HAZOP vs LOPA: How the Two Process Safety Studies Divide the Work

HAZOP finds the hazardous scenarios; LOPA decides whether the safeguards against them are enough. They are sequential, not rival: a HAZOP is a qualitative, systematic search for what can go wrong, and a LOPA is a semi-quantitative check of whether the protection layers around the serious findings reduce risk to a tolerable level. Run one without the other and process safety has either a list with no math or math with no list.

What each study does

• HAZOP (Hazard and Operability study): a team walks the process node by node applying guidewords (no flow, more pressure, reverse flow) to surface deviations and their consequences. It is broad, structured, and qualitative: it answers "what can happen here?" without putting numbers on likelihood.
• LOPA (Layer of Protection Analysis): takes a specific serious scenario and multiplies its initiating-event frequency through the failure probabilities of each independent protection layer, comparing the result to a tolerable-risk target. It answers "is this scenario adequately protected, and if not, by how much does it fall short?"

The handoff between them

The natural workflow: HAZOP first, then LOPA on the scenarios that warrant it. HAZOP typically generates dozens to hundreds of findings; most are handled by good engineering judgment, but the ones with severe consequences and uncertain protection get escalated to LOPA for a rigorous check. LOPA is deliberately narrower and more expensive per scenario, so it is aimed, not sprayed. Where LOPA finds a gap, the required additional risk reduction often becomes a safety instrumented function with a target integrity level, and the whole picture is frequently visualized as a bowtie.

A worked example: one deviation, two studies

HAZOP on a reactor node, guideword "more temperature": the team identifies loss of cooling leading to runaway and possible rupture, a severe consequence. That is the HAZOP’s job done: scenario found, consequence rated serious, recommendation "assess protection adequacy." LOPA picks it up: initiating event (cooling pump failure) at 0.1 per year, times a high-temperature alarm with operator response (PFD 0.1), times a safety instrumented function (PFD 0.01), times a correctly sized relief device (PFD 0.01), equals a mitigated frequency of one in a million years, comfortably inside a one-in-a-hundred-thousand-year target. Verdict: adequately protected, with margin. Remove the SIF from that chain and LOPA shows the scenario missing its target by a factor of ten, an objective, defensible case for installing it. HAZOP could never have produced that number; LOPA could never have found the scenario on its own.

Choosing and sequencing

• Start with HAZOP for any new or significantly modified process: you cannot analyze protection for scenarios you have not found.
• Apply LOPA selectively to high-consequence HAZOP findings where protection adequacy is genuinely uncertain, do not LOPA everything.
• Both feed the same downstream: recommendations become tracked actions, and any credited protection layer becomes a maintenance and testing obligation, an untested layer is a LOPA credit that has quietly become fiction.

Why the distinction matters to maintenance

Both studies produce promises the plant floor must keep. HAZOP recommendations become engineering and procedural changes; LOPA credits become proof-tested trips, inspected relief valves, and maintained alarms. The most rigorous LOPA on paper is worthless if the safety instrumented function it credits misses its proof test, which is where process safety stops being a study and becomes a management-of-change and maintenance discipline.

Where Fabrico fits

Fabrico is not a process hazard analysis tool and does not run HAZOP or LOPA sessions; process safety engineers do. What Fabrico owns is the follow-through both studies depend on: recommendations and credited protection layers turned into scheduled, evidenced work, proof tests, inspections, and interlock checks that never silently lapse, with overdue safety-critical work made conspicuous and the full history ready for the functional safety audit. The studies say what protects the plant; the CMMS proves it still does. EU-built, with EU data residency.

Frequently Asked Questions

Do I need both HAZOP and LOPA?

For most significant process hazards, yes, in sequence: HAZOP to find and rate scenarios, LOPA to quantify protection on the serious ones. HAZOP alone leaves protection adequacy to judgment; LOPA alone has no way to discover scenarios.

Can LOPA be done without a HAZOP?

In principle you can LOPA a scenario identified any way, but in practice the scenarios come from a hazard study, usually HAZOP. Skipping the systematic search risks analyzing the protection for the hazards you happened to think of while missing the ones you did not.

Which is more rigorous?

They are rigorous about different things. HAZOP is rigorous about completeness of scenario discovery; LOPA is rigorous about the adequacy of protection for a given scenario. Neither substitutes for the other, and full quantitative risk assessment sits beyond both for the rare cases that need it.

Want every HAZOP action and LOPA-credited barrier turned into work that never silently lapses? Book a Fabrico demo to see process-safety follow-through run through a field-ready CMMS.