Quantitative Risk Assessment: ALARP, FMEA, and SIL Determination

Industry Applications

Oil & gas processing, chemical plants, nuclear facilities, rail signaling, pharmaceutical manufacturing

Key Standards

IEC 61508 (functional safety), IEC 61511 (process industry), ISO 31000 (risk management), UK HSE Red Book

Typical Scale

QRA studies cover single units (e.g., distillation column) to full site-level FN curves with 10⁶+ Monte Carlo iterations

⚠️ Why It Matters

1

Inadequate hazard identification

↓

2

Undetected common-cause failures in control systems

↓

3

SIL-rated safety functions mis-specified

↓

4

Loss of containment during process upsets

↓

5

Escalation to major incident (fire, explosion, toxic release)

↓

6

Regulatory non-compliance and operational shutdown

📘 Definition

Quantitative Risk Assessment (QRA) is a structured engineering methodology that assigns numerical probabilities and consequences to hazardous events, enabling objective evaluation of risk levels against defined tolerability criteria. It underpins ALARP (As Low As Reasonably Practicable) justification, supports Failure Modes and Effects Analysis (FMEA) severity-probability scoring, and informs Safety Integrity Level (SIL) determination per IEC 61508 and IEC 61511. QRA integrates fault tree analysis, event tree analysis, consequence modeling (e.g., dispersion, blast overpressure), and reliability data to derive risk metrics such as individual fatality risk (IFR) or societal risk (FN curves).

🎨 Concept Diagram

AI-generated illustration for visual understanding

💡 Engineering Insight

ALARP is not a mathematical endpoint — it’s an engineering judgment anchored in evidence. A SIL assignment without documented cost-benefit analysis and stakeholder consultation is legally indefensible in jurisdictions like UK HSE or EU Seveso III. Always trace PFDavg back to component-level λDU and diagnostic coverage; 'black box' SIL tools without transparent inputs violate IEC 61508 Part 2 §7.4.2.

📖 Detailed Explanation

Quantitative Risk Assessment begins with recognizing that qualitative judgments ('high', 'medium', 'low') lack the rigor needed for life-critical systems. Instead, QRA converts hazard narratives into measurable frequencies and outcomes — e.g., a pressure relief valve failure becomes λ = 4.2 × 10⁻⁵ /hr based on OREDA 2021 data, and its consequence becomes thermal radiation dose contours modeled in PHAST or SAFETI.

Deeper analysis requires understanding dependencies: common-cause failures (CCFs) can reduce effective redundancy by >50% if not modeled via beta-factor or MGL methods; proof test coverage (DC) directly modulates PFDavg — a 10% drop in DC from 95% to 85% increases PFDavg by ~4× for a 1oo2 architecture. Human factors, maintenance quality, and environmental stressors (e.g., corrosion, EMI) must be factored into λDU adjustments, not treated as afterthoughts.

At the advanced level, QRA integrates dynamic methods: Bayesian updating refines λ estimates using site-specific failure history; Monte Carlo simulation captures parameter uncertainty (e.g., ±30% on dispersion model coefficients); and digital twin-enabled continuous PFD monitoring uses real-time sensor health data to adjust functional safety performance in operation — moving beyond static SIL verification toward adaptive SIL assurance per IEC 61511 Ed.3 Annex F.

🔄 Engineering Workflow

Step 1

Step 1: Define scope, process boundaries, and tolerable risk targets (e.g., IFR ≤ 10⁻⁶/yr)

→

Step 2

Step 2: Conduct Process Hazard Analysis (PHA) — HAZOP + FMEA to identify hazards and initiate events

→

Step 3

Step 3: Build fault trees for each SIF and event trees for key scenarios; assign failure rates (λ) from OREDA, exida, or site-specific data

→

Step 4

Step 4: Calculate PFDavg using Markov or simplified equations; verify RRF meets target SIL

→

Step 5

Step 5: Perform ALARP demonstration — compare risk reduction cost vs. risk reduction benefit using £/statistical life or €/risk unit

→

Step 6

Step 6: Document SIL verification report and functional safety management system (FSMS) evidence

→

Step 7

Step 7: Validate via loop testing, proof tests, and post-startup review with independent audit

📋 Decision Guide

Rock/Field Condition	Recommended Design Action
High-consequence scenario (e.g., >100 m³ flammable release) with HF ≥ 10⁻³/yr	Require SIL 3 SIF with redundant architecture (2oo3), DC ≥ 90%, proof test interval ≤ 6 months
Moderate consequence (toxic exposure <10 people) with HF = 10⁻⁴–10⁻³/yr	SIL 2 SIF with 1oo2 architecture, DC ≥ 70%, proof test interval ≤ 12 months
Low consequence (localized fire, no off-site impact) with HF ≤ 10⁻⁵/yr	SIL 1 or non-SIF mitigation (e.g., procedural controls, alarms); verify ALARP via cost-benefit analysis

📊 Key Properties & Parameters

PFDavg

10⁻² to 10⁻⁵ (unitless)

Average Probability of Failure on Demand — the long-term average likelihood that a Safety Instrumented Function (SIF) will fail to perform its intended safety action when required

⚡ Engineering Impact:

Directly determines achievable SIL level; PFDavg ≤ 10⁻² required for SIL 1, ≤ 10⁻⁴ for SIL 2, ≤ 10⁻⁵ for SIL 3

RRF

10 to 10,000 (unitless)

Risk Reduction Factor — ratio of process risk without a SIF to risk with the SIF in place

⚡ Engineering Impact:

RRF = 1 / PFDavg; defines minimum risk reduction needed to meet target SIL and ALARP thresholds

