No amount of protection drives risk to zero. After every safeguard has been applied, the alarms, the relief valves, the safety instrumented functions, some risk always remains, and that remainder is what residual risk names. The whole point of a risk analysis is to show that this residual is small enough: at or below the tolerable target the organization has set. Residual risk is where the initiating frequency, the protection layers, and the tolerable criterion meet on one line, and understanding it clarifies what a layer of protection analysis is really trying to prove.
Residual risk in one line: Residual risk is the risk that remains after all protection layers, including any safety instrumented function, have been applied to a hazard. It is what is left of the original, unmitigated risk once the safeguards reduce it, and for the design to be acceptable this residual must sit at or below the tolerable risk target the organization has defined.
Start with the unmitigated risk: how often a hazardous event would occur, and how bad it would be, if nothing were done to prevent it. That is the raw danger of the process. Protection layers, each of which reduces the frequency of the event reaching its consequence, are then stacked against it. Each independent layer, a basic control, an alarm with operator action, a relief device, a safety instrumented function, cuts the frequency by its own probability of failing on demand, and the layers multiply together.
Residual risk is what remains at the bottom of that stack. If the initiating event happens at some frequency and passes through several protection layers, the residual frequency is the initiating frequency multiplied by the probability that every layer fails to stop it, which is the product of their individual failure probabilities. That residual frequency, paired with the consequence severity, is the residual risk the design leaves in place. It is not a design flaw; it is the unavoidable remainder that every protected system carries.
The crucial comparison is between this residual and the tolerable risk criterion. The tolerable risk is the level the organization has decided it is willing to accept for a hazard of that severity, usually expressed as a maximum acceptable frequency for the event. The design is acceptable only if the computed residual sits at or below that tolerable line. If it does not, more risk reduction is needed, another layer, a higher-integrity function, or a change to the process itself, until the residual comes down to the target.
A layer of protection analysis is, at heart, a structured way to compute residual risk and check it against the tolerable target. It takes each hazard scenario, identifies the initiating cause and its frequency, credits each independent protection layer with its risk-reduction factor, and multiplies through to get the mitigated frequency. Comparing that mitigated frequency to the tolerable frequency reveals whether a gap remains, and if so, how large it is, expressed as the additional risk reduction still required.
The safety instrumented function is often the layer that closes the gap. If the analysis shows the residual is still above tolerable after crediting the non-instrumented layers, the required extra risk reduction determines the integrity level the SIF must achieve. In this sense the SIL requirement is derived from the residual risk gap: the function is sized precisely to bring the residual down to the tolerable line, no more and no less. A SIF that over-delivers wastes money; one that under-delivers leaves the residual above target.
When the residual meets the target, the analysis documents that the scenario is adequately protected and records the assumptions, the initiating frequency, the layers credited, their claimed reliability, that the conclusion depends on. Those assumptions are not permanent facts; they are commitments the operating organization must keep true, because a layer that is bypassed, poorly maintained, or less reliable than assumed raises the real residual above the value the analysis certified. Residual risk on paper is only as good as the layers behind it staying as good as claimed.
Meeting the tolerable criterion is not always the end of the story. Many regimes also expect that risk be reduced as low as reasonably practicable, so even a residual that sits below the tolerable line may need further reduction if additional measures are cheap and effective relative to the risk they remove. Residual risk is therefore the quantity that both tests and demonstrations turn on: it must be at or below tolerable, and the organization must be able to show it has been driven down as far as is reasonable.
The honesty of any residual-risk claim depends entirely on the protection layers performing as the analysis assumed. A relief valve that is stuck, an alarm that operators ignore, a safety function whose proof tests have lapsed, each quietly raises the real residual above the certified value, and the danger is that nothing visibly changes on paper. Keeping the layers in the condition the analysis assumed is what keeps the residual claim true, and that is largely a monitoring and maintenance discipline.
A cloud SCADA platform supports that discipline by keeping the health of the protection layers in view: whether safety functions are in service or bypassed, whether alarms are being acted on, whether proof tests are current, and how often demands are actually occurring. If the real demand rate or the real reliability drifts from the values the analysis assumed, that is a signal the residual risk has moved and the analysis needs revisiting. Because Merobix reads these layers into one browser-based view, it helps an operator ensure the residual risk they claim on paper still matches the risk the facility actually carries.
Residual risk is what actually remains after all protection layers are applied, computed from the initiating frequency and the combined failure probabilities of the layers. Tolerable risk is the target level the organization has decided it will accept. The design is acceptable only when the residual sits at or below the tolerable line; residual is the result, tolerable is the criterion it is judged against.
In broad terms, you take the frequency of the initiating event and multiply it by the probability that every independent protection layer fails to stop it, which is the product of the layers' individual failure-on-demand probabilities. The result, the mitigated event frequency, paired with the consequence severity, is the residual risk. A layer of protection analysis performs this calculation scenario by scenario.
The required integrity level of a safety instrumented function is derived from the residual risk gap. After crediting the non-instrumented layers, if the residual is still above the tolerable target, the additional risk reduction needed sets the SIL the function must achieve. The SIF is sized to bring the residual down to the tolerable line, so residual risk is what determines how strong the function has to be.
Merobix reads your field devices into a cloud SCADA - the real thing behind these terms, live in days from any browser.