ModulesHAZOP & LOPAProcess Safety
HAZOP, with LOPA where it counts.One scenario record, from the first deviation to the verified fix.
For process safety engineers and plants without a PSM department: run HAZOP alone, with LOPA on its own screen, or with LOPA inside the worksheet. Same record, same matrix.
| No. | Cause → consequence | InitialS · L · result | LOPA | UMRL · result | MRL · result | Safeguards / IPLs | Recommendation |
|---|---|---|---|---|---|---|---|
| 2.1 | Steam valve TV-201 fails open, outlet blockedOverpressure of V-201, rupture, propane fire | S5 · L4 HighFail | Inputs complete Open LOPA → | L4 · 1.5E-02 HighFail | L2 · 1.5E-05 MediumFail | PSV-201 relief to flareIPLRelief device · PFD 1.0E-02 PAHH-201, operator isolates steamIPLAlarm and response · PFD 1.0E-01 | Add an independent high-pressure trip on the steam supplyPFD credit 1.0E-01 AT-0142 · Open |
The same scenario, three ways of working. Switch the mode: nothing is retyped. An example study; the fields are the product’s, the values illustrative.
Where it connects
On the same loop: Process Hazard Identification, Management of Change, Pre-Startup Safety Review and 38 more modules in one workspace.
Method note
LOPA in the room, or after it? Both schools are right.
The literature is split, and the right answer changes between a design study and a revalidation.
Leandro · Founder, UProcess
One school keeps the HAZOP meeting for brainstorming and runs LOPA afterwards, on the few scenarios that need numbers. The other runs LOPA in the room with the same team, so nothing is lost in the handoff.
So each study picks its mode, and can change it later.
- HAZOP onlyMost scenarios. Ranked on the matrix; no numbers the team cannot defend.
- Linked LOPALOPA after the meeting, by an analyst, only where the consequence earns it.
- CombinedLOPA in the session, when the same people must own the numbers.
Where HAZOP & LOPA usually breaks
Four places a good study goes wrong, and what the record does about each.
The handoff loses the reasoning.
When LOPA is done later, from a separate file, the assessor may never read why the HAZOP team doubted a safeguard. Published reviews describe a relief valve credited in LOPA that the HAZOP team had judged unable to vent the event.
Source: IChemE Loss Prevention Bulletin 265
In UProcess LOPA opens on the same scenario record. The cause, the consequence and the team’s safeguards are already there, in linked or combined mode.
LOPA · scenario 2.1 · from the worksheet
- Cause
- Steam valve TV-201 fails open, outlet blocked
- Consequence
- Overpressure of V-201, rupture, propane fire
- Initiating event
- 1.0E-01 /yr · control valve failure
- Ignition · worker
- 0.5 · 0.3
One LOPA analysis per scenario. UMR is shared by its consequence categories; MR is graded per category.
A safeguard is not an IPL until it qualifies.
A review of tank-farm LOPAs found alarms credited when the control system was itself the initiating cause, and shared valves counted twice. Independence, effectiveness and auditability decide the credit.
Source: HSL review, IChemE Hazards XXII
In UProcess Only safeguards marked IPL-qualified count in MR, each with its PFD and its notes on independence, effectiveness and auditability. If a qualified IPL has no PFD, MR stays undetermined instead of being guessed.
Safeguards · scenario 2.1
Two scales that never meet.
LOPA targets set apart from the company’s risk matrix produce numbers that rank one way in the HAZOP and another in the LOPA, and requirements no one can trace back.
Source: IChemE Hazards 28
In UProcess UMR and MR land on the same published matrix version the HAZOP is rated against: one likelihood scale, one result, one pass or fail.
Corporate 5×5 · published 12 Aug 2026
UMR · L4 · High · FailMR · L2 · Medium · Fail
The recommendation outlives the study, unfinished.
Process safety rules require PHA findings to be promptly addressed, and investigators keep finding recommendations that were never carried out, or closed when only part was done.
Source: U.S. Chemical Safety Board
In UProcess Each recommendation becomes an action with an owner and a due date, and it can be set to close only after someone checks that it worked.
Action Tracking · AT-0142
Add an independent high-pressure trip on the steam supply
- Owner
- Sarah Mitchell
- Due
- 30 Nov 2026
- From
- HAZOP & LOPA · scenario 2.1
Trip proven at its set point before start-up · checker David Chen
Process accident case · Standby reboiler
The spare reboiler that was already full.
The paperwork said it was protected. The valve in the field said otherwise.
Session 14 Oct 2026Facilitator Emma ClarkeScribe James Walker
| Team member | 7 Oct | 9 Oct | 14 Oct | Total |
|---|---|---|---|---|
| Emma Clarke | 6 h | 6 h | 4 h | 3 |
| James Walker | 6 h | 4 h | 2 | |
| Sarah Mitchell | 6 h | 4 h | 2 | |
| Mark HughesExternal participant | 6 h | 6 h | 2 |
The record an auditor asks for.
Who was in the room is part of the study, not a sign-in sheet in a drawer.
- The team: colleagues from your company, and external participants by name.
- Every session with its date, scope, facilitator and scribe.
- Attendance by session, with hours when you record them.
- A revalidation history for the study, node by node.
What’s in a study
- Structure
- Study → nodes → deviations → scenarios, each a cause and a consequence, with one risk row per consequence category.
- Modes
- HAZOP only, linked LOPA or combined, chosen per study and changeable later. Linked and combined need a matrix version with a quantitative likelihood scale.
- Risk
- Initial, after safeguards (UMR → MR with LOPA) and after recommendations, each with its result and pass or fail.
- Libraries
- Your company’s initiating causes, safeguards with default PFDs, and recommendations, reused across studies.
- Safeguards
- IPL type, PFD, proof test interval, response time, independence, effectiveness, reliability, auditability, safety-critical class.
Questions
Do I have to run LOPA on every scenario?
No. A LOPA analysis exists only for the scenarios where you save its inputs. The rest stay qualitative.
Should LOPA happen in the meeting or after it?
Your call, per study. Linked suits LOPA after the session; combined suits LOPA in the room.
What makes a safeguard an IPL?
The team’s judgement on independence, effectiveness and auditability. UProcess records that basis and credits only what is marked IPL-qualified.
Who can read a study?
Anyone you invite as a viewer: they can read the study without editing it.