λDU

1 × 10⁻⁷ to 5 × 10⁻⁵ /hr

Dangerous Undetected Failure Rate — frequency per hour at which a SIF fails dangerously *and* remains undetected until next proof test

⚡ Engineering Impact:

Primary driver of PFDavg; dictates proof test interval, diagnostics coverage (DC), and hardware fault tolerance requirements

HF

10⁻⁶ to 10⁻¹ /yr

Hazard Frequency — estimated rate (per year) at which initiating events (e.g., valve failure, leak, overpressure) occur

⚡ Engineering Impact:

Multiplied by consequence severity to compute risk; anchors FMEA severity-probability matrices and event tree inputs

📐 Key Formulas

PFDavg (Simplified 1oo1)

PFDavg ≈ λDU × T / 2

Average probability of failure on demand for a single-channel SIF tested every T hours

Variables:

Symbol	Name	Unit	Description
PFDavg	Average Probability of Failure on Demand	dimensionless	Average probability that a safety instrumented function fails to perform its intended safety action when required
λDU	Dangerous Undetected Failure Rate	1/hour	Rate at which dangerous failures occur and remain undetected until proof test
T	Proof Test Interval	hours	Time between successive proof tests of the safety instrumented function

Typical Ranges:

SIL 1 design

1 × 10⁻³ to 1 × 10⁻²

SIL 3 design

1 × 10⁻⁵ to 1 × 10⁻⁴

⚠️ Must be ≤ target PFDavg band per IEC 61508 Table 2

🔧 Open Calculator

RRF

RRF = 1 / PFDavg

Risk reduction factor provided by a Safety Instrumented Function

Variables:

Symbol	Name	Unit	Description
RRF	Risk Reduction Factor		Risk reduction factor provided by a Safety Instrumented Function
PFDavg	Average Probability of Failure on Demand		Average probability that a Safety Instrumented Function fails to perform its intended function when required

Typical Ranges:

SIL 1

10 to 100

SIL 3

1,000 to 10,000

⚠️ RRF must meet or exceed target RRF per IEC 61508 Table 3

🔧 Open Calculator

ALARP Cost-Benefit Threshold

Cost per statistical life (CPSL) = ΔCost / (ΔRisk × 10⁶)

Monetary value assigned to risk reduction; used to justify further safeguards

Variables:

Symbol	Name	Unit	Description
CPSL	Cost per Statistical Life	USD/life	Monetary value assigned to risk reduction; used to justify further safeguards
ΔCost	Change in Cost	USD	Incremental cost of implementing additional risk-reduction measures
ΔRisk	Change in Risk	fatalities per million	Reduction in fatality risk achieved by the safeguard

Typical Ranges:

UK HSE guidance

£1–3 million per life-year saved

EU Seveso III

€2–5 million per life-year saved

⚠️ If CPSL exceeds upper bound, further risk reduction is not 'reasonably practicable'

🔧 Open Calculator

🏭 Engineering Example

Grangemouth Refinery (INEOS, UK)

N/A — Process facility (hydrocarbon processing)

HF

2.1 × 10⁻³ /yr (PSV blockage + upstream overpressure)

RRF

5,900

SIL_target

SIL 3

Consequence

Potential 300 m² jet fire, IFR = 3.8 × 10⁻⁵/yr pre-mitigation

PFDavg_measured

1.7 × 10⁻⁴

Proof_Test_Interval

6 months

🏗️ Applications

Design of emergency shutdown systems (ESD)
Justification of fire & gas detection coverage
Verification of burner management systems (BMS)
Cybersecurity risk integration into SIS architecture

🔧 Calculate This

⚡

Calculate Basic Risk Matrix

Calculate risk level using Likelihood × Severity (5×5)

Open →

Or browse all tools:

🔧 Hazard Identification & Risk A...

📋 Real Project Case

Automated Assembly Line Robot Cell Risk Assessment

Tier-1 automotive supplier, Ohio plant upgrade

Challenge: New collaborative robot (cobot) integration without physical guarding

Read full case study →

Pharmaceutical Cleanroom HVAC Failure Risk Mitigation Offshore Wind Turbine Blade Repair Confined Space Entry Food Processing Plant LOTO Program Overhaul Urban Tunnel Construction Vibration & Settlement Risk Model

🎨 Technical Diagrams

📚 References

[1]

IEC 61508-1:2010 Functional safety of electrical/electronic/programmable electronic safety-related systems — Part 1: General requirements — International Electrotechnical Commission

[2]

IEC 61511-1:2016 Functional safety — Safety instrumented systems for the process industry sector — Part 1: Framework, definitions, system, hardware and application programming requirements — International Electrotechnical Commission

[3]

HSE Red Book: Reducing Risks, Protecting People — HSE's decision-making process — UK Health and Safety Executive

[4]

OREDA Handbook (2021 Edition) — OECD Offshore Reliability Data Project

🔗 Related Knowledge

Risk Scoring Models: RPN, Risk Priority Number, and Weighted Scoring

Quantitative Risk Assessment: ALARP, FMEA, and SIL Determination

⚠️ Why It Matters

📘 Definition

🎨 Concept Diagram

💡 Engineering Insight

📖 Detailed Explanation

🔄 Engineering Workflow

📋 Decision Guide

📊 Key Properties & Parameters

PFDavg

RRF

λDU

HF

📐 Key Formulas

PFDavg (Simplified 1oo1)

RRF

ALARP Cost-Benefit Threshold

🏭 Engineering Example

Grangemouth Refinery (INEOS, UK)

🏗️ Applications

🔧 Calculate This

📋 Real Project Case

Automated Assembly Line Robot Cell Risk Assessment

🎨 Technical Diagrams

📚 References

📐 Prerequisites

➡️ Next Step

🔗 Engineering Applications