CASE
STUDY
SETTING SIL TARGETS THAT HOLD UP:
LOPA FOR A GAS PROCESSING OPERATOR
A gas processing operator was specifying safety instrumented functions against SIL targets nobody could trace to a risk assessment. A layer of protection analysis established defensible targets, and in several cases showed less instrumented protection was required than assumed.
| Challenge | Solution | Result |
|---|---|---|
| SIL targets inherited from precedent, with no documented risk basis. | Layer of protection analysis across all scenarios with instrumented protection. | Risk-based SIL targets, with several reduced and the reductions documented. |
Project Background
The operator was planning a capacity expansion at a gas processing facility and needed to specify the safety instrumented functions for the new equipment. The engineering contractor asked which SIL targets applied. The operator's answer came from precedent: the targets used on the previous expansion, which had themselves come from the project before that. No HAZOP recommendation, no risk assessment and no documented rationale sat behind any of them. The operator recognized that specifying a capital project against undocumented targets would create the same problem again, and that it had no way to defend the targets if a regulator or insurer asked.
Inherited SIL targets create exposure in both directions, and the operator was experiencing both. Where a target was set too low, the facility carried more risk than its own criteria would accept, with no analysis to reveal it. Where a target was set too high, the operator was paying for instrumented protection it did not need, in hardware cost, in proof testing burden over the life of the asset, and in the spurious trip rate that comes with additional instrumented functions.
A further complication was that the existing HAZOP records identified hazardous scenarios but stopped short of the analysis needed to set targets. They recorded causes, consequences and existing safeguards without evaluating whether those safeguards were independent, whether they were adequate, or what residual risk remained for an instrumented function to address. The raw material for a risk-based target existed; the analytical step did not.
The operator also needed the work to serve the capital project timeline. A LOPA that delivered its conclusions after the contractor had already specified the safety instrumented systems would be an audit document rather than an engineering input, and the opportunity to reduce unnecessary protection would be gone.
Arista Cyber ran a layer of protection analysis sequenced to deliver targets for the expansion scope first, so the engineering contractor could specify against risk-based numbers rather than precedent.
Risk Criteria Confirmation
Established the tolerable risk criteria the analysis would work to, confirmed with the operator rather than assumed from convention.
Scenario Selection
Identified from existing HAZOP records every scenario where instrumented protection was proposed or already in place.
Initiating Event Frequency
Assigned initiating event frequencies using recognized data sources, with the source recorded for each.
Independent Protection Layer Assessment
Evaluated each claimed safeguard for independence, effectiveness and auditability, and rejected those not qualifying as independent protection layers.
Risk Gap Determination
Calculated residual risk after credited protection layers and determined the gap each instrumented function needed to close.
SIL Target Assignment
Assigned a SIL target to each safety instrumented function, traceable to the scenario and the risk gap behind it.
Documentation and Handover
Delivered the analysis in a form the operator can reopen and update when the process changes, rather than a closed report.
Every safety instrumented function at the facility now has a SIL target traceable to a specific hazardous scenario, a specific risk gap and a documented set of credited protection layers. The operator can explain to a regulator, an insurer or its own engineering contractor why each target is what it is, which it could not do before.
The independent protection layer assessment produced the most consequential findings. Several safeguards credited informally in the original HAZOP did not qualify as independent, because they shared a sensor, a final element or an operator action with another layer already credited. Removing those raised the risk gap in some scenarios. In other scenarios, protection layers that genuinely were independent had never been credited at all, which lowered the gap and reduced the SIL target below what precedent had assumed.
The net effect was a mix rather than a uniform direction, which is the normal outcome of a first LOPA and the reason the exercise is worth doing. Some functions required more than the operator expected. Several required less, and the reductions carried through to the capital project as avoided hardware and avoided lifetime proof testing. Because the analysis was delivered before the contractor specified the systems, those reductions were realized rather than noted. The operator also now holds the analysis in a reusable form, so the next process change is an update rather than a new study.
Who Should Engage Arista Cyber?
Operators specifying safety instrumented functions against SIL targets they cannot trace to a risk assessment, those carrying HAZOP records that identify scenarios without evaluating protection layers, and capital projects needing defensible targets before systems are specified.
What's the Next Step?
Ready to replace inherited SIL targets with risk-based ones? Contact Arista Cyber to scope a LOPA study.
- Commission a LOPA study to establish defensible SIL targets
- Request an independent protection layer review of your existing HAZOP records
- Schedule a HAZOP or HAZID study for new or modified process