Digital Twins and Artificial Intelligence for HAZOP Enhancement in Process Safety: A Critical Literature Review

1. Introduction

1.1. Motivation: HAZOP in a Dynamic Operating Environment

On 23 March 2005, an explosion at the BP Texas City refinery killed 15 workers and injured more than 180 others, making it one of the deadliest industrial accidents in recent United States history. The investigation by the U.S. Chemical Safety and Hazard Investigation Board (CSB) concluded that the accident involved the overfilling of a raffinate splitter tower during start-up. More importantly, the event reflected a deeper pattern of operational drift, weak learning from previous incidents, and insufficient reassessment of hazards as plant conditions changed over time [1]. Only a few months later, the Buncefield fuel storage terminal explosion in the United Kingdom was triggered by a tank-overfilling event that was not effectively detected or stopped by existing protection layers. The explosion caused widespread damage across the surrounding industrial area and led to a major reassessment of fuel-storage safety, alarm management, and overfill-prevention practices [2,3]. Although the two incidents occurred in different sectors and operating contexts, they point to the same underlying concern: major hazards may evolve gradually during operation, while formal hazard reviews are often conducted only periodically.

This concern is not limited to BP Texas City or Buncefield. Investigations of major process safety events frequently show that serious accidents are rarely caused by a single technical failure. They often emerge from a combination of degraded equipment, weak barrier management, organizational decisions, and deviations from the original design intent. The Macondo blowout, the Chevron Richmond refinery fire, and the IOC Jaipur terminal fire all illustrate how abnormal conditions and safety-critical weaknesses can accumulate over time before becoming visible as major accidents [4,5,6,7]. These examples do not suggest that HAZOP is ineffective. Rather, they highlight a limitation in how HAZOP is commonly applied. In many facilities, HAZOP remains an episodic, design-stage or revalidation activity. This makes it difficult for the method to continuously reflect operational drift, equipment aging, process modifications, changing feedstocks, or emerging abnormal situations between formal review cycles [8,9,10]. Critiques of HAZOP limitations [11] and guidance on revalidation [12] reinforce this concern.

Recent advances in industrial sensing, data infrastructure, computational modeling, and AI-based analytics now make it more realistic to connect process safety knowledge with live operational data. At the same time, many process industries are becoming more instrumented, data-rich, and connected. Real-time sensor networks, industrial artificial intelligence, edge and cloud computing, and Digital Twin platforms are creating new possibilities for monitoring plant behavior continuously rather than relying only on periodic review and manual interpretation [13,14]. Digital Twin platforms in particular offer structured representations of physical assets that can be continuously updated with operational data [15,16]. In parallel, recent work on ontology-based HAZOP automation, process safety knowledge graphs, and natural-language processing shows that parts of hazard identification and safety knowledge management can be supported by computational tools [17,18,19]. These developments create an important opportunity: not to replace HAZOP, whose structured and expert-driven reasoning remains central to process safety, but to extend it beyond the design and revalidation stage. A digitally enhanced HAZOP framework could help compare current plant behavior with design intent, detect emerging deviations, update safety knowledge, and support more timely decision-making during operation.

This review therefore examines how Digital Twin and Artificial Intelligence technologies can support the evolution of HAZOP from a mainly periodic hazard-review method toward a more dynamic, lifecycle-oriented safety management approach. The aim is not to present digitalization as a simple solution to process safety problems, but to critically evaluate where these technologies can add value, where their limitations remain, and what technical and organizational barriers must be addressed before they can be adopted reliably in high-hazard process industries. This conceptual transition is summarized in Figure 1. Conventional HAZOP remains the foundation of expert-led process hazard analysis, but its periodic and document-centered implementation creates limitations that can be addressed through four complementary DT–AI pathways: AI-assisted HAZOP, Digital Twin-based monitoring, hybrid physics–data models, and explainable AI.

1.2. HAZOP as a Foundation of Process Safety

Hazard and Operability (HAZOP) studies have long been one of the central methods used for systematic hazard identification in the chemical and process industries. The method was developed within Imperial Chemical Industries in the 1960s and later became widely adopted because it offered a disciplined way to examine how a process could deviate from its intended design or operating conditions [10,20]. In a typical HAZOP study, a multidisciplinary team divides the process into nodes and applies guide words such as “NO”, “MORE”, “LESS”, “REVERSE”, and “OTHER THAN” to relevant process parameters, including flow, temperature, pressure, level, composition, and phase. This structured questioning helps the team identify credible deviations, possible causes, consequences, safeguards, and recommendations for further risk reduction [8,9,10].

The strength of HAZOP lies in its balance between structure and expert judgment. Unlike unstructured brainstorming, the guide-word approach forces the team to examine each node systematically and reduces the chance that important deviations will be missed. At the same time, the quality of the study still depends heavily on the experience of the team, the accuracy of process documentation, and the ability of participants to recognize how abnormal conditions may develop in practice [8,10,11]. This combination of formal procedure and engineering judgment explains why HAZOP has remained useful for many decades, but it also explains why the method can be vulnerable when process knowledge is incomplete, operating conditions change, or previous assumptions are not revisited.

HAZOP has also become deeply embedded in process safety regulation and industrial practice. In the United States, the Occupational Safety and Health Administration’s Process Safety Management standard requires process hazard analysis for facilities handling threshold quantities of highly hazardous chemicals [21]. In Europe, the Seveso III Directive requires operators of major-accident hazard establishments to identify major accident hazards and demonstrate suitable prevention and mitigation measures [22]. In the United Kingdom, the Control of Major Accident Hazards Regulations 2015 require operators to identify and evaluate major accident hazards and take all measures necessary to prevent and limit their consequences [23]. Although these regulations do not prescribe one single hazard-identification method in all cases, HAZOP is commonly used because it provides a structured, auditable, and well-established approach for process hazard analysis.

International guidance has further standardized the use of HAZOP. The CCPS Guidelines for Hazard Evaluation Procedures provide broad guidance on process hazard analysis methods, including HAZOP, while IEC 61882:2016 gives specific guidance on the application, preparation, examination sessions, documentation, and follow-up of HAZOP studies [8,9]. These references have helped make HAZOP a common language for hazard identification across companies, regulators, consultants, and engineering teams.

Despite this strong foundation, HAZOP should not be viewed as a complete solution by itself. Its effectiveness depends on how carefully it is prepared, how well the team understands the process, and how effectively recommendations are implemented and revisited. Literature reviews and critiques have noted that HAZOP remains one of the most widely used process hazard analysis methods, but they also emphasize limitations related to team dependence, time requirements, documentation quality, and the difficulty of capturing dynamic operational changes within a periodic review process [10,11,12]. These limitations are especially important in modern plants, where operating conditions, control systems, maintenance status, feedstocks, and equipment health may change continuously between formal review cycles.

These considerations provide the basis for the research gap discussed in the next section: how HAZOP can be digitally supported while preserving its structured, expert-led, and auditable character.

1.3. Research Gap and Novel Contribution

1.3.1. The Research Gap

A growing body of research has examined how Artificial Intelligence and Digital Twin technologies can support different aspects of process safety. Some studies have focused on ontology-based and computer-aided HAZOP automation [17,18], while others have explored knowledge graph construction for process safety knowledge integration [19], Digital Twin models for process-plant risk monitoring [16], safety assurance for machine-learning systems [24], and interpretable machine learning for safety-related decision support [25,26]. These contributions are important because they show that digital technologies can support specific parts of hazard identification, safety monitoring, knowledge management, and decision-making.

However, the literature remains fragmented. Existing studies tend to address individual technologies or isolated use cases, rather than presenting a unified view of how Digital Twins, AI-assisted HAZOP, hybrid physics–data models, and explainable AI could work together to strengthen HAZOP practice. In particular, there is still a need for a critical synthesis that organizes these developments into technology pathways aligned with the practical limitations of conventional HAZOP, compares their evidence maturity and implementation requirements, and examines the gap between laboratory demonstrations and industrial deployment. There is also limited discussion of the regulatory, human factors, and organizational issues that determine whether these tools can be adopted safely in real process facilities.

Table 1 summarizes representative reviews and related studies that have informed this field and highlights the specific gaps that motivate the present review.

Table 2 provides a structured comparison of this review against the most closely related works across five dimensions: scope, technology coverage, HAZOP integration depth, human factors treatment, and regulatory analysis. This comparison clarifies the unique contribution of the present review.

1.3.2. Novel Contributions of This Review

This review contributes to the field in five main ways.

1.

It provides an integrated critical synthesis of four technology pathways: AI-assisted HAZOP, Digital Twin-based monitoring, hybrid physics–data modeling, and explainable AI. Rather than reviewing these technologies as separate digital trends, the discussion is organized around the practical limitations of conventional HAZOP. This keeps the review anchored to a specific process safety problem: how structured hazard identification can be strengthened in dynamic operating environments.

2.

It links key limitations of conventional HAZOP, including episodic review, dependence on expert judgment, static risk representation, limited use of operational data, and knowledge loss between studies, to specific Digital Twin and AI capabilities. This mapping is intended to provide a practical basis for thinking about technology selection, implementation planning, and future research priorities.

3.

It develops the augmentation principle as an organizing idea for the review. In this view, Digital Twin and AI technologies should be treated as decision-support layers that strengthen expert-led HAZOP rather than replace human judgment. This principle is important for system design, governance, regulatory acceptance, and professional responsibility in safety-critical settings.

4.

It evaluates evidence quality and technology maturity across the four pathways by distinguishing between conceptual proposals, simulation-based demonstrations, prototype implementations, and validated industrial applications. This helps clarify where the field is advancing and where the evidence remains limited or conditional.

5.

It brings together technical, organizational, and human-centered adoption issues in one critical discussion. These include explainability, regulatory acceptance, failure modes, implementation barriers, ethical considerations, and the need for clear human oversight. This broader perspective is important because successful adoption in process safety depends not only on model performance, but also on trust, accountability, and integration into existing safety-management systems.

1.3.3. Objectives

This review critically evaluates how Digital Twin and Artificial Intelligence technologies can support the enhancement of conventional HAZOP and contribute to more dynamic process safety management. The specific objectives are:

1.

To characterize the main technological approaches for Digital Twin and AI-enhanced HAZOP across four complementary pathways.

2.

To assess the available validation evidence, industrial implementation status, and Technology Readiness Level maturity of these approaches.

3.

To compare the four pathways as complementary components of a lifecycle-oriented safety-management framework.

4.

To identify potential failure modes, implementation barriers, and risk-control requirements associated with Digital Twin and AI adoption in process safety.

5.

To provide practical guidance for phased industrial adoption, sector-specific considerations, and future research directions.

1.3.4. Scope and Perspective

This review is a thematic critical literature review rather than a PRISMA-style systematic review. The detailed search strategy, inclusion and exclusion criteria, selection process, and synthesis approach are described in Section 2. The review focuses specifically on Digital Twin and AI technologies in the context of HAZOP enhancement and process safety management for continuous and batch chemical processes. It does not attempt to survey the broader fields of AI, Digital Twins, or machine learning in full. The discussion gives attention not only to technical capability, but also to implementation realism, human oversight, regulatory acceptance, explainability, and organizational readiness.

1.3.5. Manuscript Organization

The remainder of this review is organized as follows. Section 2 describes the review methodology, including the search strategy, inclusion and exclusion criteria, selection process, and synthesis approach. Section 3 establishes the conceptual foundations required to understand Digital Twin and AI-enhanced HAZOP, including HAZOP knowledge structure, Digital Twin architecture for process safety, AI methods relevant to HAZOP enhancement, and the integration logic that connects static hazard review to lifecycle hazard intelligence. Sections 4–7 examine the four major technology pathways: AI-assisted HAZOP, Digital Twin architectures for dynamic hazard monitoring, hybrid physics–data models for predictive safety analytics, and explainable AI for operator trust and regulatory acceptance. Section 8 reviews industrial applications and technology maturity. Section 9 presents the critical discussion, comparative analysis, research gaps, and future research agenda. Section 10 discusses ethical and societal considerations. Section 11 covers verification, validation, and functional safety standards. Finally, Section 12 presents the conclusions and recommendations.

2. Review Methodology

This review follows a thematic critical synthesis methodology designed to provide a comprehensive and structured evaluation of Digital Twin and Artificial Intelligence applications for HAZOP enhancement in process safety. Although this work does not constitute a formal systematic review in the PRISMA sense, the literature identification and selection process was conducted rigorously and transparently to ensure reproducibility and scholarly credibility.

2.1. Search Strategy

Literature was identified through targeted searches of four major academic databases: Scopus, Web of Science, Google Scholar, and SciSpace. The search period spanned from 2000 to 2026, with particular emphasis on publications from 2015 onward, when Digital Twin and AI applications in process safety became increasingly visible in the peer-reviewed literature. Search queries were constructed using Boolean combinations of the following controlled vocabulary and free-text terms:

• Hazard identification: “HAZOP”, “hazard and operability study”, “process hazard analysis”, “PHA”
• Digital Twin: “digital twin”, “cyber-physical system”, “process simulation”, “dynamic process model”
• Artificial Intelligence: “artificial intelligence”, “machine learning”, “deep learning”, “neural network”, “large language model”, “natural language processing”, “knowledge graph”, “ontology”
• Hybrid modeling: “physics-informed neural network”, “PINN”, “hybrid model”, “physics-data model”
• Explainability and trust: “explainable AI”, “XAI”, “SHAP”, “LIME”, “operator trust”, “interpretability”
• Process safety context: “process safety”, “chemical engineering”, “anomaly detection”, “fault detection”, “Bayesian network”, “risk assessment”

Searches were conducted iteratively, with initial broad queries refined progressively to improve precision. Additional sources were identified through backward citation tracing from key review papers and seminal studies, as well as forward citation searches for highly cited foundational works. Conference proceedings from major process safety and chemical engineering venues (e.g., DYCOPS, PSE, AIChE Annual Meeting, ESREL, and CCPS Global Congress) were also consulted where relevant. This iterative search and citation-tracing approach is consistent with critical review practice in HAZOP and process safety research [10,27].

2.2. Inclusion and Exclusion Criteria

Literature was included if it: (1) addressed at least one of the four technology pathways examined in this review (AI-assisted HAZOP, Digital Twin monitoring, hybrid physics–data modeling, or explainable AI for process safety); (2) provided sufficient technical detail to assess methodological approach, validation evidence, or industrial applicability; and (3) was published in peer-reviewed journals, conference proceedings, or credible technical reports. Literature was excluded if it was purely theoretical without process safety application, if it addressed only tangentially related domains without clear relevance to HAZOP or process safety, or if it lacked sufficient detail for critical assessment.

2.3. Selection and Synthesis Process

Candidate papers were screened first by title and abstract, then by full-text review for studies meeting the initial criteria. A representative analytical corpus was assembled from studies meeting the screening criteria, supplemented by selected foundational works, standards, and technical reports needed to contextualize HAZOP, process safety, Digital Twins, and AI-enabled safety decision support. The distribution of sources reflects the relative maturity of the four pathways examined in this review. AI-assisted HAZOP, computer-aided HAZOP, and ontology-based approaches have a longer publication history, whereas hybrid physics–data models and large language model applications are more recent and remain less mature in HAZOP-specific industrial deployment.

Data extraction focused on: methodology and model type, application domain and scale, validation approach and evidence quality, reported performance metrics, Technology Readiness Level indicators, and limitations acknowledged by authors. Synthesis was conducted thematically across the four pathways, with cross-cutting analysis applied to human factors, regulatory acceptance, ethical considerations, and verification and validation requirements. Conflicting findings were resolved by giving greater weight to peer-reviewed experimental or industrial validation studies over purely simulation-based or conceptual works.

2.4. Quality Assessment

No formal quality scoring instrument was applied. Instead, evidence quality was assessed qualitatively based on: study design rigor (e.g., controlled experiment vs. illustrative case study), transparency of validation methodology, scale of application (laboratory, pilot, or industrial), and extent of independent replication. Studies with industrial validation and documented performance metrics were weighted more heavily in the synthesis. This approach is consistent with established practice for critical thematic reviews in engineering disciplines [27,28,29].

3. Conceptual Foundations for Digital Twin and AI-Enhanced HAZOP

The previous section established why conventional HAZOP remains essential to process safety, but also why its traditional implementation is increasingly challenged by dynamic operating environments, equipment degradation, process modifications, and the growing complexity of modern industrial facilities. Before examining specific technology pathways, it is necessary to clarify the conceptual foundations that allow HAZOP, Digital Twins, and Artificial Intelligence to be discussed as connected parts of one safety-support framework rather than as separate tools.

HAZOP provides a structured way to capture expert knowledge about deviations from design intent, their possible causes, consequences, safeguards, and required actions. Digital Twins provide a continuously updated representation of the operating process by linking process models with live plant data. Artificial Intelligence provides computational support for knowledge extraction, anomaly recognition, prediction, diagnosis, and explanation. The central challenge is therefore not simply to add AI or Digital Twin tools to HAZOP, but to determine how static hazard knowledge can be transformed into dynamic, explainable, and lifecycle-oriented safety intelligence.

This section develops that foundation in five steps. Section 3.1 describes HAZOP as a structured safety-knowledge framework. Section 3.2 explains the transition from static HAZOP worksheets to dynamic lifecycle safety intelligence. Section 3.3 outlines the Digital Twin architecture needed for process safety applications. Section 3.4 summarizes the AI methods most relevant to HAZOP enhancement. Finally, Section 3.5 synthesizes these elements into an integrated logic for HAZOP-informed Digital Twins.

3.1. HAZOP as Structured Safety Knowledge

Although HAZOP is conducted through expert discussion, its output is not an informal collection of opinions. A conventional HAZOP worksheet organizes process safety reasoning into a structured sequence of fields: process node, process parameter, guide word, deviation, possible causes, consequences, safeguards, risk ranking, and recommendations [8,9]. The worksheet structure and documentation requirements are described in HAZOP guidelines [10,30,31]. This structure can be interpreted as a node–deviation–cause–consequence–safeguard framework. Such a framework is important because it allows HAZOP knowledge to be traced, reviewed, challenged, updated, and potentially encoded in computational systems.

The process node defines the physical or functional boundary of the analysis. It may correspond to a reactor, vessel, heat exchanger, distillation section, compressor, pipeline segment, utility system, or control loop. Within each node, relevant process parameters such as flow, pressure, temperature, level, composition, and phase condition describe the intended process behavior. HAZOP guide words such as “NO”, “MORE”, “LESS”, “REVERSE”, and “OTHER THAN” are then systematically combined with these parameters to identify deviations from design intent [8,9,31]. For example, applying “MORE” to reactor temperature produces the deviation “higher reactor temperature”, while applying “LESS” to cooling flow may identify a credible cause of that deviation.

