Three safeguards can share one failure

Counting barriers is not enough; their dependencies matter.
Imagine two automatic actions and an alarm using the same measurement. If that measurement is involved in the initiating event, crediting three independent reductions may create unjustified confidence. LOPA needs a defined scenario, justified assumptions and examination of dependencies before the spreadsheet. Generic data, unverified response times and overlooked enabling conditions can undermine an elegant result.
For each credited layer, document why it is effective, sufficiently independent and verifiable for the specific scenario.
Which common dependency deserves another look today?

A useful follow-up is to trace the assumptions: who supplied each input, which scenario does it describe, and when will it be reviewed? Making these choices visible lets the team discuss the assessment’s robustness rather than treating a numerical result as certainty detached from the actual plant.