Audio deep dive
5:36Where HAZOP ends and SIL determination begins
A practical discussion about the different questions answered by HAZOP and SIL determination, and the evidence needed to connect them through the safety lifecycle.
Editorial note: This AI-produced discussion is an accessible companion to the written guide and may simplify or paraphrase technical and regulatory points. For precise terminology, standards references and engineering boundaries, refer to the written article and its cited sources. Always follow the applicable OEM instructions, approved site procedures and project-specific engineering requirements.
The decision trail
Can the team trace each target integrity requirement back to a defined hazard scenario, credited safeguards and an approved risk decision?
Start with the question
The studies connect—but their purposes and proof boundaries are different
HAZOP
What can go wrong with the process or operation?
A multidisciplinary team examines design intent using nodes, parameters, guide words and credible deviations.
Produces: A structured record of deviations, causes, consequences, safeguards, recommendations and actions.
Does not prove: It does not, by itself, assign a target SIL or prove that a safeguard is sufficiently reliable.
SIL determination
How much risk reduction must a proposed safety instrumented function provide?
Selected scenarios are evaluated using an agreed method such as LOPA, a calibrated risk graph or a safety matrix.
Produces: A documented target integrity requirement for each required safety instrumented function.
Does not prove: It does not design the function or prove that the proposed architecture will achieve the target.
IEC 61882 method
HAZOP is a structured examination of design intent—not a SIL calculator
IEC 61882:2016 describes a guide-word-based technique with defined preparation, examination, documentation and follow-up. The study team divides the system into manageable parts, establishes design intent and explores credible deviations such as no flow, more pressure, less temperature or reverse flow.
For each deviation, the team records credible causes, consequences, existing safeguards and actions. The value comes from disciplined team knowledge: process, operations, maintenance, control and instrumentation, mechanical and safety perspectives expose interactions that a single-discipline review can miss.
Intent
Deviation
Cause
Consequence
Safeguards
Boundary: a HAZOP worksheet can identify a candidate need for instrumented protection. It cannot establish a defensible target SIL unless a separate, documented risk-evaluation method and its required inputs are applied.
Use precise terms
“SIL assessment” can hide five different lifecycle activities
IEC 61511 separates requirements across the safety lifecycle. Naming the exact activity prevents a proposal, report or purchase order from promising one deliverable while the plant expects another.
- 01
SIL determination
Defines the required risk reduction and target SIL for a specific safety instrumented function.
- 02
Safety requirements specification
Turns the risk decision into testable functional and integrity requirements: safe state, trip basis, response time, operating modes and proof-test assumptions.
- 03
SIL verification
Checks whether the proposed sensor, logic solver and final-element design can meet the target using documented reliability, architecture and lifecycle assumptions.
- 04
SIS validation
Tests the implemented function against the approved safety requirements specification before it is relied upon.
- 05
Functional safety assessment
Provides an appropriately independent judgement of the functional-safety work and evidence at defined lifecycle stages.
A useful scope should say “SIL determination using the agreed method,” “SRS development,” “SIL verification,” “SIS validation” or “functional safety assessment”—not simply “SIL assessment.”
Control the handoffs
A credible lifecycle keeps the hazard basis attached to the engineered function
Hazard identification
HAZOP or another suitable process-hazard method establishes credible scenarios.
Scenario selection
The team identifies scenarios that need further risk evaluation and defines the cause-consequence basis.
SIL determination
An agreed method evaluates existing risk reduction and any remaining requirement for a SIF.
SRS
The safety requirements specification defines what each SIF must do and the integrity it must achieve.
Design and verification
The proposed architecture and assumptions are checked against the SRS and target SIL.
Implementation and validation
The installed function is tested against the specification and accepted through the project lifecycle.
Operate, maintain and change
Proof testing, performance evidence, impairment control and management of change preserve the basis.
The sequence is not always a single waterfall. Actions, design changes and new information can send the team back to an earlier decision. What matters is controlled traceability: scenario, assumption, requirement, design evidence, test evidence and operating basis.
Credit only what is defensible
LOPA is not a more detailed HAZOP—and every safeguard is not an IPL
Layer of Protection Analysis is a semi-quantitative method often used for SIL determination. It evaluates one defined cause-consequence scenario using an initiating-event basis, relevant enabling or conditional factors, credited independent protection layers and the organisation’s approved tolerable-risk criterion.
IEC 61511-3 provides a framework and examples for determining required integrity, but it does not prescribe the SIL for a particular application. Initiating frequencies, protection-layer credits, risk criteria and calibration choices remain project- or organisation-specific inputs that need a documented basis.
Specific
The protection acts on the defined scenario and consequence, rather than being a generic control.
