Safety has many aspects. One distinguishes fire safety, gas explosion safety, machine safety, process safety, labour safety, public safety etc. Safety has technical, organisational, psychological, societal and ethical aspects. Whatever aspect of safety one considers, the question how safe is safe enough is difficult to answer. Of course one can look at accident statistics, measure frequencies and see how trends go. This however holds for accident types which occur in relatively large numbers. The large consequence accidents with low frequency are more difficult to track and one needs to observe developments a number of years to get a feel for improvement or deterioration of a situation. All this is only to see trends and not even to answer the question: "Did we do enough"? Risk assessment can be of help. After going through the various steps of identification, consequence analysis, event frequency estimation, determining individual risk contours and group risk one can get at least an impression of the seriousness of a situation. Identifying all scenarios and taking into account all possible effects and getting a realistic estimate of frequencies is quite cumbersome and usually far beyond possible means, although newer methods such as the European ARAMIS is quite helpful in generating a scenario with the so-called 'bow tie' at least for chemical plant. Another possibility is to detect, monitor and analyse systematically small defects, mishaps, or upsets in a process or a situation over time. Since this kind of small deviations may be a precursor of a large event, if followed and judged by a team of experts, it can be a method to prevent and improve. Some years ago a tool was developed called layer of protection analysis (LOPA), first in the process industries in the United States and later spreading to Europe and other places. This tool in its simplest form is only semi-quantitative and puts emphasis on decreasing event frequency by adding layers of protection and considering their reliability assuming that once a layer functions the installation is put to a safe state. This tool now over the years developed further. First the residual damage after successful functioning of a layer can be quantified also in terms of business interruption and clean-up, secondly an overall target for the integral system of layers can be set, based on damage classification and cost. Cost-benefit analysis can be added. Thirdly the technical reliability of the layers analysed by e.g. fault tree, can be complemented with an effectiveness factor of the organisation including procedures and human factor. This effectiveness can be 'measured' by several different methods. Finally more structured methods become available such as cause tree to generate scenario and initiating events. LOPA therefore develops to a rather all-round top-down management tool applicable to many fields in which safety and security has to be guarded and the question of urgency of further improvement shall be answered. The paper will give some examples.
