HAZOP finds hazards systematically — a team applies guidewords (No, More, Less, Reverse…) to each part of the process to surface credible deviations and their causes and consequences.
LOPA (layers of protection analysis) is the order-of-magnitude maths: take the initiating-event frequency, divide by the risk reduction of each independent protection layer, and compare to the tolerable frequency. The shortfall is the risk reduction the safety function must provide.
SIL (safety integrity level, IEC 61511) grades that function by its risk reduction factor RRF = 1/PFD: SIL 1 = 10–100×, SIL 2 = 100–1000×, SIL 3 = 1000–10,000×, SIL 4 = 10,000–100,000×. The model turns a scenario into the required SIL.
1 · Risk in layers
Process safety rests on one idea: a major accident almost never has a single cause, so it should never have a single barrier. Between a normal upset and a catastrophe sits a series of independent layers of protection — the “Swiss cheese” or onion model. Each layer reduces the risk by some factor; the accident only happens if an initiating event occurs and every layer fails. The layers split into two kinds:
- Prevention — stop the event happening: inherent design, the basic process control system (BPCS), alarms with operator response, and the safety instrumented system (SIS) that trips the process to a safe state.
- Mitigation — limit the consequence once it has: relief valves, containment, gas detection and deluge, emergency response.
Process safety is the work of choosing those layers and proving they add up to tolerable risk. Three linked methods do it, in order.
2 · HAZOP — finding the hazards
A HAZOP (hazard and operability study) is a structured, team-based review of a design. The plant is split into nodes (e.g. a line or vessel), and for each one the team applies guidewords to process parameters to provoke every credible deviation:
| Guideword | Example deviation |
|---|---|
| No / None | No flow (pump stopped, line blocked) |
| More | More pressure, more temperature, more level |
| Less | Less flow, less cooling |
| Reverse | Reverse / backflow |
| As well as / Part of | Contamination; wrong composition |
For each deviation the team records the causes, the consequences, the existing safeguards, and any recommendations. HAZOP is deliberately exhaustive and qualitative — its job is to make sure nothing credible is missed. The serious scenarios it surfaces are then passed to LOPA to be quantified.
3 · LOPA — counting the layers
LOPA is a simplified, semi-quantitative risk calculation that sits between qualitative HAZOP and full quantitative risk analysis. It works in orders of magnitude, which is enough to make the decision and keeps it auditable. For a chosen scenario:
The discipline is in what counts as an independent protection layer (IPL). To be credited, a layer must be independent of the initiating cause and the other layers, effective at preventing the consequence, and auditable. A typical IPL buys one order of magnitude (PFD ≈ 0.1); a well-engineered relief valve or a SIL-rated function can buy more. The BPCS loop that caused the upset can’t also be credited as a layer against it — a common and dangerous double-count.
If the existing layers don’t get the frequency down to tolerable, the gap is the job of a new safety instrumented function — and its size sets the SIL.
4 · SIL — sizing the safety function
A safety instrumented function (SIF) is a specific protection loop — sensor → logic solver → final element (e.g. high-pressure transmitter → trip logic → shutdown valve). Its required performance is its safety integrity level (SIL), graded by the risk reduction factor it must deliver:
The interactive runs the whole LOPA-to-SIL chain: set how often the scenario initiates, how much the existing layers already reduce it, and how rare the consequence must be — and it returns the SIL the safety function has to achieve.
Interactive — LOPA to SIL
Live modelThe risk-reduction ladder
Two truths fall out of playing with it. You rarely need SIL 3+: if a scenario demands it, the right answer is usually to reduce the initiating frequency or add an independent non-instrumented layer, because very high SIL is expensive and hard to sustain. And the SIL is only as real as the proof testing: a SIL-2 function only delivers SIL-2 if it’s tested at the interval the calculation assumed — which makes functional safety a maintenance commitment, not just a design one.
The safety lifecycle is a maintenance lifecycle too. Every credited layer — the relief valve, the trip transmitter, the shutdown valve — carries a proof-test task at a defined interval, prioritised by criticality and tracked in the CMMS like any other preventive task. A missed SIS proof test silently erodes the SIL the whole risk case depends on. Functional safety and reliability engineering are the same data, viewed for safety instead of cost.
Key takeaways
- Risk is managed in independent layers — prevention and mitigation; the accident needs the initiator and every layer to fail.
- HAZOP finds hazards with guidewords and deviations; LOPA quantifies them in orders of magnitude against a tolerable target.
- SIL sizes the safety function by RRF = 1/PFD; SIL 1–4 span 10× to 100,000× risk reduction.
- SIL is a maintenance promise — it only holds if the function is proof-tested at the assumed interval.