study itself happens in a room, with people who know the unit. The prep does not. Someone has to pull the change records, incident reports, new drawing revisions and tracker items since the last study, out of five systems that do not talk to each other, and mark each one against the old node list by hand.

Then the tracker is taken at its word. A closed recommendation stays closed, even when the order behind it was canceled before the last study met, and the team reviews the old worksheet with the history in a separate binder.

Built forHazard study facilitatorsProcess safety managersProcess engineersSenior board operatorsInternal auditors

The Problem Today

Changes and incidents since the last hazard study are found by hand, and closed actions are simply trusted.

5 years
at the most between studies, with no extensions published
175 h
to find and map one unit's records by hand, our sum our estimate

Gathered by hand today

  • Changes
  • Incidents
  • Drawings
  • Actions
  • Closed on paperA work order can be canceled after the action closes
  • History left outsideThe room reads the old rows, not what came after

The Solution

  1. Gather five systemsChanges, incidents, documents and actions since the last session
  2. Pin to each nodeBy tag and drawing; unsure records go to the facilitator
  3. Test each closureEach closed action read against its work order and drawing
  4. Ask, never writeWhere history has no row, one question for the team, with sources

Built-in controls

  • People write and rank each scenario
  • Agents credit no safeguard
  • Second person opens what they sign

What You Get

The team walks in with the history under each node, and spends its days judging instead of hunting.

155 h
of finding and mapping saved on one unit, our sum our estimate
  • A report from signed contentAssembled only from what people decided
  • Five-year clockEach unit and its limit on one view
  • No credit for what is not thereA safeguard that was not built cannot be credited
One session morning, by the clock

A PHA revalidation session reaches node 12, fuel to the burners

The hydrogen plant's study is due again, and session four of twelve reaches the reformer furnace. Under node 12 sit three records the old study never met.

demoSample data throughout: the refinery, its people and its figures.

  1. 0108:02

    200 records since the last study, pinned under 41 old nodes

    Hazard study facilitator

    At 08:02 the five systems were read again and nothing new came back. The wall lays out the old study's nodes by plant section, with 96 changes, 17 incidents, 58 updated documents and 29 recommendations pinned where their tags and drawings put them. Across the top: node 12 next, one question, 133 days before the limit.

  2. 0208:55

    A fuel change whose hazard review found no new hazard

    Hazard study facilitator

    The first slip is the change that moved trim fuel from pipeline natural gas to the refinery fuel gas header, closed 12 weeks after the old study. Its hazard review reads: same burners, same header pressure, no new hazard. The marked passage shows what it left out: the burner data sheet was missing from its list of updated documents.

  3. 0308:58

    Flames on row 3 tubes, and the arch alarm stayed silent

    Hazard study facilitator

    The near miss came the next spring. Rich fuel gas reached the trim tips and flames touched row 3 tubes for 11 minutes, with the hottest tube at 1,742°F against a 1,715°F survey limit. The lab sample put the gas 23% over burner design. Row 3 air registers had been locked at 60% five months before, and the arch alarm did not sound.

  4. 0409:01

    An arch trip closed on a work order nobody ever worked

    Hazard study facilitator

    Third comes a recommendation raised after an earlier overfiring upset: add an independent high arch temperature trip. In the tracker it shows closed, with a work order as its evidence. The closure test says that order was canceled, no trip was ever built, and the last study took the closure as done. By hand, work orders get opened one at a time, so most closures go untested.

  5. 0509:04

    No old row covers rich trim fuel, so the agent asks one question

    Hazard study facilitator

    Node 12 shows six of its 14 old rows. Two carry red flags: one leans on the arch alarm that did not sound, the other on flame scanners fitted only to the end burners. The question card shows how the agent got there: rows read, three records pinned, no covering row, one question for the facilitator, and no scenario.

  6. 0609:07

    The team ranks the new row 4×3, then tries to credit the arch trip

    Study team

    With the facilitator, a process engineer and the board operator checked in, the team picks Other than, writes the cause and consequence in its own words, and ranks the row severity 4, likelihood 3. When someone lists the arch trip as a safeguard, the form refuses it: never built, citing the recommendation. Typing the bare tag, or calling it the independent arch trip, gets the same refusal.

  7. 0709:10

    A red row leaves the room with an action and an interim measure

    Hazard study facilitator

    Saved with a safeguard people do perform, the row lands in the red, so the form asks for an action, an owner, a written date and an interim measure. The team names a fuel gas quality analyzer with a high alarm, and a row 3 burner round each shift until then. The work needs an outage, so the date moves to the next planned one.

  8. 0809:19

    The drawing the checker opens shows an alarm and no trip

    Process safety manager

    The facilitator proposed reopening the trip's closure the day before. Countersign stays locked until the process safety manager has opened all three pieces of evidence in person: the tracker entry, the canceled work order and the current drawing. On the drawing revision the passage is marked. The arch carries the alarm only, and the trip's tag appears nowhere on the sheet.

  9. 0909:22

    Reopened by two people, and the trip blocked from credit in any row

    Process safety manager

    With all three records open, the countersign goes on. The closure now reads reopened, proposed by the facilitator and signed by the manager. It moves back to still open with an action for its owner, and the trip cannot be credited in any row until the work is done and the closure passes again. On the report, four of the six failed closures still wait for a ruling.

A canceled order, a missing data sheet and rows that lean on a silent alarm

Found on one unit before the team sat down.

Closed, but not there

6 of 41 closures failed the evidence test: three on canceled work orders, two on documents that do not say it, one on a withdrawn change.