The analytical value of HAZOP lies in the causal reasoning chain that follows each meaningful deviation. For each deviation, the expert team identifies credible causes, evaluates possible consequences, reviews existing safeguards, and proposes additional recommendations when the existing protection is inadequate [8,10,30]. This chain connects process behavior to safety significance. A deviation defines the abnormal condition of concern; a cause explains how that condition may arise; a consequence explains why the deviation matters; and a safeguard defines what protection is expected to prevent, detect, or mitigate escalation.

This structured knowledge is one of the main reasons why HAZOP remains highly relevant in a digital process-safety environment. Generic process-monitoring systems may detect that a variable is statistically abnormal, but they do not necessarily explain why the abnormality is safety-relevant. In contrast, a HAZOP-informed monitoring system can connect abnormal process behavior to a known deviation, a credible cause, a possible consequence, and an expected safeguard. In this sense, HAZOP provides the semantic safety layer required for meaningful Digital Twin monitoring. It tells the Digital Twin not only what to monitor, but also why the monitored condition matters and how it relates to process safety decisions.

Recent work on computer-aided hazard analysis has recognized this structured nature of HAZOP and attempted to encode it in machine-readable formats [32,33]. Ontology-based HAZOP methods and process safety knowledge graphs have extended this further [17,18,19]. These approaches show that HAZOP worksheets can be transformed from narrative documentation into structured knowledge models that support retrieval, consistency checking, automated reasoning, and reuse across similar systems. However, the purpose of such formalization should not be misunderstood. The objective is not to remove expert judgment from HAZOP, but to make expert knowledge more traceable, reusable, and connectable to operational data.

For Digital Twin integration, this distinction is essential. A HAZOP worksheet can be viewed not only as a record of a past workshop, but also as a structured safety knowledge base. The deviation column can inform abnormal-condition monitoring. The cause column can support fault diagnosis. The consequence column can support risk prioritization [34]. The safeguard column can support protection-layer verification and operator response. This interpretation provides the conceptual starting point for HAZOP-informed Digital Twins: expert safety knowledge is preserved, but it is also made operationally active. Figure 2 illustrates how conventional HAZOP worksheet elements can be formalized into a machine-readable safety knowledge base and then connected to DT–AI functions for monitoring, analytics, decision support, and lifecycle learning.

3.2. From Static HAZOP Worksheets to Dynamic Lifecycle Safety Intelligence

Conventional HAZOP practice is usually organized around discrete study events. A HAZOP is performed during design, reviewed during major modifications, and repeated periodically during the operating life of the facility. This workflow has clear practical advantages: it creates an auditable record, brings together multidisciplinary expertise, and supports regulatory compliance. However, it also means that the HAZOP worksheet may become increasingly separated from the actual operating condition of the plant as time passes.

Industrial facilities rarely remain identical to their original design basis. Equipment fouls, catalysts age, sensors drift, control loops are retuned, feedstocks vary, operating envelopes shift, and small modifications accumulate over time. Some of these changes are formally captured through management of change processes, but others may appear gradually as operational drift or equipment degradation. As a result, the process described in a HAZOP worksheet may not always represent the process that operators face in real time [11,12]. Management of change processes and operational drift have been documented as contributors to this gap [35,36,37]. This creates an important gap between hazard knowledge and operating reality.

Digital Twin technology offers a possible way to narrow this gap. A process safety Digital Twin can combine process models, plant data, equipment-health indicators, and safety logic to maintain a continuously updated representation of the operating process [15,16]. Digital Twin applications to process safety management have been demonstrated across multiple industrial sectors [38,39,40]. Recent work has further demonstrated Digital Twin approaches for process safety management in oil and gas operations [41,42], dynamic PSM architectures combining Digital Twins with machine learning [43], and safety Digital Twins for monitoring hazards in industrial environments [44,45]. When connected to HAZOP knowledge, such a system can evaluate whether current process behavior is approaching conditions associated with known deviations. For example, if heat-transfer performance deteriorates in a heat exchanger, the Digital Twin can recognize that the margin to a high-temperature deviation is decreasing. If cooling effectiveness is reduced in an exothermic reactor, the system can monitor whether the process is moving toward a thermal-risk scenario identified in the HAZOP. If differential pressure rises across a distillation column, the Digital Twin can relate this trend to flooding-related deviations and their associated consequences.

This transformation changes the role of HAZOP knowledge. Instead of remaining only as a static worksheet, HAZOP can become part of a living safety knowledge system. The original expert analysis still defines the credible deviations, causes, consequences, and safeguards, but operational data can continuously test whether these scenarios are becoming more likely, whether safeguards remain available, and whether the assumptions made during the study still hold. In this sense, the Digital Twin does not replace HAZOP; it provides an operational layer through which HAZOP knowledge can remain connected to plant behavior.

The idea of lifecycle safety intelligence therefore extends beyond simple alarm generation. A conventional alarm may indicate that a variable has crossed a fixed limit. A HAZOP-informed Digital Twin can provide richer context: which HAZOP deviation is developing, which causes are plausible, which consequences may follow, which safeguards should be checked, and how much time may remain before an operating or safety limit is reached. This creates a more explainable form of early warning and supports more informed operator and engineering decisions.

The extent to which these functions have been realized in practice remains uneven. Some elements have been demonstrated through Digital Twin monitoring, anomaly detection, dynamic risk assessment, and decision-support prototypes, while fully integrated HAZOP-informed lifecycle safety systems remain limited. A later section of this review therefore examines the extent to which these functions have been demonstrated in industrial or near-industrial settings, and where the evidence remains conceptual, simulation-based, or prototype-level.

This distinction is central to the future development of Digital Twin and AI-enhanced HAZOP. The first step is to use HAZOP knowledge to support dynamic early warning. The next step is to use AI and model-based features to distinguish between multiple possible causes of the same deviation. A further step is to connect the diagnosed scenario with safeguard status and recommended response. These functions correspond to a broader progression from identifying hazards, to detecting developing deviations, diagnosing likely causes, and supporting safe response. The later sections of this review evaluate the technologies that may enable this progression and the evidence still needed before they can be adopted safely in industrial practice.

3.3. Digital Twin Architecture for Process Safety Applications

If HAZOP provides the structured safety knowledge, the Digital Twin provides the operational environment in which that knowledge can be continuously tested against plant behavior. A Digital Twin may be understood as a virtual representation of a physical asset or process that is updated using operational data and used to support monitoring, prediction, and decision-making [15,16,38]. In process safety applications, however, the Digital Twin should not be viewed only as a visualization tool or a process simulator. Its value depends on its ability to connect live process data, process models, equipment status, safety logic, and operator decision support into one coherent monitoring architecture.

The layered architecture described here is the synthesis developed in this review from existing Digital Twin and process safety literature, applied specifically to the HAZOP context. It is not intended to replace existing Digital Twin reference architectures, but to clarify which functional layers are required when HAZOP knowledge is to be connected to operational monitoring, prediction, diagnosis, and decision support.

Process safety management methods have evolved significantly over the past decades, with risk assessment and hazard identification remaining central to industrial safety practice [46]. A process safety Digital Twin can be interpreted as a layered system. The first layer is the physical asset layer, consisting of process equipment, instrumentation, control valves, analyzers, alarms, safety instrumented functions, and utility systems. This layer generates the raw information required to understand the actual operating state of the plant. The second layer is the data acquisition and integration layer, which collects measurements from distributed control systems, historians, laboratory systems, maintenance systems, and equipment-health monitoring platforms. This layer is essential because Digital Twin performance is limited by the quality, frequency, reliability, and contextual meaning of the data it receives.

The third layer is the model layer. This layer may include first-principles models, reduced-order dynamic models, data-driven models, or hybrid physics–data models. For process safety, this layer is particularly important because it allows the Digital Twin to evaluate not only the current process state, but also how that state may evolve under disturbances, equipment degradation, or abnormal operation. A purely descriptive Digital Twin may show that a temperature is increasing; a predictive Digital Twin can estimate whether the temperature is likely to approach a hazardous limit; and a prescriptive Digital Twin can support decisions about which corrective actions may reduce risk.

The fourth layer is the analytics and intelligence layer. This layer converts process data and model outputs into safety-relevant information. Typical functions include anomaly detection, deviation recognition, fault diagnosis, degradation estimation, time-to-limit prediction, dynamic risk updating, and alarm prioritization. In a HAZOP-informed architecture, the analytics layer should not detect abnormalities in a generic sense only. It should relate detected patterns to HAZOP deviation logic. For example, a rising reactor temperature should be interpreted not only as a statistical anomaly, but as a possible “MORE temperature” deviation whose likely causes, consequences, and safeguards are already documented in the HAZOP knowledge base.

The fifth layer is the decision-support layer. This layer presents the Digital Twin outputs to operators, process engineers, and safety personnel in a form that supports timely and informed action. For process safety, this requires more than displaying trends or alarm messages. The interface should explain the detected deviation, the likely cause, the supporting evidence, the possible consequence, the relevant safeguards, and recommended checks. This is where the connection between HAZOP and Digital Twin monitoring becomes most visible. A useful alert should not only state that an abnormal condition exists; it should help the user understand what HAZOP scenario may be developing and what should be verified next.

This layered architecture also clarifies the difference between a conventional monitoring system and a HAZOP-informed Digital Twin. Conventional alarms usually monitor individual variables against fixed thresholds. They are simple, auditable, and necessary, but they often provide limited explanation and may activate only after the process has already moved close to an unsafe condition. A HAZOP-informed Digital Twin can provide an earlier and richer form of warning by combining model-based prediction, multivariable patterns, estimated degradation, and HAZOP cause–consequence logic. It therefore acts as an advisory safety layer rather than a replacement for alarms, trips, safety instrumented systems, or expert judgment.

The maturity of Digital Twin applications in process safety varies significantly. Digital Twin concepts have been applied to operator-risk prevention in process plants, dynamic safety analysis, hydrogen refueling safety, and petrochemical safety improvement [16,38,47]. Recent work has extended these applications to oil and gas process safety management [41,42], dynamic PSM architectures combining Digital Twins with machine learning [43], safety Digital Twins for industrial collaborative robots [45], and Digital Twin-based approaches for process safety in the context of methods in chemical process safety [44]. These studies show the promise of Digital Twins for safety monitoring and decision support, but they also reveal an important gap: many Digital Twin systems focus on visualization, anomaly detection, equipment health, or process optimization, while fewer explicitly connect real-time monitoring to the structured deviation–cause–consequence–safeguard logic of HAZOP. This gap motivates the need for Digital Twin architectures that are not only data-rich and model-based, but also safety-knowledge-informed.

For this reason, the term HAZOP-informed Digital Twin is used in this review to describe a Digital Twin architecture in which HAZOP knowledge actively guides monitoring, diagnosis, and response support. In such a system, HAZOP deviations define what abnormal situations should be monitored; HAZOP causes guide the selection of degradation variables or diagnostic features; HAZOP consequences support risk prioritization; and HAZOP safeguards provide the basis for protection-layer verification and operator recommendations. This architecture provides the conceptual foundation for moving from static hazard identification toward dynamic lifecycle safety intelligence.

3.4. Artificial Intelligence Methods Relevant to HAZOP Enhancement

Artificial Intelligence is not a single method, and its role in HAZOP enhancement should not be reduced to the use of one algorithm or one class of models. In the process safety context, AI should be understood as a family of computational approaches that can support different parts of the HAZOP lifecycle: capturing knowledge, retrieving prior experience, detecting abnormal process behavior, predicting hazardous trends, diagnosing likely causes, and explaining recommendations to human users [13,14,48]. Each of these functions requires a different type of AI capability and carries a different level of maturity and risk.

Rule-based and expert-system approaches represent one of the earliest forms of computer-aided HAZOP support. These systems encode expert knowledge in the form of explicit rules that connect process conditions, deviations, causes, and consequences. Their main advantage is transparency: the reasoning path can be inspected and challenged by engineers. This makes them attractive for safety-related applications, where auditable logic is important. However, rule-based systems are limited by the completeness and maintainability of the rule base. They can support structured reasoning for well-understood systems, but they are less effective when process behavior is highly nonlinear, poorly characterized, or strongly dependent on operating history [32,33].

Ontology-based systems and knowledge graphs provide a more structured way to represent HAZOP knowledge. Ontologies define the relationships between process equipment, process parameters, guide words, deviations, causes, consequences, and safeguards. Knowledge graphs extend this representation by linking structured safety knowledge with process topology, historical HAZOP records, accident reports, and operational data [17,18,19]. These approaches are valuable because they allow HAZOP knowledge to be stored in a machine-readable form and reused across similar process units. They also support consistency checking and retrieval of relevant historical scenarios. Their main limitation is the knowledge-engineering effort required to build, validate, and maintain the underlying knowledge base.

Natural language processing methods can support HAZOP enhancement by extracting structured information from unstructured or semi-structured documents, including HAZOP worksheets, incident reports, operating procedures, maintenance records, and management-of-change documentation. Such methods can help recover knowledge from legacy reports and convert narrative safety information into forms that can be searched, compared, and analyzed computationally [19,49]. Recent advances in large language models have increased interest in automated HAZOP drafting [50,51] and safety-document interpretation [28,52]. However, the use of generative models in safety-critical analysis must be treated carefully because fluent text does not guarantee correct causal reasoning, completeness, or physical consistency. For this reason, natural language methods are more defensible as expert-support tools than as autonomous replacements for HAZOP teams.

Machine learning methods are particularly relevant to Digital Twin monitoring because they can identify patterns in multivariable process data that may not be obvious from individual alarms. Supervised learning can be used for fault classification when labelled examples are available. Unsupervised and semi-supervised learning can support anomaly detection when abnormal-event data are scarce. Deep learning models, including recurrent and sequence-based architectures, can capture temporal patterns in process measurements and may provide early warning of developing abnormal conditions. However, process safety applications impose stricter requirements than ordinary predictive analytics. Models must be robust to distribution shift, sensor faults, missing data, and rare-event conditions. They must also provide outputs that operators and safety engineers can interpret and verify [24,25,48].

Bayesian networks and dynamic Bayesian networks occupy a related position between AI-based reasoning and probabilistic risk assessment. They are particularly useful when process safety decisions require updating the likelihood of deviations, causes, or safeguard failures as new evidence becomes available. In a HAZOP-informed Digital Twin, such methods can support dynamic risk updating by linking observed process evidence to HAZOP cause–consequence pathways and protection-layer status [34,38].

Hybrid physics–data models represent an important direction for process safety because they combine process knowledge with data-driven adaptability. In these models, first-principles equations, conservation laws, thermodynamic constraints, or simplified dynamic models are combined with machine learning components. This approach is attractive because purely data-driven models may extrapolate poorly outside their training domain, while purely first-principles models may be incomplete or difficult to maintain for complex industrial systems. Physics-informed neural networks and related frameworks offer a principled approach to embedding physical constraints into data-driven models [53,54]. Hybrid modeling approaches have demonstrated a balance between predictive performance, physical consistency, and interpretability in process safety applications [55,56,57]. In HAZOP-informed Digital Twins, such models can support prediction of how a developing deviation may evolve before it reaches a conventional alarm limit.

Explainable AI is another essential component of HAZOP enhancement. In safety-critical environments, it is not enough for an AI model to produce an alarm, a probability, or a classification label. The system must help the user understand why a recommendation was made, which variables contributed to it, how confident the model is, and whether the situation lies within the model’s validated operating domain. Explainable AI methods can support this requirement by providing feature importance, local explanations, counterfactual reasoning, uncertainty information, or interpretable model structures [24,25,26]. However, explainability should not be treated as a cosmetic layer added after model development. For HAZOP applications, explanations must be meaningful in process safety terms: deviation, cause, consequence, safeguard, and recommended action.

The relevance of AI to HAZOP enhancement therefore depends on how the method is positioned. AI is most credible when it augments expert-led analysis, improves knowledge management, supports dynamic monitoring, or helps diagnose developing scenarios. It is less credible when it is presented as a complete replacement for expert judgment. The augmentation principle is especially important in process safety: AI should extend the capacity of engineers and operators, but responsibility for safety-critical decisions must remain with qualified human professionals and established safety management systems.

Table 3 summarizes the complementary roles of HAZOP, Digital Twins, AI analytics, and explainability in the lifecycle safety-intelligence framework developed in this section.

3.5. Integration Logic: From HAZOP Knowledge to Lifecycle Hazard Intelligence

The preceding subsections show that HAZOP, Digital Twins, and AI each contribute a different capability. HAZOP provides structured safety knowledge. Digital Twins provide operational context and model-based process representation. AI provides computational support for knowledge extraction, pattern recognition, prediction, diagnosis, and explanation. The central question is how these capabilities can be integrated without weakening the expert judgment and accountability that make HAZOP valuable.

A useful way to view the integration is as a progression from static hazard identification to lifecycle hazard intelligence. In conventional practice, HAZOP identifies credible deviations, causes, consequences, and safeguards at a particular point in the plant lifecycle. In a HAZOP-informed Digital Twin, this knowledge can be encoded as a living safety knowledge base that is continuously compared with process data and model predictions. The Digital Twin does not create the safety logic from nothing; rather, it uses the HAZOP logic as a guide for what should be monitored, diagnosed, prioritized, and explained.

This integration can be organized around four functions: identify, detect, diagnose, and respond [29]. The identify function corresponds to conventional HAZOP and AI-assisted knowledge capture. It defines the process nodes, deviations, causes, consequences, safeguards, and recommendations. The detect function corresponds to Digital Twin monitoring and model-based early warning. It asks whether a known HAZOP deviation, or a precursor to that deviation, is developing in real operation. The diagnose function uses model-based estimation, AI classification, or hybrid approaches to distinguish between possible causes of the same deviation. The respond function connects the detected and diagnosed scenario to safeguard status, risk escalation, and recommended operator or engineering actions.

This four-function logic is important because it clarifies the difference between several levels of digital HAZOP enhancement. A basic system may only assist HAZOP documentation or retrieve historical scenarios. A more advanced system may monitor live data for abnormal trends linked to known deviations. A still more advanced system may estimate hidden degradation variables or rank competing causes. The most mature form would also evaluate whether safeguards are available, effective, bypassed, degraded, or already demanded. These levels should not be confused. Each requires different data, models, validation evidence, and governance controls.

The same logic also clarifies why Digital Twin and AI technologies should be positioned as decision-support layers rather than replacements for HAZOP [27,58]. The original HAZOP team remains essential for defining credible scenarios, judging consequence severity, evaluating safeguards, and deciding whether recommendations are practical. The Digital Twin and AI layers can then help maintain the relevance of that knowledge during operation by identifying when assumptions are changing, when degradation is developing, when a deviation is approaching, and when a safeguard should be checked. In this way, the technology extends the reach of HAZOP without removing the human expertise at its core.

