Risk Analysis

Risk = frequency × consequence. Learn qualitative vs quantitative risk assessment, fault trees and event trees, Layer of Protection Analysis (LOPA), probability of failure on demand (PFD), Safety Integrity Levels (SIL), individual and societal risk, and ALARP.

HAZOP finds scenarios; risk analysis asks 'how often, and how bad?'. Numbers allow engineers to decide whether protection is enough and where to spend money for the biggest safety benefit.

LOPA is the most widely used semi-quantitative method; full QRA is used for major hazard sites.

An analogy

Layers of protection are like slices of Swiss cheese: each has holes (failures), but an accident only happens when all the holes line up.

Risk and tolerability

Risk combines how often something happens and how severe it is. Regulators define tolerable limits, e.g. worker individual risk of fatality 10⁻³/yr intolerable, 10⁻⁶/yr broadly acceptable; in between, risk must be reduced As Low As Reasonably Practicable (ALARP).

LOPA

Take one scenario (cause → consequence). Start with the initiating event frequency (e.g. control loop failure 0.1/yr), multiply by the PFD of each Independent Protection Layer (BPCS 0.1, alarm + operator 0.1, relief valve 0.01) and compare with the target frequency. The gap defines the SIL of any additional safety instrumented function.

Fault and event trees

Fault trees work backwards from a top event through AND/OR gates to basic failures. Event trees work forwards from an initiating event through success/failure of barriers (ignition, detection, isolation) to outcomes such as jet fire, flash fire or safe dispersal.

SIS and QRA

IEC 61511 governs Safety Instrumented Systems: redundancy (1oo2, 2oo3), proof testing and PFD_avg ≈ λ_DU·T/2. QRA combines frequencies with consequence models (fires, explosions, toxic dispersion) to produce individual risk contours and societal F–N curves.

Formulas

• LOPA: f_M = f_I × Π PFD_i (× enabling/conditional modifiers)
• Required SIS PFD: PFD_SIS = target / (f_I × Π other PFDs)
• SIL bands: SIL1: 10⁻²–10⁻¹, SIL2: 10⁻³–10⁻², SIL3: 10⁻⁴–10⁻³
• Fault tree gates: AND: P = Π P_i; OR: P ≈ Σ P_i (rare events)

Worked example: LOPA for reactor overpressure

Given: Initiating event: control loop failure 0.1/yr; IPLs: alarm + operator (0.1), BPCS independent loop (0.1), relief valve (0.01); Target 10⁻⁵/yr

Find: Mitigated frequency.

• f_M = 0.1 × 0.1 × 0.1 × 0.01 = 10⁻⁵/yr
• Meets target exactly

Answer: 10⁻⁵/yr — tolerable (no extra SIF needed)

Worked example: SIL required

Given: f_I = 0.5/yr, relief valve PFD 0.01; Target 10⁻⁵/yr

Find: SIS PFD.

• Without SIS: 0.5 × 0.01 = 5 × 10⁻³
• PFD_SIS = 10⁻⁵/5 × 10⁻³ = 2 × 10⁻³ → RRF 500

Answer: SIL 2

Common mistakes

• Wrong: Counting two layers that share the same sensor. — Right: IPLs must be independent of each other and of the cause.
• Wrong: Assuming SIS PFD without proof testing. — Right: PFD_avg depends on test interval — test as designed.

Applications

• SIS design: LOPA sets SIL targets for trips and interlocks.
• Land-use planning: QRA risk contours decide where houses may be built.
• Investment decisions: Cost-benefit of risk reduction under ALARP.

Key takeaways

• Risk = frequency × consequence.
• LOPA: f_M = f_I × Π PFD.
• SIL from the gap to target.
• Fault/event trees and QRA for complex risks.

Going further

• IEC 61508/61511: Functional safety lifecycle and SIS verification.
• Bayesian updating: Use plant failure data to refine generic rates.
• Human reliability: THERP and HEART quantify operator error probabilities.