Old rows that lean on what failed

On node 12, one old row credits the arch alarm that stayed silent in the near miss, another the flame scanners on the end burners only.

A change review that skipped the data sheet

The trim fuel change updated a relief check, a drawing and a firing procedure, and called it no new hazard. The burner data sheet was not on the list.

Open recommendations past their date

18 of 23 open recommendations are past their written date, and a report gate counts them before anyone can propose sign-off.

demoSample data, from the working solution.

Around the session

The rest of the PHA revalidation, screen by screen

Further along on the same unit, from the canceled order to the audit trail.

The canceled work orderRaised to install the trip, then canceled for scope cut, no outage window. No hours booked, no materials issued, and no later order names the tag.
What waits for the checkerA closure ruling, two new actions and the team's new row wait for the process safety manager. Each one has to be opened before it can be signed.
Eleven gates before sign-offTen are still open at session four, including 18 of 23 open recommendations past their date. Sign-off stays closed and says why.
Questions the old study never metNine across the unit, each with its records: a purge timer on a temporary bypass, boiler water on the shift catalyst, the PSA running on eight of ten beds.
Carrying 316 old rows forwardThe largest decision in the study. Twelve rows drawn across the plant wait for the process engineer or board operator to read before anyone can propose it.
The morning, minute by minuteRecords opened, the question put, the team's row, the proposal and the countersignature, each with a name. No line can be altered.

demoSample data, from the working solution.

175 hours of PHA revalidation prep by hand against 20 of checking

Our estimate for one unit. Finding and mapping is different work from checking, and the 20 hours are the facilitator's alone.

96 changes at 45 minutes each72.0 h
17 incidents at 90 minutes each25.5 h
58 updated documents at 30 minutes each29.0 h
64 recommendations at 45 minutes each48.0 h
Finding and mapping by handAbout 175 hours174.5 h
Checking what the agents found200 records at 3 minutes, plus placements, questions, closures and the reportAbout 20 h
Saved on one unit465 hours a year at 3 units a year155 h

estimatedOur estimate.

The rows, the credit and the rulings stay with the study team

These calls belong to named people.

People write each scenarioThe question card holds no cause, consequence, safeguard or ranking. The facilitator types what the room agrees, and the form has no fill button.
No credit for what is not thereA safeguard never built, part built, failed on demand, bypassed, temporary or out of date is refused by name or tag, citing its record.
Two people rule on a closureThe closure tester neither reopens nor closes. The facilitator proposes; the manager opens each record, then countersigns.
Old rows carry forward on a read sampleSomeone who knows the unit reads a drawn sample, then the manager signs. A row that does not hold goes back to the team.
The report waits for its gatesSign-off stays closed while a gate is open: disputes, pulled rows, overdue recommendations or a red row without a live action.
The agents

Six agents prepare the room, and none of them writes a row

What each agent may do, and the line where it stops.

History gatherer

Reads five systems for what changed since the last session.

  • Never changes a source system
Node matcher

Places each record on a node by its tags and drawings.

  • Never places a record below the confidence floor without the facilitator
Closure tester

Tests each closed recommendation against its work order and the current drawing.

  • Never reopens or closes
Gap questioner

Finds history with no matching row and puts one question to the team, with its records.

  • Never writes a cause, consequence, safeguard or ranking
  • Never credits a safeguard
Record finder

Shows a record in the room on request.

  • Keeps no notes
  • Writes nothing into a row
Report assembler

Assembles the revalidation report from signed content only.

  • Adds no finding
  • Never signs

Questions facilitators raise before trusting PHA revalidation prep

What is PHA revalidation?

PHA revalidation is the periodic update of a process hazard analysis to match the plant as it now runs. This solution prepares it: agents pin the changes, incidents, updated documents and recommendations since the last study to the old nodes and test each closure. The team writes and ranks the rows.

What do PHA revalidation requirements ask the team to review?

The published reading of the rule asks an update to check that changes went through change management and are in the study, and that process safety information is current. Procedures must be adequate, past recommendations dealt with, and all incident investigation reports reviewed. Each of those sources becomes a slip under a node here.

How often must a PHA be updated?

At least every five years, with no extensions, and a shutdown does not stop the clock. The rule counts from completion of the prior study without defining it, so here a site rule sets the start: the date on the study report.

Does it write HAZOP revalidation scenarios?

No. Where history has no matching row, the agent writes a question with its records. The facilitator opens them before putting it to the team, the team writes and ranks the row, and the process safety manager opens the records before accepting it.

What happens when a closed recommendation fails the evidence test?

The closure tester shows the tracker, the maintenance system and the drawing side by side and leaves the ruling to people. A reopening is proposed by the facilitator, and the process safety manager countersigns only after opening each record. The item moves back to still open with an action, and its safeguard cannot be credited in any row.

Can old rows that nothing touched carry forward as they are?

Only after a drawn sample is read by the process engineer or board operator. A row that does not hold goes back to the team. The facilitator then proposes the carry-forward, and the manager opens each row before signing.

HSE, Process Safety & OT Security

More for process safety teams

All 10 solutions →
Learning from Incidents

Past incidents gather around the job, and you see which fixes really held.

1-min demoCompetence Assurance

Seats filled with people fit for the whole hitch before the manifest closes.

1-min demoOT Cybersecurity Compliance

One proof answers every rule it truly meets, and practice is tested against policy.

1-min demo

Bring one unit's last study
and the five years since.

We'll pin your own changes, incidents and tracker items to your old nodes and test the closures with you.

Book a demoBrowse solutions