This integrated view provides the basis for the remainder of the review. Section 4 examines AI-assisted HAZOP methods that address dependence on expert judgment, knowledge formalization, and reuse of previous safety analysis. Section 5 evaluates Digital Twin architectures that address the static and document-centered nature of conventional HAZOP by connecting hazard knowledge to operational data and early-warning logic. Section 6 reviews hybrid physics–data models that support predictive safety analytics under nonlinear and uncertain operating conditions. Section 7 examines explainable AI, operator trust, and regulatory acceptance, which are essential if DT–AI outputs are to be used credibly in safety-critical workflows. Later sections then assess industrial maturity, implementation barriers, and the research agenda needed to move from fragmented demonstrations toward reliable HAZOP-informed Digital Twin systems.

4. AI-Assisted HAZOP: From Knowledge Automation to Expert Augmentation

Section 3 established that HAZOP knowledge has a structured form that can be encoded, searched, reused, and connected to operational data. This raises an important question: to what extent can Artificial Intelligence support or automate parts of the HAZOP workflow? The answer is more nuanced than a simple claim of automation. AI-assisted HAZOP has developed from early rule-based and expert-system approaches toward ontology-based models, knowledge graphs, natural language processing, and more recently large language models. These methods can support deviation generation, knowledge retrieval, consistency checking, documentation, and scenario suggestion. However, they do not remove the need for expert judgment, multidisciplinary review, or process-specific validation.

The reviewed literature indicates that AI-assisted HAZOP is best positioned as expert augmentation rather than full replacement. HAZOP is not only a mechanical exercise of applying guide words to process parameters; it is also a structured expert discussion that combines process knowledge, operating experience, equipment familiarity, human factors, and judgment about safeguard adequacy. AI can reduce repetitive effort, improve access to previous knowledge, and highlight omissions or inconsistencies, but it remains limited when asked to evaluate unusual causal pathways, judge safeguard independence, or decide whether recommendations are practical in a specific facility.

This section reviews the main AI-assisted HAZOP pathways. Section 4.1 explains why HAZOP automation has attracted sustained research interest. Section 4.2 reviews rule-based and expert-system approaches. Section 4.3 examines ontology-based HAZOP and formal knowledge representation. Section 4.4 discusses knowledge graphs and the reuse of process safety knowledge. Section 4.5 evaluates natural language processing and large language models. Section 4.6 compares the main AI-assisted HAZOP approaches. Finally, Section 4.7 provides a critical assessment of why AI-assisted HAZOP should be positioned as a decision-support layer within expert-led process safety practice.

4.1. Why HAZOP Automation Has Attracted Research Interest

Interest in AI-assisted HAZOP is driven by a practical tension. HAZOP is valued because it is systematic, auditable, and grounded in multidisciplinary expertise [8,9]. At the same time, it is time-consuming, resource-intensive, and highly dependent on the experience, preparation, and participation of the team conducting the study [21,22,23]. A large industrial HAZOP may involve many nodes, hundreds of guide-word combinations, extensive worksheet documentation, and repeated discussion of similar deviation patterns across comparable equipment. These characteristics make HAZOP a natural candidate for computational support.

Several parts of the HAZOP workflow are especially suitable for assistance. The first is deviation generation. Since guide words are applied systematically to process parameters, software can help ensure that obvious combinations are not accidentally omitted. The second is knowledge retrieval. Similar equipment items, such as pumps, heat exchangers, reactors, compressors, storage tanks, and distillation columns, often share recurring deviation patterns and failure causes. AI-supported retrieval can help teams identify relevant scenarios from previous HAZOP studies, incident reports, equipment-specific knowledge bases, and accident databases [49,59]. The third is consistency checking. When similar deviations are assigned different risk rankings or safeguards in different parts of the same facility, computational tools can flag these differences for expert review. The fourth is documentation support, where structured templates, language processing, and knowledge bases can reduce the administrative burden of preparing and maintaining HAZOP worksheets.

These opportunities directly address several limitations discussed earlier in this review: dependence on expert judgment, scalability challenges, documentation quality, and the difficulty of reusing lessons from previous studies. However, the most safety-critical parts of HAZOP remain difficult to automate. Identifying whether a cause is credible in a specific process context, judging whether a consequence is realistic, evaluating whether a safeguard is independent and effective, and deciding whether additional recommendations are necessary all require engineering judgment. These tasks depend not only on generic hazard knowledge, but also on plant-specific design details, operating history, maintenance practices, human factors, and organizational procedures.

For this reason, the literature on AI-assisted HAZOP should be interpreted through an augmentation lens [58]. A useful AI-assisted HAZOP system is not one that replaces the expert team, but one that helps the team work more systematically, retrieve relevant knowledge more efficiently, and reduce avoidable omissions or inconsistencies. This distinction is essential for process safety. Overstating automation capability may create false confidence, whereas a carefully designed augmentation system can strengthen expert-led HAZOP while preserving accountability.

4.2. Rule-Based and Expert-System Approaches

Early work on computer-aided HAZOP was strongly influenced by rule-based reasoning and expert-system approaches. These systems attempted to encode process safety knowledge as explicit rules, often in the form of cause–deviation–consequence relationships. A simplified rule might state that loss of cooling in an exothermic reactor can lead to higher reactor temperature, which may increase pressure or create a runaway risk. Such rules mirror the logic used by HAZOP teams and are therefore attractive because their reasoning can be inspected and challenged by engineers.

The strength of rule-based systems is transparency. In a safety-critical context, it is valuable to know why a system suggested a particular deviation, cause, or consequence. If the logic is expressed as explicit rules, the user can trace the recommendation back to encoded process knowledge. This aligns well with the auditability expected in process safety management and with the documentation culture of HAZOP. Rule-based systems can also support systematic deviation generation for simple process units [32,59,60], especially where equipment behavior and causal relationships are well understood [35].

However, rule-based approaches also reveal why full automation of HAZOP is difficult [27]. First, the rule base must be developed, validated, and maintained by domain experts. This creates a knowledge-engineering burden: the system is only as complete and reliable as the rules it contains. Second, rules that work for one process unit may not transfer directly to another without modification. A generic rule about high temperature may have different implications in a storage tank, fired heater, polymerization reactor, or distillation column. Third, complex process behavior often involves nonlinear dynamics, recycle streams, interacting control loops, start-up and shutdown procedures, and multiple simultaneous deviations. Such behavior is difficult to capture using simple deterministic rules.

These limitations do not make rule-based systems irrelevant. Rather, they define their appropriate role. Rule-based and expert-system approaches are useful for encoding well-established safety logic, supporting structured review, and providing transparent decision support. They are less suitable as stand-alone tools for discovering novel hazards or replacing the deliberation of a multidisciplinary HAZOP team. Their greatest value is therefore as one component within a broader AI-assisted HAZOP environment, particularly when combined with ontologies, knowledge graphs, and expert validation.

4.3. Ontology-Based HAZOP and Formal Knowledge Representation

Ontology-based approaches represent a more structured and scalable development of earlier rule-based systems [61]. An ontology defines the concepts in a domain and the relationships between them. In the HAZOP context, this may include equipment types, process parameters, guide words, deviations, failure causes, consequences, safeguards, materials, operating modes, and process connections. The value of an ontology is that it makes implicit safety knowledge explicit and machine-readable, allowing software systems to retrieve, compare, and reason over HAZOP-related information [17,18,59]. Machine learning and NLP approaches have been integrated with these ontological frameworks to support automated HAZOP reasoning [32,62,63].

For example, an ontology can represent that a heat exchanger has hot-side and cold-side streams, that temperature and flow are relevant process parameters, that fouling can reduce heat-transfer performance, and that reduced heat transfer may lead to a high-temperature deviation downstream. Similarly, a reactor ontology can represent relationships between cooling duty, reaction heat, temperature rise, pressure increase, relief demand, and runaway potential. By encoding these relationships, ontology-based systems can support systematic generation of deviation scenarios and provide candidate causes or consequences for expert review.

Ontology-based HAZOP has several advantages. It supports consistency because similar equipment and deviations can be described using a common vocabulary. It supports reuse because knowledge developed for one study can be applied to similar systems. It supports traceability because relationships between deviations, causes, consequences, and safeguards can be inspected. It also provides a bridge between traditional HAZOP worksheets and computational systems such as Digital Twins, where structured knowledge is needed to connect safety logic to process data.

Nevertheless, ontology-based HAZOP faces important limitations. Building a useful ontology requires significant expert effort. The ontology must be broad enough to cover common process equipment and failure mechanisms, but specific enough to represent the details that matter in a particular facility. If it is too generic, it may suggest irrelevant or superficial scenarios. If it is too specific, it may become difficult to maintain or reuse. Ontology-based systems may also struggle with dynamic behavior, operating procedures, human factors, or abnormal situations where the relevant causal relationships are not easily represented as static relationships between concepts.

The most realistic role for ontology-based HAZOP is therefore not autonomous hazard analysis, but structured knowledge support. Ontologies can help formalize HAZOP knowledge, reduce inconsistency, improve retrieval, and provide a foundation for HAZOP-informed Digital Twins. However, the credibility of the output still depends on expert validation and on the quality of the encoded process knowledge. In this respect, ontology-based HAZOP illustrates the broader theme of this review: digital methods can strengthen the HAZOP process, but they do not eliminate the need for qualified human judgment.

4.4. Knowledge Graphs and Reuse of Safety Knowledge

Knowledge graphs extend ontology-based representation by linking entities and relationships across different sources of process safety information [64,65]. In the HAZOP context, a knowledge graph may connect equipment items, process parameters, deviations, causes, consequences, safeguards, incident histories, maintenance records, operating procedures, and management-of-change documents. This structure allows safety information to be searched and reused more effectively than in isolated worksheets or document repositories [19,66].

The value of knowledge graphs is especially clear when HAZOP knowledge must be reused across similar units, projects, or facilities. For example, a deviation such as “high pressure” in a reactor may be linked to causes such as blocked outlet, cooling failure, runaway reaction, gas breakthrough, or control-valve malfunction. Each cause may then be linked to possible consequences, safeguards, relevant incidents, and previous recommendations. When a new HAZOP study is conducted, the knowledge graph can retrieve similar historical scenarios and present them to the team as prompts for consideration. This can reduce the risk that lessons from previous analyses or incidents remain buried in past documents.

Knowledge graphs can also support consistency checking. If similar equipment items have different safeguards assigned for comparable deviations, the system can highlight the discrepancy for review. If an incident report describes a failure mechanism that is not represented in the HAZOP knowledge base, the gap can be identified and used to update future studies. In this way, knowledge graphs can support organizational learning by connecting hazard identification, incident investigation, and operational experience.

However, knowledge graphs are not automatically reliable simply because they are structured. Their quality depends on the completeness, accuracy, and contextual meaning of the data used to construct them. Legacy HAZOP worksheets may contain inconsistent terminology, incomplete causal descriptions, vague recommendations, or site-specific language that is difficult to generalize. Accident reports may contain narrative descriptions that require careful interpretation before they can be encoded as structured relationships. For this reason, knowledge graph construction should include expert review, terminology control, and validation against real process knowledge.

For HAZOP enhancement, knowledge graphs are best viewed as a knowledge-management and reasoning-support layer. They help preserve and reuse safety knowledge, but they do not determine by themselves whether a scenario is credible or whether a safeguard is sufficient. Their main contribution is to make safety knowledge more accessible, connected, and reusable across the plant lifecycle.

4.5. Natural Language Processing and Large Language Models

Natural language processing methods are relevant to HAZOP because much process safety knowledge is stored in unstructured or semi-structured text. HAZOP worksheets, incident reports, operating procedures, maintenance logs, near-miss reports, and management-of-change records often contain valuable information about deviations, causes, consequences, safeguards, and corrective actions. NLP methods can help extract this information, classify it, and convert it into structured forms that support retrieval and analysis [49,67].

Earlier NLP applications in process safety focused on tasks such as keyword extraction, entity recognition, relationship extraction, classification of accident causes, and retrieval of similar cases from accident databases. In the HAZOP context, these methods can help identify recurring failure mechanisms, extract equipment–deviation relationships, and standardize terminology across legacy documents. When combined with ontologies or knowledge graphs, NLP can help populate structured safety knowledge bases from historical documents.

Large language models have expanded interest in AI-assisted HAZOP because they can generate fluent text, summarize documents, suggest possible deviations, and draft preliminary worksheet entries. In principle, an LLM could assist a HAZOP team by proposing candidate causes, retrieving similar incidents, rewriting recommendations, or checking whether a worksheet entry is vague or incomplete. These functions may reduce documentation burden and improve access to background knowledge [67,68,69]. Recent work has evaluated GPT-class models for hazard analysis tasks, including STPA hazard identification [70], question-answering systems for incident-based hazard identification [71], and prompt-engineering approaches for AI-assisted HAZOP assessment [72]. These studies confirm that LLMs can support preliminary hazard-identification tasks but consistently highlight the need for expert validation, hallucination control, and process-specific verification.

However, LLMs introduce specific risks that are especially important in process safety. A language model may generate plausible but incorrect causal explanations, overlook rare but critical scenarios, or produce recommendations that appear reasonable but are not valid for the actual process design. This problem is not merely a matter of text quality; it is a safety-governance issue. A HAZOP entry must be physically credible, process-specific, and reviewable by qualified personnel. For this reason, LLM-generated outputs should be treated only as draft suggestions or prompts for expert review, not as validated HAZOP conclusions.

The most defensible use of LLMs in HAZOP is therefore controlled and bounded. They may support document summarization, terminology standardization, retrieval of relevant historical cases, drafting of non-final worksheet text, and identification of possible omissions for expert review. They should not independently assign risk rankings, approve safeguard adequacy, or generate final recommendations without human validation. In safety-critical workflows, LLM use also requires version control, prompt traceability, source attribution, review logs, and clear responsibility for final decisions [69,73]. Applications of LLMs to asset integrity and process safety management have demonstrated that AI-generated outputs can be useful for knowledge retrieval and preliminary screening, but their integration into safety-critical workflows requires careful governance [74]. Deep learning approaches for HAZOP risk classification, such as B-TBM models trained on natural language descriptions, also show promise for supporting structured risk evaluation from text [75].

4.6. Comparative Assessment of AI-Assisted HAZOP Approaches

The approaches reviewed above differ in their level of maturity, transparency, data requirements, and suitability for safety-critical use [27,58]. Table 4 summarizes their main contributions, strengths, limitations, and most defensible role in HAZOP enhancement.

4.7. Critical Assessment: Why Full HAZOP Automation Remains Limited

The literature on AI-assisted HAZOP shows clear progress, but it also reveals persistent limitations [27,50]. Rule-based systems provide transparency but are difficult to scale and maintain [61]. Ontologies improve structure and reuse but require substantial knowledge-engineering effort. Knowledge graphs connect safety information across sources but depend on the quality of the underlying data. NLP and LLMs can support extraction and drafting but require careful control because language fluency does not guarantee technical correctness [50,51].

The main limitation is that HAZOP reasoning is contextual. A deviation that is significant in one system may be irrelevant in another. A cause that is credible during start-up may be unlikely during normal operation. A safeguard that appears adequate in a worksheet may be ineffective if it is not independent, unavailable, bypassed, poorly maintained, or not recognized by operators during an abnormal situation. These judgments require process knowledge, operational experience, and awareness of site-specific practices. They cannot be fully delegated to generic AI systems.

Another limitation is validation. Many AI-assisted HAZOP studies demonstrate feasibility using simplified case studies, limited process examples, or retrospective document analysis. These demonstrations are valuable, but they do not necessarily prove that the method can perform reliably across complex industrial facilities. Before AI-assisted HAZOP tools can be used in high-consequence settings, they must be validated against expert-reviewed studies, diverse process units, abnormal operating modes, and real documentation quality. They must also be evaluated for false omissions, not only for correct suggestions. In process safety, missing a credible hazardous scenario may be more serious than generating extra items for review.

A further challenge is governance. If an AI system suggests a deviation or recommendation, responsibility for accepting, rejecting, or modifying that output must remain clear. The system should support traceability: which data were used, which model version generated the output, which assumptions were applied, and which expert approved the final worksheet entry. Without this governance, AI-assisted HAZOP could create new forms of risk, including automation bias, overconfidence, inconsistent documentation, and unclear accountability.

Therefore, the near-term future of AI-assisted HAZOP is unlikely to be full automation. A more realistic and safer direction is expert augmentation. AI can help generate prompts, retrieve previous knowledge, standardize terminology, check consistency, and connect HAZOP worksheets to Digital Twin monitoring logic. The expert team remains responsible for judging credibility, consequence severity, safeguard adequacy, and final recommendations. This augmentation position is consistent with the lifecycle safety-intelligence framework developed in Section 3: AI strengthens the reach and usability of HAZOP knowledge, but it does not replace the engineering judgment on which process safety depends.

The findings of this section also motivate the next technology pathway. If AI-assisted HAZOP can help formalize and organize safety knowledge, the next question is how that knowledge can be connected to operational data so that known deviations can be monitored during plant operation. Section 5 therefore examines Digital Twin architectures for dynamic hazard monitoring and early warning.

5. Digital Twin Architectures for Dynamic Hazard Monitoring

Section 4 examined how AI-assisted HAZOP can support knowledge capture, scenario retrieval, documentation, and expert augmentation. However, formalizing HAZOP knowledge is only one part of the transformation. For HAZOP to become operationally useful during the plant lifecycle, its deviation–cause–consequence–safeguard logic must be connected to live process data, process models, equipment condition, and operator decision support. This is the role of Digital Twin architectures in DT–AI-enhanced HAZOP.

In this review, a HAZOP-informed Digital Twin is understood as a safety-support architecture that links structured HAZOP knowledge with live operational data and model-based reasoning. Its purpose is not to replace alarms, safety instrumented systems, process control systems, or expert judgment. Rather, it provides an additional advisory layer that helps identify whether known HAZOP deviations are developing, whether process conditions are moving closer to hazardous limits, whether safeguards should be checked, and whether operators require earlier contextual warning. This section therefore examines how Digital Twin architectures can address one of the central limitations of conventional HAZOP: the separation between static hazard documentation and dynamic plant behavior.

5.1. From Process Monitoring to HAZOP-Informed Digital Twins

Conventional process monitoring is usually organized around measured variables, control-loop performance, alarm limits, and operator displays [29]. These systems are essential for safe operation, but they often treat abnormal conditions as variable excursions rather than as structured hazard scenarios. A high-temperature alarm, for example, may indicate that a limit has been exceeded, but it does not necessarily explain which HAZOP deviation is developing, which causes are plausible, which consequences may follow, or which safeguards require verification.

