Layer of Protection Analysis (LOPA) Explained

LOPA, or layer of protection analysis, sits between a qualitative hazard study and a full quantitative risk assessment. A HAZOP study finds the scenarios; LOPA puts order of magnitude numbers on them and asks a simple question: are the existing safeguards enough? It was formalised by the Center for Chemical Process Safety (CCPS) in 2001 and is the most common way to set the required safety integrity level of a safety instrumented function under IEC 61511.

What LOPA does

A LOPA study looks at one cause and consequence pair at a time. Each pair is a scenario, for example “level control valve fails open, tank overfills, flammable liquid is released”. For each scenario the team records:

• Initiating event (IE): the failure or error that starts the sequence, with a frequency per year.
• Enabling conditions and conditional modifiers: probabilities such as the fraction of time the unit is in the hazardous mode, or the chance of ignition or of people being present. CCPS 2015 gives guidance on when these may be used.
• Independent protection layers (IPLs): safeguards that can stop the scenario on their own, each with a probability of failure on demand (PFD).
• Consequence and tolerable frequency: the severity of the outcome and the maximum frequency the company will accept for it.

The output is the mitigated event frequency. If it is above the tolerable frequency, the gap must be closed, often by adding or upgrading a safety instrumented function (SIF).

The LOPA equation

The mitigated frequency of a consequence for one scenario is the initiating event frequency multiplied by every probability that must line up for the consequence to happen:

$$f_C = f_{IE} \times \prod_j P_j \times \prod_i PFD_i$$

where f_IE is the initiating event frequency in events per year, P_j are enabling conditions and conditional modifiers, and PFD_i is the probability that IPL i fails when demanded. Each IPL gives a risk reduction factor:

$$RRF = \frac{1}{PFD}$$

When a SIF is needed, its required PFD comes from the ratio of the tolerable frequency to the frequency with all other layers in place:

$$PFD_{SIF} \le \frac{f_{tolerable}}{f_{C,\,no\,SIF}}$$

Because LOPA values are rounded to powers of ten, the method is often done by adding exponents. That simplicity is its strength, but it also means results are only as good as the order of magnitude data behind them.

Layers of protection in LOPA

Download diagram (WebP)

The figure shows typical layers in the order they act. The PFD values marked are the generic values given in CCPS 2001; a SIF takes a value from its SIL band. In a real scenario only the layers that actually prevent that consequence are credited. A dike, for example, mitigates the spread of a spill but does not prevent an overpressure.

What makes a layer independent

Not every safeguard is an IPL. CCPS sets out core attributes that a safeguard must meet before it can be credited:

• Effective: it can detect the condition and act in time to prevent the consequence, with enough capacity.
• Independent: it does not share components with the initiating event or with other IPLs claimed in the same scenario.
• Auditable: its performance can be checked by testing, inspection and records.

Items such as training, procedures, maintenance programmes and fire protection that only acts after a release are usually treated as safeguards that support IPLs, not as IPLs themselves.

Typical values used in LOPA

The values below are the generic order of magnitude figures published in CCPS 2001 and IEC 61511-3. Companies normally adopt an approved table and justify any lower PFD claim.

Tolerable risk criteria

LOPA needs a target. Each company sets its own tolerable frequency for each consequence category, often linked to the severity rows of its risk matrix. For individual risk, the UK HSE R2P2 framework treats a fatality risk of 1 in 1000 per year as the boundary of intolerable risk for workers and 1 in a million per year as broadly acceptable, with ALARP in between. Scenario targets for severe consequences are therefore set well below the worker limit, because one person is exposed to many scenarios.

Many companies would specify the SIF to a PFD target with some margin below 0.02, or review whether another IPL could be added, before accepting the design.

Key formulas for LOPA

Strengths and limitations of LOPA

Strengths: quicker than full quantitative analysis, more consistent than a risk matrix alone, gives a clear documented basis for each SIL, and highlights safeguards that do not qualify as independent.

Limitations: it depends on the scenario list from the hazard study, uses generic data that may not suit a specific plant, and can hide common cause failures if independence is not checked carefully. It is not suited to complex scenarios with many interacting failures, where fault tree analysis or FMEA gives more insight. Results also depend on IPLs being maintained and tested as assumed, which links LOPA to reliability and availability management during operation.

LOPA interview and viva questions

1. What is the main output of a LOPA study? The mitigated event frequency of each scenario and, where it exceeds the tolerable frequency, the risk reduction a new or upgraded safeguard such as a SIF must provide.
2. What are the core attributes of an IPL? It must be effective in preventing the consequence, independent of the initiating event and other credited IPLs, and auditable.
3. Why is BPCS credit limited to a PFD of 0.1? IEC 61511-1 limits a BPCS protection layer to a risk reduction of no more than 10 unless it is designed and managed to SIS standards.
4. How is the required SIL found from LOPA? Divide the tolerable frequency by the mitigated frequency without the SIF to get the required PFD, then match it to the IEC 61511 SIL bands.
5. Why can an alarm on the same transmitter as the failed control loop not be credited? It shares the failed component with the initiating event, so it is not independent and would fail at the same time.