Independent
It is not defeated by the initiating cause or by the failure of another credited layer.
Dependable
Its claimed performance has a defensible technical and operating basis.
Auditable
The assumptions, testing, maintenance and performance can be checked over time.
Good evidence
A safeguard has a defined scenario, independence basis, performance claim, test regime and owner.
Common double-count
Two claimed layers share the same sensor, logic, power, final element or human response path.
Assess the whole function
SIL is not a universal product label
A safety instrumented function is the complete path that detects a defined condition and takes the process to its specified safe state. Component suitability and certification evidence can support the design, but the integrity claim depends on the complete function, its architecture, application and lifecycle assumptions.
01
Sensor subsystem
Detects the defined process condition using the agreed voting, diagnostics and failure assumptions.
02
Logic solver
Evaluates the inputs and commands the required action using the approved application logic.
03
Final-element subsystem
Moves the process toward the defined safe state; valves, actuators, relays and utilities may dominate the failure probability.
The target belongs to the function.
Device failure data, systematic capability, architecture, common-cause assumptions, diagnostics, proof-test effectiveness and interval all contribute to the verification. None of them alone proves the SIF.
Illustrative scenario
Follow the decision without inventing universal numbers
HAZOP finding
A credible feed-control failure can drive reactor pressure above the intended operating envelope, with a potential loss-of-containment consequence. The team records existing safeguards and recommends further risk evaluation.
SIL determination question
For the defined cause and consequence, which safeguards qualify for credit and what additional risk reduction—if any—must a high-high pressure shutdown function provide?
SRS handoff
If a SIF is required, the specification defines the sensed condition, trip action, safe state, response time, operating modes, reset, bypass, testing and integrity requirements.
Verification and validation
The design is checked against the integrity requirement, then the installed function is tested against the approved SRS.
No initiating frequency, protection-layer credit, tolerable-risk value or target SIL is shown here. Those values must come from the site’s controlled method, evidence and risk criteria—not from a generic website example.
Prepare the evidence and people
The quality of the study cannot exceed the quality of its inputs
For HAZOP
- Current P&IDs and process description
- Design intent and operating envelopes
- Normal, startup, shutdown and abnormal modes
- Cause-and-effect and control narratives
- Operating and maintenance knowledge
For SIL determination
- Clearly defined cause-consequence scenarios
- Consequence and initiating-event basis
- Enabling and conditional factors
- Evidence for each proposed protection-layer credit
- Approved organisational risk criteria
For SIL verification
- Approved SRS and target SIL
- Proposed architecture and device data
- Failure-rate and common-cause assumptions
- Diagnostic and proof-test coverage
- Proof-test interval and operating-mode basis
Participation matters: HAZOP needs the people who understand design intent and real plant operation. SIL determination needs competent risk-method facilitation plus process, operations, control and instrumentation and process-safety knowledge. Verification and independent assessment require different evidence and, where applicable, independence.
Make the output usable
A signed workshop sheet is not the whole safety case
HAZOP record
Nodes, design intent, deviations, causes, consequences, safeguards, recommendations, owners and status.
Scenario register
A controlled bridge from hazard study findings to the scenarios selected for further risk evaluation.
SIL determination report
Method, assumptions, risk criteria, credited layers, target for each required SIF and unresolved actions.
Safety requirements specification
The functional and integrity requirements against which the SIF will be designed, verified and validated.
Verification and validation evidence
Calculations, assumptions, test results, deviations and acceptance decisions linked back to the SRS.
Actions need owners, due dates, technical close-out evidence and a controlled route back into drawings, specifications, procedures and management of change. Otherwise, the study records the risk without changing it.
South African context
The law defines duties and regulated risk-assessment routes—not one named HAZOP-to-SIL recipe
Section 8 of the Occupational Health and Safety Act requires employers, as far as reasonably practicable, to provide and maintain a working environment that is safe and without risk to employees. The Act does not prescribe HAZOP, LOPA or SIL determination by name.
For establishments within scope, the Major Hazard Installation Regulations, 2022 require an approved inspection authority to carry out a risk assessment in accordance with SANS 1461. The Regulations also require process-safety-management arrangements that address systematic identification and evaluation of major hazards and management of change.
HAZOP and IEC 61511 lifecycle work can provide important engineering evidence, but they are not substitutes for the regulated SANS 1461 risk assessment, the duty holder’s legal responsibilities, or any approved-inspection-authority work that applies. A standard can also become contractually required without becoming legislation.
Engineering evidence
Scenario traceability, risk decisions, SRS requirements, verification assumptions, validation records and management-of-change links.
Regulated MHI route
Classification, SANS 1461 risk assessment by an approved inspection authority, policy, safety-report and other duties according to establishment scope and tier.