A HAZOP-informed Digital Twin extends this logic by connecting process monitoring to hazard knowledge. Instead of monitoring variables only as isolated measurements, the Digital Twin interprets them in relation to known deviations, causal pathways, consequences, and safeguards. For example, a gradual loss of heat-transfer performance may be interpreted as an early precursor to a high-temperature deviation in a reactor or downstream process unit. A rising pressure-drop trend across a column may be interpreted as a possible precursor to flooding or fouling-related deviations. A declining pump performance indicator may be linked to reduced-flow scenarios already captured in the HAZOP worksheet.

This connection is important because process safety decisions require context. Operators and engineers do not only need to know that a variable is abnormal; they need to understand why the abnormality matters, how it may escalate, and what protection layers are expected to prevent or mitigate the consequence. Digital Twin architectures can support this by combining live data, dynamic models, equipment-health indicators, and HAZOP knowledge into a common decision-support environment [15,16]. Process safety Digital Twin implementations have demonstrated this integration across industrial applications [38,39,40].

The conceptual distinction is therefore clear. A conventional monitoring system asks: “Is the process variable outside its limit?” A HAZOP-informed Digital Twin asks a richer safety question: “Is the process moving toward a known hazardous deviation, what are the likely causes, what consequences may follow, and what safeguards should be verified?” This shift from variable monitoring to scenario-aware monitoring is the main contribution of Digital Twin architectures to HAZOP enhancement.

5.2. Core Architecture of a HAZOP-Informed Digital Twin

A process safety Digital Twin can be represented as a layered architecture [29]. The first layer is the physical asset layer, which includes the process equipment, instrumentation, control valves, alarms, interlocks, safety instrumented functions, relief devices, utilities, and human operators. This layer represents the real plant and generates the process data needed for monitoring and diagnosis.

The second layer is the data acquisition and integration layer. This layer collects and integrates data from distributed control systems, historians, laboratory information systems, maintenance systems, inspection records, alarm databases, and equipment-health monitoring platforms. For safety applications, data integration is not a simple technical detail. The reliability, sampling frequency, calibration quality, timestamp consistency, and contextual meaning of the data directly affect the credibility of the Digital Twin output.

The third layer is the model layer. This layer may include first-principles process models, reduced-order models, empirical models, machine-learning models, or hybrid physics–data models. In a HAZOP-informed Digital Twin, the model layer is used not only to reproduce current plant behavior, but also to estimate hidden states, forecast future trajectories, and evaluate whether the process is approaching a known deviation or safety margin. The model layer is therefore central to early warning, because it can provide information before a conventional alarm threshold is crossed [15,38,47]. Physics-informed and hybrid models are particularly well-suited for this role [53,54].

The fourth layer is the structured HAZOP knowledge layer. This is the feature that distinguishes a HAZOP-informed Digital Twin from a generic plant Digital Twin. The knowledge layer contains structured information about nodes, parameters, deviations, causes, consequences, safeguards, recommendations, and operating assumptions. It allows model outputs and data trends to be interpreted in process-safety terms. Without this layer, the Digital Twin may detect anomalies but may not explain their safety significance.

The fifth layer is the analytics and decision-support layer. This layer converts data, model outputs, and HAZOP knowledge into actionable information. Typical functions include deviation recognition, anomaly detection, fault diagnosis, time-to-limit estimation, safeguard-status checking, dynamic risk prioritization, and operator advisory support. The output should be explainable enough for operators, process engineers, and safety personnel to understand what scenario is developing and what evidence supports the recommendation.

Figure 3 illustrates the proposed layered architecture of a HAZOP-informed Digital Twin for dynamic hazard monitoring.

5.3. Dynamic Deviation Monitoring and Early Warning

One of the most important functions of a HAZOP-informed Digital Twin is dynamic deviation monitoring [76,77]. In conventional HAZOP, deviations are identified during a study session and documented in a worksheet. During operation, however, the process may gradually move toward one of these deviations because of fouling, catalyst deactivation, sensor drift, control-loop degradation, changing feed composition, or equipment wear. A Digital Twin can help identify this movement before the deviation becomes severe enough to trigger a conventional alarm.

Dynamic deviation monitoring requires mapping HAZOP deviations to measurable or estimable process indicators. Some deviations can be monitored directly. For example, “high pressure”, “low flow”, or “high temperature” may correspond to measured variables. Other deviations require inferred indicators. For example, reduced heat-transfer capability may require estimating an overall heat-transfer coefficient or approach temperature. Loss of catalyst activity may require estimating conversion loss under comparable operating conditions. Reduced safeguard availability may require information from maintenance, bypass, alarm, or proof-test records.

The Digital Twin can also support early warning by forecasting process trajectories [76,77]. Instead of only identifying the current state, the system can estimate whether the process is likely to approach a hazardous condition within a relevant time window. This is particularly important for deviations that develop gradually. A slow rise in reactor temperature, a gradual increase in column pressure drop, or a progressive reduction in cooling duty may not immediately violate alarm limits, but may indicate decreasing safety margin. Connecting such trends to HAZOP deviation logic can make early warning more meaningful and less arbitrary [38,47,48].

However, early warning must be designed carefully. If thresholds are too sensitive, the system may generate excessive alerts and contribute to alarm fatigue. If thresholds are too conservative, the Digital Twin may fail to provide useful warning before escalation. The design of dynamic deviation monitoring therefore requires validation against operating envelopes, process dynamics, known incident mechanisms, and expert judgment. The goal is not to create more alarms, but to provide earlier and more contextual safety information.

5.4. Fault Diagnosis and Cause Ranking

A single HAZOP deviation may have several possible causes [77,78]. For example, high reactor temperature may result from cooling failure, excessive feed concentration, agitator malfunction, control-valve failure, reaction-rate acceleration, or incorrect operating procedure. Conventional monitoring may show that the temperature is increasing, but it may not distinguish between competing causes. A HAZOP-informed Digital Twin can support diagnosis by comparing observed process behavior with expected patterns associated with different causes.

Cause ranking can be supported by process models, fault-detection and diagnosis methods, Bayesian reasoning, machine learning, or hybrid approaches. The role of the Digital Twin is to integrate multiple sources of evidence: process measurements, model residuals, equipment-health indicators, alarm history, maintenance status, and HAZOP cause–consequence logic. The output should not be treated as a final diagnosis unless validated. Instead, it should support expert reasoning by indicating which causes are most consistent with the available evidence [34,47,48].

This diagnostic function is particularly valuable when different causes require different responses. For example, a high-temperature deviation caused by reduced cooling water flow may require checking cooling-water supply, valve position, or exchanger fouling. The same deviation caused by excessive reactant concentration may require different operating actions. By connecting the deviation to likely causes, the Digital Twin can help operators and engineers move from symptom recognition to scenario understanding.

Nevertheless, cause ranking introduces technical and organizational risks. Diagnostic models may be wrong if the plant is operating outside the conditions used for model validation. Sensor faults may create misleading evidence. Multiple faults may occur simultaneously. Maintenance or bypass information may be incomplete. For this reason, cause ranking should be presented with uncertainty, supporting evidence, and clear limitations. The operator should be able to see why a cause was suggested and what additional checks are required before action is taken.

5.5. Safeguard Monitoring and Protection-Layer Awareness

A major advantage of linking HAZOP knowledge to Digital Twin architecture is the possibility of monitoring not only deviations and causes, but also safeguards [29]. In conventional HAZOP worksheets, safeguards are documented as existing protection measures, such as alarms, operator actions, interlocks, relief devices, trips, procedures, or independent protection layers. However, the worksheet may not continuously reflect whether those safeguards remain available, tested, bypassed, degraded, or effective during operation [8,9,12]. Operational drift and management of change gaps contribute to this discrepancy [35,36].

A HAZOP-informed Digital Twin can support protection-layer awareness by linking safeguards to operational and maintenance data. For example, if a high-level deviation relies on a level alarm and operator response, the Digital Twin can check whether the level transmitter is healthy, whether the alarm is active, whether the alarm has been inhibited, and whether the operator has sufficient response time. If a deviation relies on a safety instrumented function, the system can display proof-test status, bypass status, or known maintenance limitations. If a deviation relies on cooling capacity, the Digital Twin can assess whether sufficient cooling margin remains under current conditions.

This function is important because process safety depends not only on identifying hazardous scenarios, but also on confirming that protection layers remain effective. Many major accidents involve situations where safeguards existed on paper but were unavailable, bypassed, poorly maintained, misunderstood, or ineffective under the actual operating conditions. A Digital Twin cannot replace formal safety lifecycle management, but it can provide a more current view of whether the assumptions made in the HAZOP remain valid.

Safeguard monitoring also supports more meaningful prioritization. A developing deviation with all safeguards healthy may require monitoring and engineering review. The same deviation with degraded or unavailable safeguards may require urgent operator action, management attention, or controlled shutdown. In this sense, Digital Twin support can help move HAZOP knowledge from static documentation toward operational risk awareness.

5.6. Functional Summary of HAZOP-Informed Digital Twins

The preceding subsections show that HAZOP-informed Digital Twins can support several distinct but connected safety functions. Table 5 summarizes these functions and illustrates how each contributes to dynamic hazard monitoring. The table also reinforces an important point: the value of a HAZOP-informed Digital Twin is not only its ability to detect abnormal data patterns, but its ability to translate those patterns into HAZOP-relevant safety information that supports operator and engineering judgment.

5.7. Implementation Challenges and Data Requirements

Despite its potential, a HAZOP-informed Digital Twin is difficult to implement in practice [29]. The first challenge is data quality. Safety-relevant monitoring requires reliable sensors, correct tags, consistent timestamps, validated historian data, and clear links between process variables and HAZOP nodes. Poor data quality can lead to false alerts, missed deviations, or misleading diagnostic conclusions.

The second challenge is model validity. A Digital Twin may perform well under normal operating conditions but fail under abnormal, transient, start-up, shutdown, or degraded-equipment scenarios. This is especially important for process safety, where rare abnormal events may be more important than routine steady-state operation. Digital Twin models used for safety support should therefore include validation boundaries, uncertainty estimates, and clear warnings when the process moves outside the model’s reliable domain.

The third challenge is integration with existing safety-management systems. HAZOP-informed Digital Twins must be connected to management of change, alarm management, maintenance, inspection, operating procedures, and incident-learning systems. Without such integration, the Digital Twin may become another isolated digital tool rather than part of the plant safety-management framework.

The fourth challenge is human factors. Operators and engineers must understand what the Digital Twin is showing, how confident the system is, and what actions are expected. If the system produces too many alerts, unclear explanations, or recommendations that conflict with operator experience, trust may decline. Conversely, if the system appears too authoritative, it may encourage automation bias [51,79]. The design of the user interface, explanation logic, and governance process is therefore as important as the model itself.

The fifth challenge is cybersecurity and data governance. A Digital Twin connected to live plant data, safety logic, and decision support becomes part of the broader industrial information environment. It must therefore be protected against unauthorized access, data manipulation, model tampering, and loss of availability. Safety-support systems should be designed with clear access control, audit trails, version management, and validation procedures.

5.8. Critical Assessment of Digital Twin-Based HAZOP Enhancement

Digital Twin architectures offer a strong pathway for enhancing HAZOP because they address a limitation that conventional HAZOP cannot easily solve: the gap between static hazard review and changing operational reality [29]. By connecting HAZOP knowledge to plant data and process models, Digital Twins can support dynamic deviation monitoring, early warning, cause ranking, safeguard awareness, and lifecycle learning.

At the same time, Digital Twin-based HAZOP enhancement should not be overstated. Many current Digital Twin applications in process safety remain conceptual, simulation-based, or limited to specific equipment and monitoring tasks [38,47]. Digital Twin platforms as originally conceived [15,16] are still being adapted for industrial safety use. Fewer studies demonstrate fully integrated systems that connect live plant data to structured HAZOP knowledge, validated diagnostic models, safeguard-status monitoring, and operator decision support. The field is therefore promising, but still developing.

The reviewed literature supports the near-term role of Digital Twins as advisory safety layers. They can help operators and engineers understand how current process behavior relates to known HAZOP scenarios, but they should not replace alarms, safety instrumented systems, formal procedures, or expert judgment. Their outputs must be explainable, validated, auditable, and integrated into existing process safety management systems.

The findings of this section motivate the next pathway: hybrid physics–data models. A Digital Twin can provide the architecture for dynamic monitoring, but its predictive value depends heavily on the quality of the models used to estimate process behavior, forecast deviations, and support diagnosis. The next section therefore examines how hybrid physics–data modeling can strengthen predictive safety analytics in DT–AI-enhanced HAZOP.

6. Hybrid Physics–Data Models for Predictive Safety Analytics

Section 5 examined the Digital Twin architecture required to connect structured HAZOP knowledge with live process data, model-based monitoring, and operator decision support. However, the value of a HAZOP-informed Digital Twin depends strongly on the quality of the models used inside it. A Digital Twin can only provide meaningful early warning if it can estimate the current process state, predict how abnormal conditions may evolve, and relate those predictions to known HAZOP deviations. This is where hybrid physics–data models become important.

Hybrid physics–data models combine first-principles process knowledge with data-driven learning. In process safety, this combination is attractive because neither purely mechanistic nor purely data-driven models are sufficient in all situations. First-principles models provide physical consistency and extrapolation discipline, but they may be incomplete, expensive to maintain, or too slow for real-time use. Data-driven models can learn complex patterns from plant data, but they may fail when the process moves outside the training domain, when sensors drift, or when rare abnormal events are not well represented in historical data. Hybrid models attempt to balance these limitations by combining physical structure with statistical adaptability.

In the context of HAZOP enhancement, the role of hybrid modeling is not simply to improve prediction accuracy. Its deeper contribution is to support predictive safety reasoning. A hybrid model can estimate whether a process is moving toward a known deviation, forecast the time available before a safety or operating limit is reached, distinguish between alternative causes of the same deviation, and quantify uncertainty in the prediction. These functions can help transform HAZOP from a static record of possible deviations into a dynamic source of predictive safety intelligence.

6.1. Why Predictive Models Matter for HAZOP Enhancement

Conventional HAZOP identifies credible deviations, causes, consequences, and safeguards, but it does not continuously predict when a deviation may develop during operation [46,76]. In practice, many hazardous scenarios evolve gradually [46,76]. Heat-transfer fouling may reduce cooling margin over weeks or months. Catalyst deactivation may shift operating conditions toward higher temperature or lower conversion. Compressor performance degradation may reduce flow stability. Sensor drift may obscure the true process state. Control-loop deterioration may allow disturbances to propagate further than expected. These changes may not immediately trigger alarms, but they can reduce the safety margin assumed during the original HAZOP study.

Predictive models are valuable because they can estimate process behavior before a conventional alarm limit is crossed. For example, a model may forecast that reactor temperature will exceed a safe operating limit if cooling performance continues to deteriorate. It may estimate that a distillation column is approaching flooding conditions based on pressure-drop trends and changing separation performance. It may identify that a heat exchanger is losing duty in a way that increases the likelihood of a downstream high-temperature deviation. In each case, prediction provides time for diagnosis and response before the process reaches a more critical state.

This predictive role is closely connected to HAZOP logic. A model prediction becomes more useful when it is interpreted through the node–deviation–cause–consequence–safeguard framework. Instead of simply stating that a temperature is expected to increase, the Digital Twin can relate the prediction to a HAZOP deviation such as “MORE temperature”, identify likely causes such as cooling loss or increased reaction rate, evaluate possible consequences, and prompt verification of relevant safeguards. This connection gives model outputs process-safety meaning.

However, predictive modeling for process safety is more demanding than ordinary process optimization. The model must remain credible under abnormal, transient, degraded, and uncertain conditions. It must also communicate uncertainty and avoid creating false confidence. In HAZOP-informed Digital Twins, prediction should therefore be treated as an advisory input to expert judgment, not as an automatic decision-maker.

6.2. First-Principles, Data-Driven, and Hybrid Modeling Approaches

Three broad modeling approaches are relevant to predictive safety analytics: first-principles models, data-driven models, and hybrid physics–data models. Each approach contributes something useful, but each also has limitations that become important in safety-critical use.

First-principles models describe process behavior using conservation laws, thermodynamics, reaction kinetics, transport phenomena, and equipment-performance relationships. In chemical engineering, these models are attractive because their structure reflects the physical behavior of the process. A reactor energy balance, for example, can represent the relationship between heat generation, heat removal, temperature rise, and cooling-system performance. A heat-exchanger model can represent how fouling or reduced flow affects heat-transfer duty. A distillation model can relate pressure, temperature, vapor–liquid equilibrium, and separation performance. Because these models are physically meaningful, their outputs can often be interpreted by engineers and linked to HAZOP deviations.

The main limitation of first-principles models is that they may not fully represent the operating plant. Parameters such as heat-transfer coefficients, catalyst activity, fouling resistance, reaction-rate constants, valve characteristics, or compressor efficiency may change over time. Detailed dynamic models may also require significant effort to build, calibrate, and maintain. In some cases, they may be computationally demanding or unavailable for legacy units. Therefore, although first-principles models provide a strong physical foundation, they may not be sufficient on their own for real-time predictive safety support.

Data-driven models take the opposite approach. Instead of starting from governing equations, they learn relationships from historical or real-time process data. Statistical process monitoring, machine learning, deep learning, and sequence models can identify multivariable patterns, classify faults, detect anomalies, or forecast trends in plant operation. Data-driven process monitoring and diagnosis have a long history in process systems engineering and remain highly relevant to Digital Twin applications [47,68]. These methods are useful when the process is highly instrumented and when sufficient historical data are available.

The limitation of data-driven models is that they may learn correlations without understanding the underlying physical mechanism. A model may perform well for normal operating data but fail during rare abnormal events, start-up, shutdown, equipment degradation, or operating conditions outside the training domain. This is especially problematic for process safety because hazardous scenarios are often rare, data-sparse, and difficult to reproduce deliberately. A purely data-driven model may therefore appear accurate while still being unreliable for the conditions that matter most for HAZOP-informed early warning.

Hybrid physics–data models attempt to combine the strengths of both approaches. In one form, a first-principles model provides a baseline prediction, while a data-driven model learns the residual between the baseline and the observed plant behavior. In another form, machine learning is constrained by physical relationships, conservation laws, monotonic behavior, or known operating limits. A third form uses physics-informed machine learning, where governing equations or physical residuals are embedded directly into the learning process [53]. Applications in process monitoring and fault detection have demonstrated the effectiveness of this approach [80,81,82]. More broadly, informed and science-guided machine learning provides a framework for integrating engineering knowledge into data-driven models [14,26].

