HAZOP vs LOPA vs SIL: What Each Process Safety Study Actually Answers
HAZOP, LOPA and SIL explained in order: what each study asks, how they connect, a worked LOPA example, and the SIL table every engineer should know.
By Syed Hasan30 Oct 20265 min read
HAZOP, LOPA and SIL appear together in every process safety discussion, and they are often treated as alternatives. They are not. They are three steps that answer three different questions, in order: what can go wrong, whether there are enough barriers, and how reliable the last barrier must be.
Short answer: HAZOP finds the hazards, using a structured team review. LOPA takes the serious scenarios and checks whether the independent protection layers bring the risk down to the company's target. If they do not, SIL expresses how much extra risk reduction a safety instrumented function must provide. The safety instrumented system is then designed and verified to IEC 61511.
The three studies in order
HAZOP: what can go wrong?
A hazard and operability study is a structured, team-based review of a design or an operating plant. The team divides the process into nodes and applies guidewords (no, more, less, reverse, other than) to parameters such as flow, pressure, temperature and level. For each deviation it asks: what could cause it, what would the consequences be, what safeguards exist, and is anything more needed?
HAZOP is qualitative. Its strength is breadth: it finds scenarios that nobody had thought of. Its weakness is that it cannot easily say whether the existing safeguards are enough. That is where LOPA comes in.
LOPA: are there enough barriers?
Layer of protection analysis takes the most serious scenarios from the HAZOP and puts numbers on them. It starts with how often the initiating event is expected, then multiplies by the probability that each independent protection layer (IPL) fails on demand. The result is the mitigated frequency of the consequence, which is compared with the company's tolerable frequency for that consequence.
Not every safeguard counts as an IPL. To earn credit, a layer must be effective at stopping the scenario, independent of the initiating event and of other credited layers, and auditable, so its performance can be checked. A basic control loop that caused the problem cannot also be credited as protection against it.
A worked example
Scenario: the level control loop on a separator fails, sending gas into a downstream vessel and over-pressuring it. The numbers below are illustrative; your company's procedures decide the real values.
| Step | Value | Result |
|---|---|---|
| Initiating event: control loop failure | 0.1 per year | 0.1 per year |
| IPL 1: independent high-pressure alarm and operator response | PFD 0.1 | 0.01 per year |
| IPL 2: pressure relief valve sized for the case | PFD 0.01 | 0.0001 per year (1 in 10,000) |
| Company's tolerable frequency for this consequence | 0.00001 per year (1 in 100,000) | |
| Gap | 10 times too frequent |
The existing layers leave the scenario ten times more frequent than the target. A safety instrumented function (SIF), for example a high-high pressure trip that closes an inlet valve, must therefore reduce the risk by at least a factor of 10. That places it in SIL 1.
SIL: how good must the last barrier be?
A safety integrity level expresses the required reliability of a safety instrumented function. For functions demanded infrequently (low-demand mode, typical in process plants), IEC 61508 and IEC 61511 define the bands by the average probability of failure on demand:
| SIL | PFDavg (low demand) | Risk reduction factor |
|---|---|---|
| SIL 1 | 0.01 to 0.1 | 10 to 100 |
| SIL 2 | 0.001 to 0.01 | 100 to 1,000 |
| SIL 3 | 0.0001 to 0.001 | 1,000 to 10,000 |
| SIL 4 | 0.00001 to 0.0001 | 10,000 to 100,000 |
SIL 4 is rare in the process industry; a need for SIL 3 or above often signals that the process design itself should be changed to remove the hazard, rather than relying on instrumentation. Once the target is set, the SIF is designed, its achieved PFD is calculated and verified, and it is tested at intervals to keep it at that level, all under IEC 61511.
Common mistakes
- Treating HAZOP as the end. A HAZOP that lists "relief valve" as a safeguard has not shown the risk is acceptable.
- Over-crediting layers. Counting the same operator twice, or crediting an alarm on the same transmitter as the control loop, overstates protection.
- Forgetting the proof test. A SIF only delivers its SIL if it is tested and maintained as assumed in the calculation.
- Using inconsistent numbers. Initiating event frequencies and IPL credits should come from the company's approved list, so studies across the site are comparable.
Relief valves are often the most important IPL in a LOPA, so their own integrity matters: sizing basis, testing and revalidation after plant changes. EIM's self-paced PSV & Flare System Integrity programme covers exactly that.
Learn more with EIM
EIM's live Process Safety Management (PSM) course runs over 20 sessions (40 hours) on weekends, with recordings, and covers hazard identification, HAZOP with a workshop, LOPA, SIS and SIL, management of change, mechanical integrity and process safety KPIs, ending with a capstone project. No batch is published at the moment, so check the course page for the next date. For self-paced study, the Process Safety Management programme covers the 14 PSM elements and why failures are rarely in the element that gets blamed. EIM is an independent training provider.
Frequently asked questions
Is LOPA a replacement for HAZOP?
No. LOPA analyses selected scenarios that HAZOP has already identified. Without HAZOP, LOPA has nothing to analyse.
What is an independent protection layer?
A safeguard that can stop the scenario on its own, is independent of the initiating event and other credited layers, and can be audited. Relief valves and independent alarms with a defined operator response are common examples.
What does SIL 2 mean?
In low-demand mode, the safety instrumented function has an average probability of failure on demand between 0.001 and 0.01, giving a risk reduction of 100 to 1,000 times.
Who sets the tolerable frequency?
The operating company, in its risk criteria. LOPA compares each scenario against those criteria.
Which standard covers SIS in process plants?
IEC 61511, the process-sector application of IEC 61508.
Sources
- IEC 61508 and IEC 61511 (functional safety; SIL definitions). Cited, not quoted.
- CCPS, Layer of Protection Analysis: Simplified Process Risk Assessment, and Guidelines for Initiating Events and Independent Protection Layers in LOPA. Cited, not quoted.
- IEC 61882, Hazard and operability studies: application guide. Cited, not quoted.
- Worked example prepared by EIM for illustration. Checked 7 October 2026.