Treat change as new evidence
Revalidation is triggered by the risk basis—not a generic calendar slogan
- 01A process, substance, inventory, throughput or operating envelope changes
- 02A new operating mode, cause or consequence becomes credible
- 03A credited safeguard or SIF architecture is modified, bypassed or removed
- 04Proof-test, demand, failure or incident evidence challenges an earlier assumption
- 05An incident, near miss or audit finding exposes a gap in the hazard basis
- 06The applicable legal, company or project review trigger is reached
MHI-specific trigger: Regulation 10 requires the SANS 1461 risk assessment at intervals not exceeding five years or when the establishment changes. Regulation 12 sets review triggers for a high-hazard establishment’s safety report. These exact duties should not be turned into a universal HAZOP timetable for every facility.
Five misconceptions
Shortcuts that break the traceability between hazard and protection
“HAZOP and SIL assessment are the same workshop.”
HAZOP identifies and records hazard and operability scenarios. SIL determination evaluates the integrity required of a specific instrumented protection function. They have different methods and outputs.
“A HAZOP recommendation automatically becomes a SIF.”
Recommendations may call for inherently safer design, mechanical protection, operating controls or further study. A SIF is one possible risk-reduction decision, not the default outcome.
“Every safeguard in the HAZOP can be credited in LOPA.”
Only a safeguard that satisfies the project’s protection-layer criteria can receive credit. Shared sensors, utilities, logic, final elements or human dependencies can defeat independence.
“A SIL-capable device makes the loop SIL 2 or SIL 3.”
The target and achieved performance belong to the complete safety instrumented function, including its architecture, application, testing and maintenance assumptions.
“A target SIL means the work is complete and compliant.”
Determination is one lifecycle decision. The SRS, design, verification, implementation, validation, operation, proof testing, change control and applicable legal duties still remain.
Common questions
HAZOP and SIL questions plant teams ask first
Does every HAZOP recommendation become a safety instrumented function?+
No. A recommendation may lead to inherently safer design, mechanical protection, a control change, an operating action or further analysis. A SIF is specified only where the risk decision establishes a need for instrumented protection and defines its function and integrity requirement.
Can LOPA be completed without a HAZOP?+
LOPA needs a clearly defined initiating cause, consequence and safeguard basis. A HAZOP is a common source of those scenarios, but another suitable process-hazard analysis may provide them. The important requirement is a complete, controlled and technically credible scenario basis.
What is the difference between SIL determination and SIL verification?+
SIL determination decides the integrity target a SIF requires. SIL verification tests the proposed design and its assumptions against that target. One sets the requirement; the other checks whether the design can meet it.
When should HAZOP and SIL work be revisited?+
Revisit the relevant work when the process, consequence, initiating-event basis, credited safeguards, SIF design or operating assumptions change, or when incidents, performance evidence, management of change, company rules or applicable regulation trigger a review.
What should a plant prepare before the studies begin?+
Provide current process information, P&IDs, design intent, operating modes, control and cause-and-effect narratives, incident and failure knowledge, safeguard evidence, approved risk criteria and the people who understand how the plant is designed, operated and maintained.
Authoritative references
Sources and further reading
Six supplied research reports were consolidated for this rewrite. Conflicting claims were resolved against current IEC catalogue records and published South African legislation and guidance. Full standards remain subject to licence, project edition control and competent interpretation.
- IEC — IEC 61882:2016, HAZOP application guide
- IEC — IEC 61511-1:2016 + AMD1:2017, SIS lifecycle requirements
- IEC — IEC 61511-3:2016, required SIL determination guidance
- South African Government — Occupational Health and Safety Act 85 of 1993
- South African Government — Major Hazard Installation Regulations, 2022
- South African Government — Explanatory Notes to the MHI Regulations, 2022
What this article does not promise
This article does not claim that Touch Teqniques Engineering is an approved inspection authority, accredited certification body or independently certified functional-safety assessor. It does not guarantee legal compliance, regulator acceptance or a particular SIL outcome. It does not supply universal initiating-event frequencies, protection-layer credits, tolerable-risk criteria, proof-test intervals or risk-graph calibrations. Exact scope, methods, independence, competency and acceptance roles must be confirmed for the facility and project.
Research status
Source-led technical briefing
Primary standards and South African regulatory sources checked
This article was rebuilt from a consolidated technical research pack and checked against current IEC catalogue pages and published South African regulatory material. It is general information and does not replace a site-specific engineering, legal or approved-inspection-authority assessment.
Research updated: 11 August 2026
Relevant domains: HAZOP and IEC 61882, SIL determination and IEC 61511, LOPA and protection-layer boundaries, South African MHI context.