This hybrid approach is especially suitable for HAZOP-informed Digital Twins. The physical component helps prevent physically unrealistic predictions and gives the model engineering meaning. The data-driven component allows the model to adapt to plant-specific behavior, degradation, and operating history. Together, they can support prediction, diagnosis, and uncertainty-aware decision support while remaining more interpretable than a purely black-box model.

Figure 4 illustrates how first-principles process knowledge and plant data can be combined in hybrid physics–data models to support predictive safety analytics and HAZOP-informed decision support.

6.3. Model-Based Early Warning and Time-to-Limit Prediction

One of the most important contributions of hybrid models is their ability to support early warning [46,48,76]. Conventional alarms normally activate when a measured variable crosses a predefined threshold. This is necessary for safe operation, but it may provide limited warning for slowly developing abnormal conditions. A HAZOP-informed Digital Twin can go further by estimating whether the process is moving toward a known deviation and how much time remains before an operating or safety limit may be reached.

Time-to-limit prediction is particularly useful because it connects model forecasting to operational decision-making [76,77]. Instead of only reporting that a variable is increasing, the system can estimate when the variable may reach a critical limit if the current trend or fault condition continues. For example, if reactor temperature is rising because cooling duty is decreasing, the model may estimate the remaining time before the reactor approaches a high-temperature operating limit. If a distillation column pressure drop is increasing, the model may estimate the time before flooding risk becomes significant. If heat-exchanger fouling is progressing, the model may estimate when downstream temperature control will no longer remain within the acceptable envelope.

This function has direct value for HAZOP enhancement because HAZOP scenarios are often expressed as deviations from design intent. The Digital Twin can translate a predicted trajectory into HAZOP language: the process is moving toward “MORE temperature”, “LESS flow”, “MORE pressure”, or another documented deviation. It can then connect that prediction to likely causes, consequences, safeguards, and recommended verification. In this way, early warning becomes more than a statistical alert; it becomes a process-safety interpretation of the developing condition.

Time-to-limit prediction must also consider uncertainty. A forecast based on noisy data, uncertain parameters, or extrapolation outside the validated model domain should not be presented with the same confidence as a forecast supported by reliable measurements and validated model behavior. The system should therefore communicate both the estimated time-to-limit and the confidence in that estimate. This is important because operators may respond differently to a highly certain short time-to-limit than to a highly uncertain advisory trend.

The design of early-warning thresholds also requires care. If the system is too sensitive, it may generate excessive warnings and contribute to alarm fatigue. If it is too conservative, it may fail to provide useful warning before escalation. Therefore, model-based early warning should be validated using expert-reviewed abnormal scenarios, plant operating envelopes, available incident data, and dynamic simulations where direct plant data are unavailable. The goal is not to replace conventional alarms, but to provide an earlier advisory layer that helps operators and engineers recognize developing HAZOP-relevant scenarios.

6.4. Fault Diagnosis and Deviation–Cause Discrimination

A major challenge in HAZOP-informed monitoring is that one deviation may have several possible causes [48,77,78]. A high-temperature deviation may arise from cooling failure, excessive reactant concentration, heat-transfer fouling, agitator malfunction, control-valve failure, or incorrect procedure. A low-flow deviation may result from pump degradation, blocked filters, valve malfunction, low suction pressure, or instrumentation error. Effective response depends on distinguishing between these competing causes.

Hybrid models can support this task [77,78] by comparing measured behavior with expected patterns under different fault hypotheses. A physics-based model can represent how the process should behave under normal operation. Deviations between predicted and measured behavior can then be analyzed as residuals. Data-driven components can classify residual patterns, rank likely causes, or detect slow degradation. This combination supports diagnosis while preserving some connection to the physical process.

In a HAZOP-informed Digital Twin, the cause list in the HAZOP worksheet provides a structured diagnostic frame. The model does not need to search an unlimited space of possible faults. Instead, it can evaluate which documented causes are most consistent with the current evidence. This makes diagnosis more aligned with process safety practice and more explainable to operators and engineers.

However, cause discrimination remains difficult. Multiple faults can occur together. A sensor fault can mimic a process fault. Some causes may produce similar symptoms. Plant operation may move outside the model validation region. For this reason, hybrid-model diagnosis should be presented as ranked evidence rather than as a final conclusion. The system should indicate which causes are plausible, what evidence supports them, and what additional checks are needed.

6.5. Uncertainty, Model Drift, and Validation

Uncertainty management is central to the safe use of hybrid models [46,83]. In process safety, an incorrect prediction may have serious consequences. A false negative may fail to warn of a developing hazardous condition. A false positive may contribute to alarm fatigue or unnecessary intervention. The model should therefore provide not only a prediction, but also information about confidence, uncertainty, and validity.

Several types of uncertainty are relevant. Measurement uncertainty arises from sensor noise, drift, calibration error, or missing data. Parameter uncertainty arises when model parameters such as heat-transfer coefficients, reaction-rate constants, fouling factors, or valve characteristics are not known exactly. Structural uncertainty arises when the model does not fully represent the real process. Operational uncertainty arises when feed composition, production rate, ambient conditions, or equipment status changes.

Model drift is also important. A model that was valid during commissioning may become less accurate as equipment ages, fouling develops, catalysts deactivate, or operating strategy changes. In a HAZOP-informed Digital Twin, model drift is not only a performance issue; it is a safety issue because the model may understate or overstate the margin to a hazardous deviation. Continuous monitoring of model residuals, periodic validation, recalibration, and clear model-management procedures are therefore necessary.

Validation should include more than fitting historical data. For safety applications, the model should be tested against abnormal scenarios, transient conditions, start-up and shutdown cases, degraded-equipment behavior, and known incident mechanisms where possible. The model should also be evaluated for its ability to avoid dangerous omissions. In process safety, missing a credible hazardous trajectory may be more serious than generating additional cases for expert review.

Safety assurance for machine-learning-based systems provides useful principles here, including the need for lifecycle validation, monitoring, and explicit treatment of uncertainty and operational boundaries [83]. These principles are directly relevant to hybrid models used in HAZOP-informed Digital Twins.

6.6. Comparative Assessment of Modeling Approaches

Table 6 summarizes the main modeling approaches relevant to predictive safety analytics and their roles in HAZOP-informed Digital Twins [46,48,78].

6.7. Critical Assessment of Hybrid Models for HAZOP Enhancement

Hybrid physics–data models offer a strong pathway for HAZOP enhancement because they address one of the main limitations of static hazard review: the inability to predict how safety margins change during operation [46,76]. The combination of first-principles knowledge with data-driven adaptability is particularly valuable in process safety contexts [46,78]. By combining physical process understanding with data-driven adaptation, hybrid models can support early warning, time-to-limit estimation, fault diagnosis, and dynamic risk awareness.

At the same time, their role should not be overstated. A hybrid model is not automatically safe because it contains physics, and it is not automatically accurate because it uses plant data. The model must be validated, monitored, maintained, and interpreted within a clear safety-management framework. It must also be connected to HAZOP knowledge in a disciplined way. Otherwise, model outputs may remain disconnected from the deviation–cause–consequence–safeguard logic that gives HAZOP its safety value.

The reviewed literature supports the role of hybrid models as predictive decision-support tools. They can help operators and engineers understand whether a known deviation is developing, how quickly the process may approach a hazardous limit, and which causes are most consistent with the evidence. However, the final judgment about risk significance, safeguard adequacy, and required action must remain with qualified personnel.

The findings of this section motivate the next pathway: explainable AI. Predictive models can only support safety decisions if their outputs are understandable, trustworthy, and auditable. The next section therefore examines explainable AI, operator trust, and regulatory acceptance in DT–AI-enhanced HAZOP.

7. Explainable AI, Operator Trust, and Regulatory Acceptance

Section 6 examined how hybrid physics–data models can support predictive safety analytics by forecasting deviations, estimating time-to-limit, ranking possible causes, and communicating uncertainty. However, prediction alone is not sufficient for process safety. In high-hazard operations, an AI-generated alert or recommendation must be understandable, technically credible, auditable, and acceptable to the people who must act on it. This makes explainable AI (XAI), operator trust, and regulatory acceptance central to DT–AI-enhanced HAZOP.

Explainable AI is especially important because HAZOP is built on transparent expert reasoning. A conventional HAZOP worksheet records the logic connecting a deviation to its causes, consequences, safeguards, and recommendations. If AI or Digital Twin systems are introduced into this workflow, their outputs must preserve this traceability. A black-box model that predicts a hazardous state without explaining the supporting evidence may have limited practical value, even if its statistical performance appears strong. Operators, process engineers, safety specialists, and regulators need to understand why the system produced a warning, what assumptions were used, which variables contributed to the result, and whether the recommendation lies within the validated operating domain of the model [83,84,85].

The reviewed literature indicates that explainability should not be treated as an optional visualization feature added after model development. For HAZOP-informed Digital Twins, explainability must be built into the safety-support architecture. Explanations should be expressed in process-safety terms: deviation, cause, consequence, safeguard, uncertainty, and recommended verification. This section reviews the role of XAI in safety-critical decision support, the relationship between explanation and operator trust, the regulatory and auditability requirements for DT–AI-enhanced HAZOP, and the limitations of explainability as a risk-control measure.

7.1. Why Explainability Matters in HAZOP-Informed Digital Twins

In many industrial AI applications, explanation is valued because it improves user understanding of model behavior. In process safety, the requirement is stronger. Explanation is needed because decisions may involve hazardous materials, high-energy systems, environmental consequences, production losses, and risks to personnel. A safety-support system that cannot explain its reasoning may be difficult to trust, difficult to validate, and difficult to defend during audits or incident investigations.

For HAZOP enhancement, explainability has a specific meaning. A useful explanation should not only identify which input variables influenced a model output. It should connect the output to the HAZOP reasoning structure. For example, if a Digital Twin generates an early warning for a reactor, the explanation should indicate the relevant HAZOP deviation, such as “MORE temperature”, the likely causes, such as reduced cooling duty or increased reaction rate, the possible consequences, such as pressure rise or runaway risk, and the safeguards that should be verified. This type of explanation is more useful to operators than a generic machine-learning feature-importance plot.

This distinction is important because many XAI methods were developed for general machine-learning applications rather than process safety. Common techniques such as feature attribution, local explanations, surrogate models, counterfactual explanations, or saliency measures may help identify variables that influenced a prediction, but they do not automatically produce safety-relevant explanations [84,85]. Methods such as LIME [86] and SHAP [87] are widely used but require engineering interpretation. Widely used post-hoc explanation methods include SHAP (SHapley Additive exPlanations), which assigns each feature a contribution value based on game-theoretic principles [87], and LIME (Local Interpretable Model-agnostic Explanations), which builds locally faithful surrogate models around individual predictions [86]. In HAZOP-informed systems, the explanation must be translated into engineering meaning. It should help the user answer practical questions: What is changing? Why does it matter? What scenario may be developing? Which safeguards are involved? What should be checked next?

Explainability also supports accountability. In conventional process safety practice, HAZOP records, alarm rationalization documents, operating procedures, and management-of-change records create an auditable trail. DT–AI systems should preserve the same discipline. The system should record which model version was used, what data were available, what assumptions were applied, what warning was generated, what explanation was shown, and what human action was taken. Without this traceability, AI-generated recommendations may create uncertainty about responsibility and decision authority.

7.2. Interpretability versus Explainability: A Critical Distinction for Safety

A distinction that is often blurred in the AI literature but is consequential for safety-critical applications is the difference between interpretability and explainability. An interpretable model is one whose internal structure can be directly examined and understood by a qualified human: decision trees, linear regression models, rule-based systems, and Bayesian networks fall into this category. An explainable model, by contrast, may be internally opaque (a deep neural network, a gradient-boosted ensemble, or a large language model), but is accompanied by a post-hoc explanation method that approximates why a given output was produced [25,86,87].

For HAZOP-informed Digital Twins, this distinction has direct implications. Interpretable models provide a safety advantage: their reasoning can be reviewed by process engineers, auditors, and regulators without requiring additional explanation tools. If a Bayesian network predicts a high probability of a high-temperature deviation, the conditional probability tables can be inspected and the reasoning chain can be traced. This traceability is closely aligned with the documentation culture of process safety. Explainable models, by contrast, provide post-hoc approximations that may not fully capture the model’s true decision boundary, may not be stable across similar inputs, and may produce explanations that are locally plausible but globally misleading [88].

The practical implication is that, for safety-critical HAZOP applications, interpretability should be preferred over explainability wherever model performance is adequate. When complex models are necessary to capture nonlinear process behavior, post-hoc explanation methods should be used with explicit acknowledgment of their limitations. In no case should an explanation be treated as a verified causal account of the model’s reasoning. It is an approximation that supports human review, not a substitute for it.

7.3. Forms of Explainability Relevant to Process Safety

Different forms of explainability are relevant to DT–AI-enhanced HAZOP. The first is model transparency. Some models are naturally more interpretable than others. Rule-based systems, decision trees, linear models, Bayesian networks, and simplified mechanistic models can often be inspected more directly than deep neural networks. Transparent models may be attractive for safety-related applications because their reasoning can be reviewed by engineers and auditors. However, simple models may not always capture complex nonlinear process behavior.

The second form is post-hoc explanation. In this approach, the AI model may be complex, but additional methods are used to explain its outputs after prediction. Examples include feature-importance methods, local surrogate models, sensitivity analysis, and counterfactual reasoning [84,85,86]. Process-safety-specific XAI applications have built on these foundations [88]. SHAP [87] and LIME [86] are among the most widely applied post-hoc explanation methods and have been used in process safety fault detection and anomaly classification tasks. These methods can be useful, but they must be interpreted carefully. A feature-importance result may show that reactor temperature, cooling-water flow, and feed concentration influenced a prediction, but it does not by itself confirm the causal mechanism or the adequacy of safeguards. Engineering interpretation remains necessary.

The third form is physics-based explanation. In hybrid physics–data models, explanations can be supported by physical relationships such as mass balances, energy balances, thermodynamic constraints, kinetic behavior, or equipment-performance indicators. This form of explanation is particularly valuable in chemical engineering because it connects model outputs to familiar engineering concepts. For example, an early warning may be explained by a decreasing heat-removal margin, increasing fouling resistance, rising reaction heat, or declining compressor efficiency.

The fourth form is HAZOP-structured explanation. This is the most important form for the present review. In this approach, the explanation is organized around the HAZOP logic itself: node, parameter, deviation, cause, consequence, safeguard, and recommendation. The AI system may use machine learning, probabilistic reasoning, or hybrid modeling internally, but the output is translated into the structure that process safety teams already use. This makes the system easier to review and more compatible with existing safety-management practices.

The fifth form is uncertainty explanation. In safety-critical settings, the system should not only say what it predicts, but also how confident it is and why. Uncertainty may arise from sensor quality, missing data, model extrapolation, parameter uncertainty, or conflicting evidence. Communicating uncertainty helps prevent overconfidence and supports more cautious decision-making. A warning with high uncertainty may still be useful, but it should be presented differently from a warning supported by strong evidence.

7.4. Operator Trust and Human-in-the-Loop Decision-Making

Trust is essential for the practical adoption of DT–AI-enhanced HAZOP. If operators do not trust the system, they may ignore warnings or treat the Digital Twin as irrelevant. If they trust it too much, they may accept AI outputs without sufficient questioning. Both situations are unsafe. The aim is therefore not maximum trust, but calibrated trust: users should rely on the system when it is valid and question it when evidence, context, or model limits require caution [89,90]. Trust calibration in human–AI teaming has been studied in industrial and safety-critical contexts [91,92].

Operator trust depends on several factors. The first is technical reliability. The system must provide useful warnings without excessive false alarms or missed detections. The second is explanation quality. Users should understand why a warning was generated and what evidence supports it. The third is consistency with process knowledge. A recommendation that contradicts operator experience without explanation may reduce trust. The fourth is interface design. Information should be presented clearly, without overloading operators during abnormal situations. The fifth is governance. Operators should know whether the system is advisory, mandatory, or linked to any automatic action.

Human-in-the-loop decision-making is therefore central to DT–AI-enhanced HAZOP. The AI system should support recognition, diagnosis, prioritization, and response, but the final judgment should remain with qualified personnel and established safety-management procedures. This is especially important when the system is used to support decisions involving shutdown, bypass management, emergency response, or changes to operating limits.

A useful human-in-the-loop system should show the detected deviation, likely causes, supporting evidence, relevant safeguards, uncertainty level, and recommended checks. It should also allow operators and engineers to provide feedback. If a warning is confirmed, rejected, or modified, that information can be used to improve the knowledge base and model performance. In this way, operator interaction becomes part of lifecycle learning rather than a passive response to AI output.

However, human-in-the-loop design also introduces challenges. Operators may experience alarm fatigue if the system generates too many advisory messages. They may experience automation bias if the system appears authoritative or if explanations are presented too confidently [50,58]. They may also experience workload increase if the system provides complex explanations during time-critical situations. For this reason, explanation design must be aligned with operating context. A control-room operator may need a concise explanation and clear action prompt, while a process engineer or HAZOP facilitator may need deeper diagnostic detail and historical evidence.

A further concern is the risk of skill erosion and de-skilling. If DT–AI systems routinely perform deviation detection, cause ranking, and safeguard verification, operators and HAZOP facilitators may progressively lose the manual competence and situational awareness required to perform these tasks independently. This is especially important for rare or severe abnormal situations, which are precisely the scenarios where DT–AI systems are most likely to fail or operate outside their validated domain. If human experts have reduced their direct engagement with the process because the AI system handles routine monitoring, the consequences of an AI failure during a critical event may be more severe than if the monitoring had always been manual. Organizations deploying DT–AI HAZOP support should therefore maintain training programs, periodic manual exercises, and competency verification to ensure that human expertise does not atrophy [51]. The AI system should be positioned as a tool that augments expert capability, not one that substitutes for it over time.

Automation complacency is a related and well-documented human factors phenomenon. Research in aviation, nuclear power, and process industries has shown that when automated systems are reliable most of the time, human operators tend to reduce their vigilance and may fail to detect errors or anomalies introduced by the automation itself [24,48]. This complacency effect has been documented in AI-assisted safety contexts as well [58,79]. In the DT–AI HAZOP context, complacency risk arises when operators accept AI-generated deviation alerts without independent verification, when HAZOP facilitators rely on AI-generated scenario lists without applying their own process knowledge, or when safety managers assume that DT monitoring provides coverage equivalent to a formal HAZOP revalidation. Mitigating complacency requires clear communication of system limitations, regular reminders of the advisory status of AI outputs, and governance procedures that require human sign-off on safety-critical decisions regardless of AI recommendation.

