Hazard and Risk Analysis
Hazard and risk analysis
This domain tests structured hazard identification, scenario development, and risk estimation inputs. Expect HAZOP, LOPA, what-if, FMEA, fault tree, and risk graph questions, plus the rules that make a scenario auditable.
Core rules
- HAZOP examines deviations from design intent (no, more, less, reverse, as well as, part of, other than) using nodes, guide words, causes, consequences, and safeguards.
- LOPA starts from a single cause-consequence scenario, estimates initiating event frequency, and subtracts independent protection layers (IPLs) to compare with tolerable risk.
- An IPL must be specific, independent, dependable, and auditable. BPCS control and alarms generally receive limited credit unless designed and managed as IPLs.
- Human intervention credit is restricted by time available, procedures, training, and error rate; it is not a free layer.
- Risk criteria can be qualitative, semi-quantitative (risk graph), or quantitative; the method must match the decision.
Worked example
A HAZOP on a separator finds "more level" caused by outlet blockage, with the consequence of liquid carryover to gas export. LOPA sets initiating frequency at 0.1/yr, credits a high-level alarm with operator response (PFD 0.1) and an independent high-high trip (PFD 0.01). Mitigated frequency = 0.1 × 0.1 × 0.01 = 1e-4/yr. If the tolerable frequency is 1e-4/yr, the scenario is at the criterion; the trip's SIL must then be verified against its own PFD.
Traps
- Using HAZOP to identify equipment failure modes; that is FMEA or FMECA.
- Counting the same BPCS as both control and protection.
- Giving credit to a safeguard that shares a sensor with the trip.
- Presenting LOPA as a hazard identification technique.