Risk Reduction
Risk reduction
This domain tests how risk is reduced to tolerable levels and how the reduction is allocated across layers. Expect definitions of tolerable risk, ALARP, risk reduction factor (RRF), and the relationship between RRF, PFDavg, and SIL.
Core rules
- Risk reduction is the ratio of unmitigated risk to tolerable risk: RRF = risk_without / risk_tolerable.
- Layers are applied in order: inherently safer design, control, alarms and human response, safety instrumented function, physical mitigation, emergency response.
- Each layer's claimed risk reduction must be independent and its performance must be sustained; otherwise the credit is unjustified.
- For a low-demand SIF, PFDavg ≈ 1/RRF_sif. SIL bands: SIL 1 = 0.01–0.1, SIL 2 = 0.001–0.01, SIL 3 = 0.0001–0.001, SIL 4 = 0.00001–0.0001.
- Residual risk remains after all layers; it must still meet the site's criteria and be communicated.
Worked example
Unmitigated event frequency is 0.2/yr; the tolerable frequency is 2e-4/yr, so RRF = 1000. Non-SIS layers are credited with RRF 50, leaving RRF 20 for the SIF. PFDavg target = 1/20 = 0.05, which lies in the SIL 1 band (0.01–0.1). The SIF is therefore SIL 1, not SIL 3, even though the total reduction is 1000. A SIL 1 function can be the right answer when other layers carry the rest.
Traps
- Equating RRF directly with the SIL number.
- Assigning all reduction to the SIS because it is the easiest layer to document.
- Claiming credit for a layer that is not independent or not proof-tested.
- Ignoring residual risk after the SIF.