7.5. Human Factors and Automation Governance

The deployment of AI-assisted tools in safety-critical environments introduces a set of human factors challenges that are distinct from those encountered in conventional HAZOP practice. These challenges have been extensively studied in aviation, nuclear power, and process control, and their lessons are directly applicable to DT–AI HAZOP enhancement [89,92].

7.5.1. Trust Calibration and Automation Complacency

A central concern is automation complacency: the tendency for operators to over-rely on automated systems, reducing vigilance and independent verification [91,92]. Research in analogous domains consistently shows that automation complacency is not simply a matter of individual operator psychology, but emerges from the interaction between system design, organizational culture, and workload distribution [89,90,93]. Cognitive modeling studies demonstrate that adaptive transparency—where the system adjusts the amount of information it provides based on estimated operator cognitive load and trust calibration—can mitigate complacency by supporting more accurate mental models of system limitations [93].

In the HAZOP context, automation complacency is particularly dangerous because HAZOP is a safety-critical activity where missed deviations or incorrectly dismissed AI-generated alerts can have severe consequences [89,92]. The risk is not that AI will replace expert judgment, but that operators may defer to AI outputs without adequate critical evaluation, especially under time pressure or high workload [90,94]. Governance frameworks must therefore explicitly address how AI recommendations are reviewed, challenged, and overridden by human experts [58,95].

7.5.2. Skill Development and Knowledge Maintenance

A second concern is the potential for skill atrophy: as AI systems take over routine HAZOP tasks (deviation identification, cause-consequence lookup, safeguard verification), human practitioners may lose the deep process knowledge and analytical skills needed to handle novel or edge-case scenarios that fall outside the AI system’s training distribution [89,94]. This is a well-documented phenomenon in aviation (automation-induced skill degradation) and is beginning to be discussed in process safety contexts [92].

Mitigation strategies include: (a) preserving human-led HAZOP sessions for complex, novel, or high-consequence scenarios; (b) requiring operators to independently verify a random sample of AI-generated recommendations; (c) incorporating AI-assisted HAZOP into training programs to build familiarity with both the tool’s capabilities and its failure modes; and (d) maintaining documentation of human reasoning alongside AI outputs to preserve institutional knowledge [58,89,94].

7.5.3. Human–AI Interface Design Principles

Effective human-AI collaboration in HAZOP requires careful attention to interface design [90,93]. Key principles from the human factors literature include:

• Calibrated uncertainty communication: AI systems should communicate not only their recommendations but also their confidence levels and the basis for those recommendations, enabling operators to make informed decisions about when to trust and when to override [85,93].
• Explanation in domain language: XAI outputs must be expressed in HAZOP terminology (deviation, cause, consequence, safeguard) rather than in ML-centric terms (feature importance, SHAP values) to be actionable for process safety engineers [84,85,88].
• Graceful degradation: Systems should degrade gracefully when operating outside their validated envelope, providing clear warnings to operators rather than silently extrapolating from training data [89,96].
• Appropriate automation level: Research consistently shows that moderate automation levels—where the AI assists and flags rather than decides—maintain healthier trust calibration and better overall decision quality than high automation levels that minimize human involvement [90,93].

7.5.4. Organizational and Regulatory Dimensions

Beyond individual operator behavior, the deployment of AI in HAZOP requires organizational changes in roles, responsibilities, and governance [58,89]. Safety management systems must be updated to define who is responsible for verifying AI-generated HAZOP outputs, how conflicts between AI recommendations and expert judgment are resolved, and how AI system performance is monitored over time [94,95]. Regulatory frameworks are beginning to address these questions, but clear guidance for AI-assisted HAZOP in regulated industries (e.g., COMAH, PSM, SEVESO) remains limited [89,97].

7.6. Regulatory Acceptance, Auditability, and Governance

Regulatory acceptance is a major consideration for DT–AI-enhanced HAZOP. Process safety regulation and guidance place strong emphasis on systematic hazard identification, documentation, implementation of recommendations, management of change, operating procedures, training, mechanical integrity, and auditing [8,9]. PSM regulatory frameworks and industry standards reinforce these requirements [36,37]. AI-supported systems must also satisfy requirements for auditability and validation [21,48]. AI-supported systems must be compatible with these expectations rather than operating outside them.

A key requirement is auditability. A regulator, auditor, or internal safety team should be able to understand how the system works at an appropriate level, what role it plays in decision-making, how it was validated, and how its outputs are controlled. This does not necessarily mean that every mathematical detail of a complex model must be transparent to every user. It does mean that the system must have documented scope, assumptions, data sources, validation evidence, limitations, and change-control procedures.

Model governance is also essential. A DT–AI system used for safety support should have version control, configuration management, access control, validation records, performance monitoring, and procedures for update or rollback. If the model is retrained, recalibrated, or modified, the change should be assessed in the same disciplined manner expected for other safety-relevant systems. In many cases, this should be linked to management-of-change processes.

The boundary between advisory support and safety-critical control must also be clear. A Digital Twin that provides advisory warnings is different from a safety instrumented system that initiates protective action. If AI outputs are used only to support human decision-making, the regulatory expectations may differ from those for automated protection systems. However, even advisory systems can influence safety-critical decisions. Therefore, their limitations and authority must be clearly defined.

Regulatory acceptance will also depend on evidence maturity. A method demonstrated in a simulation study may be useful for research, but it is not equivalent to an industrially validated safety-support tool. Evidence should include performance testing, abnormal-scenario evaluation, uncertainty analysis, human factors assessment, failure-mode analysis, cybersecurity review, and operational feedback. This is particularly important for generative AI and LLM-based tools, where plausible outputs may conceal technical errors or missing scenarios [25].

The emerging regulatory landscape for AI in safety-critical systems is also relevant. The European Union Artificial Intelligence Act (EU AI Act, 2024) classifies AI systems used in safety-critical infrastructure as high-risk, imposing requirements for conformity assessment, technical documentation, transparency, human oversight, robustness, and accuracy. Although the Act does not specifically address process safety HAZOP tools, its principles apply directly to AI systems that support safety-critical decisions in chemical and process plants. Similarly, emerging guidance from standards bodies such as ISO/IEC 42001 (AI management systems), IEC 61508 (functional safety of electrical and electronic systems), and developing frameworks for AI safety assurance (such as UL 4600 for autonomous systems) are beginning to shape expectations for AI in safety-critical environments. Organizations planning to deploy DT–AI HAZOP support systems should engage proactively with these frameworks rather than waiting for sector-specific guidance. Demonstrating alignment with high-risk AI requirements, including risk management, data governance, model documentation, human oversight mechanisms, and post-deployment monitoring, will be important for gaining regulatory acceptance and maintaining social license to operate [61,64].

7.7. Failure Modes of Explainable AI in Safety-Critical Use

Although explainability is necessary, it is not sufficient [58]. Explanations can fail in several ways. The first failure mode is superficial explanation. A system may provide a visually attractive explanation that appears useful but does not reflect the true model logic or the real process mechanism. This can create false confidence.

The second failure mode is technically correct but operationally unhelpful explanation. For example, a feature-importance plot may identify several influential variables, but it may not help an operator decide which safeguard to check or which action to take. For process safety, explanations must be actionable and aligned with operating procedures.

The third failure mode is misleading causal interpretation. Many XAI methods explain statistical associations rather than causal mechanisms. A model may identify cooling-water flow as important, but this does not automatically prove that cooling failure is the cause of the deviation. Engineering judgment and additional evidence remain necessary.

The fourth failure mode is explanation overload. During abnormal operation, users may not have time to read complex explanations. Too much information can delay response or increase cognitive burden. The explanation must therefore be layered: concise for immediate operation, with deeper detail available for engineering review.

The fifth failure mode is overtrust. If an explanation appears clear and confident, users may assume that the model is correct even when the system is operating outside its validated domain. For this reason, explanations should include uncertainty, model validity status, and warnings when inputs are outside the training or validation envelope.

These failure modes show that XAI should be treated as part of a broader risk-control strategy. It must be combined with model validation, human factors design, governance, training, and clear accountability. In this sense, XAI is not a substitute for safety assurance; it is one element of a wider assurance framework for AI-supported process safety [83].

7.8. Practical Requirements for Explainable DT–AI HAZOP Support

For DT–AI-enhanced HAZOP to be credible in industrial practice, explainability should be designed around practical requirements [58,89,94]. First, explanations should be HAZOP-aligned. The system should express its output in terms of node, deviation, cause, consequence, safeguard, uncertainty, and recommended verification.

Second, explanations should be evidence-based [58]. The system should show which measurements, model predictions, residuals, trends, or historical cases support the alert. This allows operators and engineers to challenge the output rather than accepting it blindly.

Third, explanations should be uncertainty-aware. The system should indicate whether the prediction is reliable, whether the model is extrapolating, whether sensor data are questionable, and whether multiple causes remain plausible.

Fourth, explanations should be role-specific. Operators, process engineers, maintenance personnel, safety engineers, and auditors need different levels of detail. A single explanation format may not serve all users.

Fifth, explanations should be auditable. The system should preserve records of alerts, explanations, model versions, input data, human decisions, and follow-up actions. This audit trail is essential for learning, accountability, and regulatory confidence.

Sixth, explanations should support lifecycle learning. If the system identifies a recurring deviation or a previously undocumented causal pathway, the information should feed back into HAZOP revalidation, management of change, alarm management, operating procedures, and training.

Table 7 summarizes these practical explainability requirements and links them to implementation implications for HAZOP-informed Digital Twins.

7.9. Critical Assessment of XAI for HAZOP Enhancement

Explainable AI provides an essential pathway for DT–AI-enhanced HAZOP because it addresses the human and organizational side of digital safety support [89,91,94]. Without explainability, even technically strong AI models may be difficult to trust, validate, audit, or adopt. With appropriate explainability, AI outputs can be translated into process-safety language and integrated more effectively into operator decision-making and safety-management systems.

However, explainability should not be oversold. An explanation does not prove that a model is correct. It does not guarantee that the training data were representative, that the model will generalize to abnormal conditions, or that the recommendation is operationally practical. Explainability is therefore a necessary condition for adoption, but not a sufficient condition for safety.

Figure 5. XAI explainability chain for HAZOP-informed Digital Twin support. The four-stage pipeline transforms real-time plant data into operator-actionable decisions: (1) AI Prediction detects deviations and generates anomaly scores; (2) Feature Attribution quantifies the contribution of key process variables using SHAP and LIME; (3) HAZOP-Language Explanation translates attribution results into structured process safety terms (deviation, cause, consequence, safeguard); and (4) Operator Action presents human-in-the-loop decision options. A feedback loop returns operational decisions to update the knowledge base, supporting continuous model improvement.

Figure 5. XAI explainability chain for HAZOP-informed Digital Twin support. The four-stage pipeline transforms real-time plant data into operator-actionable decisions: (1) AI Prediction detects deviations and generates anomaly scores; (2) Feature Attribution quantifies the contribution of key process variables using SHAP and LIME; (3) HAZOP-Language Explanation translates attribution results into structured process safety terms (deviation, cause, consequence, safeguard); and (4) Operator Action presents human-in-the-loop decision options. A feedback loop returns operational decisions to update the knowledge base, supporting continuous model improvement.

XAI is best positioned in HAZOP-informed Digital Twins to make advisory outputs understandable, challengeable, and auditable. It should help users see which deviation is developing, which causes are plausible, which consequences matter, which safeguards should be verified, and how reliable the model output is. The final decision should remain within expert-led process safety practice, supported by established procedures and governance.

The findings of this section complete the four technology pathways examined in Sections 4–7. AI-assisted HAZOP supports knowledge capture and reuse; Digital Twin architectures connect hazard knowledge to operational data; hybrid physics–data models enable predictive safety analytics; and explainable AI supports trust, auditability, and regulatory acceptance. The next section therefore evaluates the industrial maturity of these pathways and the extent to which they have moved from conceptual or prototype demonstrations toward practical deployment.

8. Industrial Applications and Technology Maturity

Sections 4–7 examined four complementary pathways for DT–AI-enhanced HAZOP: AI-assisted HAZOP, Digital Twin-based monitoring, hybrid physics–data models, and explainable AI. These pathways show strong conceptual potential, but their industrial maturity is uneven. Some methods have been demonstrated through case studies, simulations, prototypes, or equipment-specific applications, while fully integrated HAZOP-informed Digital Twin systems remain limited.

This section evaluates the maturity of the four pathways from an implementation perspective. The aim is not simply to list applications, but to distinguish between conceptual proposals, laboratory or simulation demonstrations, prototype systems, and industrially validated tools. This distinction is important because process safety adoption requires more than technical feasibility. A method must also be reliable under abnormal conditions, explainable to users, compatible with existing safety-management systems, auditable, maintainable, and accepted by plant personnel and regulators.

8.1. Evidence Maturity Across the Four Technology Pathways

The four pathways differ significantly in their current level of evidence. AI-assisted HAZOP has a relatively long research history, especially in rule-based, ontology-based, and computer-aided HAZOP methods. These studies show that parts of HAZOP knowledge can be formalized and reused computationally [32,35]. Ontology-based methods and knowledge graphs have extended this formalization [18,19]. Machine learning and NLP approaches have extended this to automated deviation generation and risk classification [62,63]. More recent work on process safety knowledge graphs and NLP-based extraction shows potential for knowledge retrieval [19,67]. LLM-assisted HAZOP approaches have demonstrated capability for documentation support and scenario generation [70,71]. Additional LLM applications to HAZOP and asset integrity have been demonstrated [72,74]. However, most of these applications remain closer to expert-support prototypes than fully validated industrial HAZOP systems.

Digital Twin applications in process safety show increasing maturity, particularly for monitoring, visualization, operator support, and equipment-level safety applications. Digital Twin concepts have been applied to operator-risk prevention in process plants, petrochemical safety improvement, hydrogen refueling station safety, and broader safety-risk analysis [15,16]. Process safety Digital Twin implementations have demonstrated monitoring and decision-support capabilities [38,47]. More recent applications include process safety management in oil and gas operating units [41], cloud-integrated Digital Twin architectures for real-time risk monitoring in oil and gas operations [42], dynamic PSM architectures integrating Digital Twins with machine learning [43], and safety Digital Twins for industrial collaborative robots [45]. These studies demonstrate that Digital Twins can support safety monitoring and decision-making. Nevertheless, many applications remain focused on general monitoring, simulation, visualization, or equipment health, rather than explicit integration with structured HAZOP deviation–cause–consequence–safeguard logic.

Hybrid physics–data models are technically promising because they support prediction under complex and uncertain process conditions. Process fault detection and diagnosis provide strong methodological foundations for predictive safety analytics, as surveyed comprehensively in [98,99]. Physics-informed learning methods have demonstrated capability for process monitoring and fault detection [80,81,82]. Hybrid physics–data models have been applied to predictive safety analytics in industrial process settings [55,56,100]. However, industrial maturity depends strongly on the specific application. Some model-based monitoring and fault diagnosis methods are well established in process systems engineering, while integrated hybrid models for HAZOP-informed early warning remain less mature. Their use in safety-critical decision support still requires stronger validation under abnormal, transient, degraded, and rare-event conditions.

Explainable AI is essential for operator trust and regulatory acceptance, but its maturity in process-safety-specific applications remains developing. General XAI methods and frameworks are well documented [84,85], and process-safety-oriented XAI approaches have been developed [88,101], and safety assurance for machine-learning-based systems has been discussed in broader engineering contexts [83]. However, translating XAI outputs into HAZOP-specific explanations remains an open challenge. Process safety users do not only need feature importance or model transparency; they need explanations expressed in terms of deviation, cause, consequence, safeguard, uncertainty, and recommended verification.

8.2. Technology Readiness Interpretation

Technology Readiness Level (TRL) is a useful, although imperfect, way to discuss maturity [27,58]. In the context of DT–AI-enhanced HAZOP, the lowest maturity level corresponds to conceptual frameworks or theoretical proposals. Intermediate maturity corresponds to simulation studies, retrospective case studies, proof-of-concept tools, or prototype systems tested on limited process examples. Higher maturity would require sustained industrial deployment, validated performance under real operating conditions, integration with existing safety-management systems, documented governance, and evidence of user acceptance.

Most DT–AI approaches for HAZOP enhancement currently appear to sit in the intermediate range rather than at full industrial maturity. AI-assisted HAZOP tools often demonstrate knowledge formalization or scenario generation, but not always long-term integration with industrial HAZOP workflows. Digital Twin applications may demonstrate real-time monitoring or dynamic simulation, but not always explicit linkage to HAZOP knowledge. Hybrid models may demonstrate prediction or fault diagnosis, but not always safety-case validation. XAI methods may explain model outputs, but not always in process-safety language suitable for operators and auditors.

For this reason, it is more accurate to describe the field as promising but not yet fully mature. The evidence supports the feasibility of individual components, but fewer studies demonstrate the full lifecycle chain: HAZOP knowledge formalization, live plant data integration, predictive modeling, explainable AI output, safeguard-status verification, human-in-the-loop decision support, and feedback into HAZOP revalidation.

8.3. Industrial Application Domains

Potential application domains for HAZOP-informed Digital Twins include reactors, distillation columns, heat exchangers, compressors, storage tanks, pipelines, utilities, and hydrogen or petrochemical safety systems [29,76]. These systems are suitable because they involve dynamic behavior, measurable process variables, known degradation mechanisms, and well-established HAZOP deviation patterns.

Reactors are particularly important because deviations in temperature, pressure, feed composition, cooling duty, or agitation can escalate rapidly. A HAZOP-informed Digital Twin could monitor thermal margin, reaction-rate indicators, cooling performance, and safeguard availability. Hybrid models may support early warning of thermal risk, while XAI can explain whether the developing scenario is linked to cooling loss, feed disturbance, or kinetic acceleration.

Distillation systems provide another important application area. Deviations such as high pressure, flooding, loss of separation, reboiler duty loss, condenser failure, or reflux malfunction are commonly considered in HAZOP studies. A Digital Twin can monitor pressure drop, tray or packing performance, temperatures, compositions, and control-loop behavior. Connecting these indicators to HAZOP knowledge could support earlier recognition of flooding, weeping, off-specification product, or pressure-related hazards.

Heat exchangers and utility systems are also suitable because degradation often develops gradually. Fouling, loss of cooling water, steam-side problems, or reduced heat-transfer performance may erode safety margins before alarms are triggered. A hybrid model can estimate heat-transfer degradation, while the HAZOP knowledge layer can relate loss of duty to downstream temperature, pressure, or reaction hazards.

Hydrogen systems and petrochemical units are increasingly relevant because they combine high-consequence hazards with growing interest in digital monitoring and safety analytics. Recent Digital Twin studies in hydrogen refueling and petrochemical safety show the potential for combining simulation, sensor data, and decision support [15,16]. However, these applications still need stronger connection to formal process hazard analysis and lifecycle safety governance before they can be considered mature HAZOP-informed systems.

8.4. Implementation Barriers

Several barriers limit industrial deployment [27,29,58]. The first is data quality and availability. HAZOP-informed Digital Twins require reliable sensor data, consistent tag mapping, historian access, alarm records, maintenance information, and clear links between process variables and HAZOP nodes. Many plants have fragmented data systems, inconsistent naming conventions, missing contextual information, or limited access to safety-critical data.

The second barrier is knowledge formalization. HAZOP worksheets are often written for human readers, not machines. They may contain inconsistent terminology, incomplete causal descriptions, site-specific abbreviations, or vague recommendations. Transforming these records into a structured knowledge base requires expert review and careful standardization. Automated extraction can help, but it cannot fully replace domain validation.

The third barrier is model validation. Predictive models used for safety support must be validated under conditions that matter for process safety, including abnormal operation, start-up and shutdown, equipment degradation, sensor faults, and rare but credible hazardous scenarios. This is difficult because industrial data for severe abnormal events are limited, and deliberate testing of hazardous scenarios is often impossible.

The fourth barrier is organizational integration. A DT–AI system must fit into existing workflows for HAZOP, management of change, alarm management, maintenance, operating procedures, training, and incident learning. If the system is isolated from these workflows, it may become a digital dashboard rather than a safety-management tool.

The fifth barrier is human acceptance. Operators and engineers must understand the system, trust it appropriately, and know how to act on its outputs. Poorly explained warnings, excessive alerts, or recommendations that conflict with operating experience can reduce trust. Conversely, overly confident explanations may encourage automation bias.

The sixth barrier is governance and cybersecurity. A Digital Twin connected to live plant data and safety-support logic must be protected against unauthorized access, data manipulation, model tampering, and uncontrolled updates. Model governance, audit trails, access control, and management-of-change procedures are therefore necessary for reliable deployment.

8.5. Maturity Comparison of the Four Pathways

Table 8 summarizes the relative maturity of the four pathways qualitatively, while Table 10 provides a detailed Technology Readiness Level (TRL) assessment using the standard nine-point NASA/ESA scale [102]. The qualitative table supports critical comparison of pathway characteristics; the TRL table provides numerical anchors and identifies the validation milestones required to advance each pathway toward industrial deployment. Both assessments are necessarily approximate: TRL assignments for software-intensive and knowledge-based systems carry inherent uncertainty, and the estimates given here reflect the state of evidence reviewed in this paper rather than a formal certification exercise.

8.6. Reported Quantitative Performance Metrics Across the Four Pathways

A persistent challenge in evaluating DT–AI technologies for HAZOP enhancement is the scarcity of standardized, comparable performance metrics across the four pathways. Table 9 consolidates quantitative results reported in the reviewed literature. Where multiple studies address the same pathway, the range of reported values is indicated. Where no numeric results are available, this is explicitly noted as a research gap, consistent with the need for more rigorous empirical validation in DT–AI-supported process safety [27,58].

The data in Table 9 reveal several important patterns. First, AI-assisted HAZOP using NLP and LLMs has some of the most directly reported metrics, but these results generally come from controlled case studies or benchmark evaluations rather than sustained live industrial deployment [103,104]. The reported valid scenario ratio of 41–45% for selected LLM outputs underscores that hallucination, invalid suggestions, and factual errors remain significant barriers [50,51]. Second, Digital Twin monitoring and hybrid physics–data models show strong methodological potential on benchmark process-monitoring and fault-diagnosis problems, but systematic reporting of false positive rates, false negative rates, and detection latency in live process environments remains limited [76,98,99,100]. Third, XAI methods have not yet been evaluated with standardized fidelity metrics or operator-trust studies in HAZOP-specific contexts [89,90]. These gaps collectively define a high-priority empirical research agenda for the field.

8.7. Technology Readiness Level Assessment

Technology Readiness Levels (TRL 1–9) provide a standardized framework for assessing the maturity of technologies from basic research to full operational deployment [102]. Table 10 presents a detailed TRL assessment for each of the four DT–AI HAZOP enhancement pathways, with evidence-based justifications drawn from the reviewed literature. The TRL assignments are conservative and should be interpreted as approximate maturity indicators rather than formal certification outcomes. Each assignment is anchored to the weakest link in the pathway’s evidence chain, meaning the most critical sub-component that has not yet been demonstrated at the level required for reliable industrial deployment.

Table 10 reveals a consistent pattern: component-level technologies, such as individual ML models, XAI methods, and Digital Twin architectures, are generally more mature than fully integrated HAZOP-specific systems. Rule-based HAZOP expert systems represent one of the more mature technology categories, while LLM-based HAZOP generation and HAZOP-specific XAI remain at earlier stages of maturity. This gap between component maturity and integrated-system maturity is a defining characteristic of the current research landscape and underscores the need for multidisciplinary integration research that bridges process safety engineering, AI/ML, and operational technology [27,58].

8.8. Critical Assessment of Industrial Readiness

The evidence reviewed in this section suggests that DT–AI-enhanced HAZOP is not a single ready-made technology [27,29,58]. It is better understood as an emerging integration of several partially mature capabilities. AI-assisted HAZOP can help formalize and reuse knowledge. Digital Twins can connect safety knowledge to live operating data. Hybrid models can support prediction and diagnosis. XAI can make outputs more understandable and auditable. Each capability is useful, but the full value appears only when they are integrated in a disciplined safety-management framework.

The main maturity gap is therefore not only technical. It is systemic. The field has many demonstrations of individual components, but fewer examples of complete lifecycle systems that connect HAZOP worksheets, live data, predictive models, explanations, safeguard verification, operator decisions, and feedback into revalidation. This gap matters because process safety depends on the performance of the whole sociotechnical system, not only on the accuracy of an algorithm.

For near-term industrial adoption, the most realistic approach is phased implementation. Facilities may begin with low-risk decision-support functions such as HAZOP knowledge retrieval, document standardization, and scenario consistency checking. The next phase may involve advisory monitoring of selected deviations in well-instrumented units. More advanced phases may include predictive time-to-limit estimation, cause ranking, safeguard-status integration, and lifecycle updating of the HAZOP knowledge base. At each phase, human oversight, validation, and governance must remain central.

The findings of this section provide the basis for the broader critical discussion in the next section. While the four pathways show clear potential, their safe adoption requires careful attention to failure modes, validation evidence, organizational integration, cybersecurity, and regulatory confidence.

9. Critical Discussion, Research Gaps, and Future Research Agenda

The preceding sections examined four complementary pathways for enhancing HAZOP through Digital Twin and Artificial Intelligence technologies: AI-assisted HAZOP, Digital Twin-based monitoring, hybrid physics–data models, and explainable AI. Taken together, these pathways show that the future of HAZOP enhancement is unlikely to depend on one technology alone. The strongest opportunity lies in integration: structured HAZOP knowledge provides the safety logic, Digital Twins provide the operational context, hybrid models provide predictive capability, and explainable AI provides the transparency needed for human trust and regulatory confidence.

However, the review also shows that DT–AI-enhanced HAZOP should not be interpreted as a replacement for conventional HAZOP. The core value of HAZOP remains expert-led, multidisciplinary, auditable reasoning about deviations from design intent. Digital technologies can strengthen this reasoning by improving knowledge retrieval, monitoring known deviations, forecasting hazardous trajectories, ranking plausible causes, and supporting decision-making. They cannot remove the need for engineering judgment, plant-specific knowledge, safeguard evaluation, or organizational accountability.

This section synthesizes the main findings of the review, identifies cross-cutting limitations and failure modes, discusses implementation and governance requirements, and proposes a future research agenda for moving from fragmented demonstrations toward reliable HAZOP-informed Digital Twin systems.

9.1. Comparative Analysis: DT–AI-Enhanced vs. Conventional HAZOP

A direct comparison between DT–AI-enhanced and conventional HAZOP is essential to evaluate whether the proposed framework delivers practical value. Table 11 provides a structured head-to-head comparison across key performance and implementation dimensions. It is important to note that this comparison is qualitative and indicative: quantitative performance data from long-term industrial deployments remain limited, as most implementations are at prototype or pilot scale (TRL 3–6). The comparison is therefore based on the best available evidence from the reviewed literature.

9.2. Industrial Case Study Synthesis

Although fully integrated DT–AI HAZOP systems at industrial scale remain rare, the reviewed literature contains evidence of partial implementations that illustrate the practical potential and challenges of individual pathway components. Three representative case vignettes are synthesized below from the reviewed literature to ground the framework in operational and near-operational contexts.

Case Vignette 1: Ontology-Based HAZOP Automation in Chemical Process Design. Single et al. [17,18] demonstrated ontology-based computer-aided HAZOP approaches for chemical process hazard identification. These systems use formal process ontologies linked to HAZOP guide words, process information, and consequence rules to generate candidate deviation scenarios from structured process knowledge. Compared with fully manual preparation, ontology-based support can improve terminology consistency, scenario retrieval, and reuse of previous safety knowledge. However, expert validation remains essential: candidate scenarios must be reviewed by engineers to confirm credibility, relevance, consequence severity, and safeguard adequacy. This vignette illustrates intermediate maturity for ontology-based HAZOP support and reinforces the point that AI-generated outputs are most valuable as expert-support tools rather than autonomous hazard-analysis systems. The key implementation lesson is that the quality and completeness of the ontology strongly influence the quality of the output; incomplete or inconsistently populated ontologies can produce unreliable or incomplete scenario lists.

Case Vignette 2: Digital Twin-Based Risk Monitoring in Process Plants. Bevilacqua et al. [16] described a Digital Twin reference model for operator-risk prevention in process plants. The work illustrates how Digital Twin concepts can integrate process information, risk indicators, and operator-support functions to improve situational awareness during abnormal or hazardous conditions. This case is important because it shows the practical relevance of Digital Twins for safety monitoring, but it also highlights a key gap for HAZOP enhancement: general risk monitoring does not automatically provide explicit linkage to HAZOP deviation–cause–consequence–safeguard logic. A Digital Twin that detects “something unusual” is less useful for HAZOP support than one that can connect the developing condition to a specific node, deviation, plausible cause, consequence pathway, and safeguard status. This case therefore illustrates the difference between general Digital Twin safety monitoring and a fully HAZOP-informed Digital Twin architecture.

Case Vignette 3: Physics-Informed Machine Learning for Fault Diagnosis in Process Equipment. Raissi et al. [53] introduced physics-informed neural networks (PINNs) as a framework for embedding physical constraints into data-driven models. Subsequent process monitoring and fault-diagnosis research has explored physics-informed and hybrid approaches for engineering systems [80,81,82,98]. These studies suggest that incorporating physical constraints can improve plausibility and generalization compared with purely data-driven models, especially when training data are limited. The key implementation challenge is validation under rare-event and degraded-operation conditions. Models trained primarily on normal or benchmark data may not generalize reliably to emergency, degraded, or out-of-distribution scenarios without targeted verification and validation. This vignette illustrates the promise of hybrid physics–data modeling for predictive safety analytics, while also highlighting the need for formal V&V protocols that test model behavior near operating boundaries and under degraded sensor or equipment conditions.

These case vignettes collectively illustrate that the pathway from component demonstration to integrated HAZOP-informed Digital Twin systems requires not only technical integration, but also systematic validation, governance, and organizational embedding. The most important lesson across the cases is that digital tools add value when they are explicitly aligned with HAZOP structure, expert judgment, and the specific decision needs of process safety teams.

9.3. Synthesis of the Four Pathways

The four pathways reviewed in this paper address different limitations of conventional HAZOP. AI-assisted HAZOP addresses the challenge of dependence on expert judgment, repetitive documentation, inconsistent terminology, and limited reuse of previous safety knowledge. Ontologies, knowledge graphs, NLP methods, and LLM-supported drafting can help formalize and retrieve HAZOP knowledge, but they remain most defensible as expert-support tools rather than autonomous hazard-analysis systems [67,69,73].

Digital Twin architectures address the static nature of conventional HAZOP. A HAZOP worksheet captures the understanding of hazards at a particular time, but plant conditions change continuously. By connecting HAZOP knowledge to live plant data, Digital Twins can help identify when a known deviation is developing, when safety margins are decreasing, or when safeguard assumptions should be checked. This moves HAZOP knowledge from a passive document toward an active lifecycle safety resource [39,40,76]. Recent applications in oil and gas process safety management [41], cloud-integrated monitoring architectures [42], and dynamic PSM frameworks combining Digital Twins with machine learning [43] further illustrate this trajectory.

Hybrid physics–data models address the need for predictive safety analytics. Conventional alarms are generally reactive, while hybrid models can support early warning by forecasting process trajectories, estimating time-to-limit, and distinguishing between competing causes of a deviation. Their value lies in combining physical consistency with data-driven adaptation [55,56,57]. However, they also introduce challenges related to validation, uncertainty, model drift, and rare-event generalization.

Explainable AI addresses the human and regulatory side of DT–AI adoption. In safety-critical environments, a prediction or recommendation is not useful unless it can be understood, challenged, audited, and acted upon. XAI must therefore be aligned with the HAZOP logic of deviation, cause, consequence, safeguard, and recommendation. Generic explanations such as feature importance are not sufficient unless they are translated into process-safety meaning [86,87,88].

The four pathways are therefore complementary. AI-assisted HAZOP helps structure the knowledge; Digital Twins connect the knowledge to operation; hybrid models support prediction; and XAI makes the outputs usable and auditable. The main research and implementation challenge is to integrate these capabilities into a coherent safety-management framework.

9.4. Cross-Cutting Failure Modes

DT–AI-enhanced HAZOP introduces new opportunities, but also new failure modes [50,58,89]. The first is knowledge-base incompleteness. If the HAZOP knowledge base omits a credible scenario, the Digital Twin may not monitor it, the AI system may not retrieve it, and the decision-support system may not warn the operator [50,58]. Digital systems can amplify the quality of the original HAZOP knowledge, but they can also amplify its omissions.

The second failure mode is model drift. Predictive models may become less accurate as equipment ages, catalysts deactivate, fouling develops, sensors drift, or operating strategies change. In a safety-support context, model drift can create false confidence by making predictions appear precise even when the model is no longer valid.

The third failure mode is data-quality degradation. Missing data, incorrect tags, sensor bias, poor calibration, inconsistent timestamps, and historian errors can all weaken Digital Twin reliability. Since DT–AI systems depend on data streams, poor data governance can directly affect safety-support quality.

The fourth failure mode is misleading explanation. An explanation may appear clear without being technically meaningful. A feature-attribution result, for example, may identify important variables but fail to explain the actual causal pathway or safeguard implication. In process safety, explanations must be grounded in engineering logic and HAZOP structure.

The fifth failure mode is automation bias. Operators or engineers may over-rely on AI-generated outputs, especially if the system appears confident or sophisticated. This risk is particularly serious when the model operates outside its validated domain or when multiple abnormal conditions occur simultaneously.

The sixth failure mode is organizational detachment. A DT–AI system may be technically impressive but disconnected from HAZOP revalidation, management of change, alarm management, maintenance, operating procedures, and training. In that case, it may become another isolated digital tool rather than a true safety-management enhancement.

9.5. Implementation Principles for Safe Adoption

The review supports several practical principles for safe adoption [27,50,58]. The first is augmentation rather than replacement. DT–AI systems should be designed to support expert-led HAZOP, not replace it [50,58]. This principle protects the role of engineering judgment and helps avoid unrealistic claims about automation.

The second principle is HAZOP alignment. Digital tools should preserve the structure that makes HAZOP useful: node, parameter, deviation, cause, consequence, safeguard, recommendation, and action tracking. AI outputs should be expressed in this language whenever possible.

The third principle is validation before reliance. Models, knowledge bases, and AI outputs must be validated against expert-reviewed cases, abnormal scenarios, operating envelopes, and known failure mechanisms before being used for safety-related decision support.

The fourth principle is uncertainty communication. The system should communicate confidence, model validity, missing data, conflicting evidence, and operating-domain limitations. A warning without uncertainty may encourage overconfidence.

The fifth principle is human-in-the-loop governance. Operators, process engineers, and safety personnel should retain responsibility for final safety decisions. The system should provide evidence and explanation, but not obscure accountability.

The sixth principle is lifecycle integration. DT–AI outputs should feed back into HAZOP revalidation, management of change, incident learning, alarm management, procedures, and training. Without this feedback loop, the system cannot support continuous safety learning.

The seventh principle is cybersecurity and configuration control. A HAZOP-informed Digital Twin is part of the industrial information environment. It must therefore be protected against unauthorized access, data manipulation, model tampering, and uncontrolled updates.

9.6. Research Gaps

Several research gaps remain [27,50,58]. The first is the lack of validated end-to-end HAZOP-informed Digital Twin frameworks. Many studies address individual components, such as ontology-based HAZOP, Digital Twin monitoring, fault diagnosis, or XAI [27]. Fewer studies demonstrate the full chain from HAZOP knowledge formalization to live data integration, predictive modeling, explanation, safeguard verification, and feedback into revalidation.

The second gap is limited industrial validation. Simulation studies and proof-of-concept demonstrations are valuable, but process safety adoption requires evidence under real operating conditions. Future work should evaluate DT–AI systems across different process units, operating modes, abnormal scenarios, and organizational contexts.

The third gap is the treatment of safeguards. Many digital safety studies focus on detecting abnormal conditions, but fewer explicitly evaluate whether safeguards are available, independent, effective, bypassed, degraded, or already demanded. Since safeguards are central to HAZOP and protection-layer thinking, this gap is important.

The fourth gap is explainability in HAZOP language. General XAI methods are not enough. Future research should develop explanation methods that directly map model outputs to deviation, cause, consequence, safeguard, and recommended verification.

The fifth gap is uncertainty and model-boundary communication. DT–AI systems must inform users when the model is extrapolating, when data quality is poor, or when predictions are uncertain. This remains underdeveloped in many safety-support prototypes.

The sixth gap is governance for LLM use in HAZOP. LLMs may support drafting, retrieval, and summarization, but their use in safety-critical workflows requires strict controls for hallucination, source traceability, review, versioning, and accountability.

The seventh gap is human factors validation. Future work should evaluate how operators and engineers actually interact with DT–AI explanations during abnormal situations. Usability, workload, trust calibration, alarm fatigue, and automation bias should be studied alongside model accuracy.

9.7. Future Research Agenda

A staged research agenda is needed to move the field from fragmented demonstrations toward reliable industrial deployment [27,29]. This agenda must address human factors, ethics, and governance requirements [58,89]. Figure 6 summarizes this agenda by organizing future work into short-term, medium-term, and long-term horizons, supported by cross-cutting requirements for validation, human factors, governance, and cybersecurity.

In the short term, research should focus on knowledge formalization and expert-support functions. This includes standardizing HAZOP terminology, building reusable ontologies, developing knowledge graphs from HAZOP and incident data, and evaluating AI-assisted worksheet review under expert supervision.

In the medium term, research should focus on HAZOP-informed monitoring and predictive analytics. This includes mapping HAZOP deviations to measurable indicators, developing hybrid models for selected high-risk units, validating time-to-limit prediction, and integrating model outputs with safeguard-status information. Demonstrations should move beyond idealized case studies toward realistic plant data, degraded conditions, and abnormal operating scenarios.

In the longer term, research should focus on lifecycle safety intelligence. This means developing systems that continuously connect HAZOP knowledge, Digital Twin monitoring, predictive models, explainable decision support, incident learning, management of change, and revalidation. The goal should not be autonomous HAZOP, but a disciplined human-centered safety-support ecosystem that keeps hazard knowledge alive throughout the plant lifecycle.

Future research should also develop evaluation metrics that go beyond prediction accuracy. Important metrics include omission rate for credible hazards, false advisory rate, warning lead time, explanation usefulness, operator response quality, safeguard-verification effectiveness, model drift detection, and contribution to HAZOP revalidation. These metrics would better reflect the real needs of process safety.

9.8. Critical Position of This Review

The overall position of this review is deliberately balanced. DT–AI technologies offer meaningful opportunities to enhance HAZOP, but their value depends on disciplined integration with process safety practice. The strongest contribution is not full automation; it is the ability to make HAZOP knowledge more structured, dynamic, predictive, explainable, and reusable [73,99,106].

This position differs from overly optimistic views that present AI as a replacement for expert hazard analysis. It also differs from overly conservative views that treat digital methods as irrelevant to process safety. The more realistic position is that AI and Digital Twins can become valuable safety-support layers when they are transparent, validated, governed, and aligned with expert-led HAZOP practice [89,106,107].

The future of HAZOP enhancement therefore depends less on whether AI can “perform HAZOP” and more on whether AI and Digital Twins can help process safety teams maintain a living understanding of hazards as plants change over time. This lifecycle perspective is the central contribution of the DT–AI-enhanced HAZOP framework proposed in this review [73,100].

10. Ethical and Societal Considerations

The deployment of AI and Digital Twin technologies in process safety raises ethical and societal questions that extend beyond technical performance. These questions concern accountability, transparency, workforce impact, and the social license to deploy AI in high-consequence industrial environments. While the process safety community has begun to engage with these issues [58,85,108], a systematic ethical framework for DT–AI HAZOP enhancement has not yet been established.

10.1. Accountability and Responsibility

A fundamental ethical challenge is the allocation of accountability when AI-assisted HAZOP tools contribute to safety decisions [95,108]. In conventional HAZOP, accountability is clear: the HAZOP team, led by a competent facilitator, is responsible for the quality and completeness of the study. When AI tools generate deviation lists, cause-consequence mappings, or safeguard recommendations, the question of who is responsible for errors or omissions becomes more complex [58,97].

Several accountability frameworks have been proposed for AI in safety-critical systems [95,109]:

• Human-in-the-loop accountability: AI outputs are treated as decision support, with human experts retaining full accountability for all safety decisions. This is the most conservative approach and is most consistent with current regulatory frameworks [58,89].
• Shared accountability: Accountability is distributed between the AI system developer, the deploying organization, and the human operators who use the system. This requires clear documentation of system capabilities, limitations, and validation evidence [95,108].
• Auditable AI: All AI recommendations, the data used to generate them, and the human decisions made in response are logged and auditable, enabling post-incident analysis and regulatory inspection [85,97].

For HAZOP applications, the human-in-the-loop model is strongly recommended, with auditable AI as a minimum requirement for any deployed system [58,108].

10.2. Transparency and Explainability

Transparency is identified as a prerequisite for responsible AI adoption in chemical engineering [85]. Opacity in AI decision-making impedes trust, regulatory acceptance, and effective human oversight [85,109]. For DT–AI HAZOP tools, transparency requirements include: (a) clear documentation of training data provenance and coverage; (b) explicit statement of the system’s validated operating envelope; (c) explainable outputs that can be traced back to specific process data, historical incidents, or engineering knowledge; and (d) regular reporting of system performance metrics to operators and safety managers [85,108,110].

The concept of meaningful transparency—where explanations are not only technically accurate but are also comprehensible and actionable for the intended audience—is particularly important for HAZOP applications [85]. A process safety engineer does not need to understand the mathematics of a neural network; they need to understand why the system flagged a particular deviation, what evidence supports the recommendation, and what the system’s confidence level is [84,85].

10.3. Workforce Impact and Equity

The automation of HAZOP tasks raises legitimate concerns about workforce impact [108,111]. In the near term, AI-assisted HAZOP is likely to change the nature of process safety work rather than eliminate it: routine tasks (systematic deviation enumeration, cause–consequence lookup) may be automated, while complex tasks (novel scenario assessment, judgment under uncertainty, stakeholder communication) remain human-led [58,108]. However, the long-term trajectory of AI capability development introduces greater uncertainty about the extent of automation.

Ethical deployment of AI in process safety requires proactive attention to workforce transitions [95,108]:

• Upskilling and reskilling: Organizations should invest in training programs that equip process safety engineers with the skills to work effectively with AI tools, understand their limitations, and maintain the deep process knowledge that AI cannot replicate [58,89].
• Equitable access: Smaller organizations and those in lower-income countries may not have the resources to deploy and maintain sophisticated DT–AI systems, potentially creating safety inequities between organizations [108,109].
• Participatory design: Involving process safety engineers and operators in the design and evaluation of AI tools improves both the quality of the tools and the legitimacy of their deployment [95,108].

10.4. Social License and Regulatory Engagement

The deployment of AI in process safety requires not only technical validation but also social license—the acceptance by workers, communities, regulators, and the public that AI-assisted safety systems are trustworthy and appropriately governed [95,108]. Building social license requires transparent communication about AI capabilities and limitations, meaningful engagement with affected stakeholders, and demonstrated commitment to safety culture [108,109].

Regulatory engagement is an essential component of responsible deployment [58,97]. Process safety regulators and related standards bodies are increasingly paying attention to AI-enabled safety systems, but comprehensive guidance for AI-assisted HAZOP remains limited [89,97]. Early adopters of DT–AI HAZOP tools have an opportunity—and a responsibility—to engage proactively with regulators, share validation evidence, and contribute to the development of appropriate standards and guidance [58,111].

10.5. Ethical Position for DT–AI-Enhanced HAZOP

The ethical position adopted in this review is that DT–AI technologies should be used to strengthen, not dilute, process safety responsibility. AI may assist with knowledge retrieval, deviation generation, documentation, monitoring, prediction, and explanation, but final safety judgment must remain with competent human professionals operating within established safety-management systems. Responsible deployment therefore requires human-in-the-loop accountability, meaningful transparency, auditable records, workforce development, equitable access, cybersecurity protection, and proactive regulatory engagement.

This position is consistent with the broader argument of the review. DT–AI-enhanced HAZOP should not be evaluated only by whether it improves technical performance or reduces documentation effort. It should also be evaluated by whether it preserves professional accountability, improves safety culture, supports human learning, and maintains public confidence in high-hazard industrial operations.

11. Verification, Validation, and Functional Safety Standards

The deployment of AI and Digital Twin components in HAZOP-related safety functions raises fundamental questions about verification and validation (V&V) that are not adequately addressed by traditional process safety standards. This section examines the applicable standards landscape, identifies the specific V&V challenges posed by AI/ML components, and proposes a layered V&V framework for DT–AI HAZOP systems.

11.1. Applicable Standards and Their Limitations

11.1.1. IEC 61508: Functional Safety of E/E/PE Safety-Related Systems

IEC 61508 is the foundational international standard for functional safety of electrical, electronic, and programmable electronic safety-related systems [112]. It defines Safety Integrity Levels (SIL 1–4) and prescribes V&V requirements commensurate with the assigned SIL. For AI/ML components, IEC 61508 presents several challenges [24,96]:

• Non-deterministic behavior: Traditional IEC 61508 V&V assumes deterministic software behavior that can be fully specified and tested. ML models are inherently probabilistic and their behavior cannot be fully characterized by finite test cases [96,110].
• Probabilistic failure modes: SIL-style arguments require allocation of probabilistic failure budgets. Statistical ML behavior introduces a new class of failures (distributional shift, adversarial inputs, hallucination) that do not fit neatly into the hardware reliability framework of IEC 61508 [24,96].
• Training data as a safety artifact: IEC 61508 does not address the safety implications of training data quality, coverage, and bias—all of which are critical determinants of ML system behavior in safety-critical applications [24,110].
• Lifecycle requirements: The standard’s V-model lifecycle assumes stable requirements and a fixed implementation. ML systems require continuous monitoring, retraining, and revalidation as process conditions change, which is not addressed by the standard’s lifecycle model [96,97].

Ongoing revisions to IEC 61508 (Part 3 and emerging guidance documents) are beginning to address AI/ML, but comprehensive coverage remains incomplete [24,96]. In the interim, practitioners are advised to apply IEC 61508 requirements as a baseline while supplementing with AI-specific V&V approaches [97,110].

11.1.2. UL 4600: Standard for Safety for the Evaluation of Autonomous Products

UL 4600 provides a safety-case-oriented framework for evaluating autonomous products, including systems that rely on complex software and AI/ML components [113]. Although it was developed primarily for autonomous products rather than process safety applications, its safety-case logic is useful by analogy for AI-assisted HAZOP tools and HAZOP-informed Digital Twins [96,114]:

• Safety case construction: A structured safety case argues, with supporting evidence, that the system is acceptably safe for its intended use. This logic is relevant to DT–AI HAZOP systems, where safety argumentation must span process models, data pipelines, AI/ML components, human interfaces, and governance controls [97,113].
• ML-oriented failure analysis: AI-enabled systems require explicit analysis of how ML components can fail and how those failures could affect safety-related decisions. This supports ML-specific failure-mode analysis for DT–AI HAZOP components [96,110].
• Operational design domain: Safety-case approaches require clear definition of the conditions under which the system is intended and validated to operate. For HAZOP applications, this would specify the process types, operating modes, data-quality conditions, and decision-support boundaries under which the AI tool’s outputs can be trusted [110,113].
• Monitoring and anomaly detection: Deployed AI-enabled systems require ongoing monitoring to identify degradation, distributional shift, and operation outside the validated domain [96,110].

11.2. A Layered V&V Framework for DT–AI HAZOP Systems

Given the limitations of existing standards, a layered V&V framework is proposed for DT–AI HAZOP systems, drawing on IEC 61508, UL 4600-inspired safety-case thinking, and emerging AI safety literature [96,97,113]. Safety assurance for machine-learning-based systems [24,110] and safety frameworks for autonomous systems [114] inform the framework design. The framework consists of four complementary layers:

1.

Formal and analytical verification: Where feasible, formal methods (model checking, theorem proving, abstract interpretation) should be applied to verify safety-critical properties of deterministic components (rule engines, ontology reasoners, threshold logic). For ML components, formal verification is limited but can be applied to verify specific input-output properties within bounded domains [96,110].

2.

Statistical testing and benchmarking: ML components must be evaluated on held-out test datasets that are representative of the intended operating conditions, including rare and abnormal scenarios. Performance metrics (precision, recall, F1, false positive rate) must be reported for each operational condition, not just overall [24,103,110]. Adversarial testing—evaluating system behavior under deliberately challenging inputs—is strongly recommended [110].

3.

Process-specific validation: AI-generated HAZOP outputs must be validated against expert-led HAZOP studies on the same process systems. This validation should assess not only the overlap between AI and expert outputs, but also the consequences of AI misses (false negatives) and false alarms (false positives) in the HAZOP workflow [27,58,97].

4.

Operational monitoring and lifecycle management: Deployed DT–AI systems must be continuously monitored for performance degradation, distributional shift, and model drift. Retraining and revalidation protocols must be defined and executed whenever significant changes in process conditions or operating modes occur [46,96,114]. All model versions, training datasets, validation results, and deployment decisions must be documented and auditable [85,97].

Figure 7. Layered V&V framework for DT–AI HAZOP systems. Four complementary layers provide progressive safety assurance: (1) Formal Verification (model consistency, logical completeness, static analysis); (2) Statistical Testing (out-of-distribution evaluation, uncertainty quantification, performance benchmarking); (3) Process-Specific Validation (HAZOP scenario coverage, fault injection testing, domain expert review); and (4) Operational Monitoring (model drift detection, performance tracking, continuous audit). IEC 61508-aligned functional-safety requirements support safety-related functions, while UL 4600-inspired safety-case argumentation supports evidence-based justification for assurance across the lifecycle. All evidence feeds upward into a Safety Case Evidence Package.

Figure 7. Layered V&V framework for DT–AI HAZOP systems. Four complementary layers provide progressive safety assurance: (1) Formal Verification (model consistency, logical completeness, static analysis); (2) Statistical Testing (out-of-distribution evaluation, uncertainty quantification, performance benchmarking); (3) Process-Specific Validation (HAZOP scenario coverage, fault injection testing, domain expert review); and (4) Operational Monitoring (model drift detection, performance tracking, continuous audit). IEC 61508-aligned functional-safety requirements support safety-related functions, while UL 4600-inspired safety-case argumentation supports evidence-based justification for assurance across the lifecycle. All evidence feeds upward into a Safety Case Evidence Package.

11.3. Completeness and Coverage Verification

A particularly challenging V&V requirement for AI-assisted HAZOP is completeness: demonstrating that the AI system has not missed any safety-significant deviations. Traditional HAZOP relies on the structured, systematic application of guidewords to every process node to provide completeness assurance. AI systems that generate deviation lists from process data or P&ID images cannot provide the same type of completeness guarantee without additional verification mechanisms [27,50,58].

Proposed approaches to completeness verification include: (a) requiring human experts to independently verify AI-generated deviation lists against the full guideword checklist; (b) using ensemble methods that combine multiple AI approaches and flag any deviation identified by at least one method; (c) maintaining a formal HAZOP knowledge base that tracks coverage of all guideword-node combinations; and (d) applying uncertainty quantification to identify nodes or parameters where the AI system has low confidence, triggering enhanced human review [50,58]. These approaches draw on AI safety assessment frameworks [96,110]. None of these approaches provides a complete solution, and completeness verification remains an open research problem for AI-assisted HAZOP [27,50,97].

12. Conclusions and Recommendations

This review critically examined how Digital Twin and Artificial Intelligence technologies can support the enhancement of conventional HAZOP in process safety [27,58]. Conventional HAZOP remains one of the most important methods for systematic hazard identification because it provides a structured, expert-led, and auditable way to examine deviations from design intent. However, its traditional implementation is often periodic, document-centered, and strongly dependent on expert experience. These characteristics limit its ability to reflect operational drift, equipment degradation, process modifications, changing feedstocks, and emerging abnormal conditions between formal review cycles.

The central conclusion of this review is that DT–AI technologies should not be viewed as replacements for HAZOP [50,58]. Rather, they should be designed as decision-support layers that strengthen expert-led process safety practice. The most credible direction is not autonomous HAZOP, but HAZOP-informed lifecycle safety intelligence. In this view, HAZOP knowledge is formalized, connected to operational data, supported by predictive models, explained to human users, and updated through learning from plant operation.

The review identified four complementary technology pathways. First, AI-assisted HAZOP can support knowledge capture, deviation generation, scenario retrieval, terminology standardization, worksheet review, and reuse of previous safety knowledge. Ontologies, knowledge graphs, NLP methods, and LLM-supported drafting can reduce repetitive effort and improve knowledge access [51,64,65], but their outputs require expert validation [50]. Second, Digital Twin architectures can connect structured HAZOP knowledge with live plant data, equipment status, model predictions, and operator decision support. This can help transform HAZOP from a static worksheet into an operational safety-support resource. Third, hybrid physics–data models can support predictive safety analytics by forecasting deviations, estimating time-to-limit, ranking possible causes, and communicating uncertainty [46,48,78]. Fourth, explainable AI is required to make DT–AI outputs understandable, challengeable, auditable, and acceptable to operators, engineers, safety personnel, and regulators [58,94].

The review also showed that the field is promising but not yet fully mature [27]. Many studies demonstrate individual components, such as ontology-based HAZOP, process safety knowledge graphs, Digital Twin monitoring, fault diagnosis, physics-informed modeling, or XAI. Fewer studies demonstrate integrated lifecycle systems that connect HAZOP knowledge formalization, live data acquisition, predictive modeling, safeguard-status monitoring, explainable decision support, and feedback into HAZOP revalidation [27,29,58]. This integration gap is one of the most important barriers to industrial adoption.

Several practical recommendations follow from this review. First, organizations should adopt DT–AI tools gradually, beginning with low-risk expert-support functions such as HAZOP knowledge retrieval, terminology standardization, consistency checking, and document review [27,58]. Second, Digital Twin monitoring should be explicitly linked to HAZOP deviation–cause–consequence–safeguard logic rather than used only as a general visualization or anomaly-detection tool [29]. Third, predictive models should include validation boundaries, uncertainty communication, and model-drift monitoring before being used for safety-related decision support [46,83]. Fourth, AI-generated outputs should remain advisory unless they have been formally validated, governed, and integrated into approved safety-management procedures. Fifth, explainability should be designed in process-safety language, so that outputs can be interpreted in terms of deviations, causes, consequences, safeguards, uncertainty, and recommended verification [58,94].

Future research should focus on validated end-to-end HAZOP-informed Digital Twin systems [27,29,58]. Priority areas include standardized HAZOP ontologies, process safety knowledge graphs, hybrid models for high-risk unit operations, uncertainty-aware early warning, safeguard-status monitoring, HAZOP-specific explainability, human factors validation, cybersecurity, and governance frameworks for AI-supported safety decisions. Research should also develop evaluation metrics that reflect process safety needs, including warning lead time, omission rate for credible hazards, explanation usefulness, safeguard-verification effectiveness, and contribution to HAZOP revalidation.

Overall, DT–AI-enhanced HAZOP should be understood as an evolution of process safety practice rather than a replacement of established methods [50,58]. Its value lies in keeping HAZOP knowledge alive throughout the plant lifecycle. When implemented with validation, explainability, governance, and human oversight, Digital Twins and Artificial Intelligence can help process safety teams move from periodic hazard review toward dynamic, predictive, and lifecycle-oriented safety management [27,29]. Human factors and trust considerations remain essential for successful adoption [58,89].