LOPA, Layer of Protection Analysis.
LOPA, Layer of Protection Analysis is the semi-quantitative process safety technique used to determine whether the existing layers of protection adequately reduce the risk of a hazardous scenario, and if not, what additional independent protection layer, typically a new safety instrumented function is required. LOPA takes a hazardous scenario identified by HAZOP as input, identifies the initiating event frequency and the existing layers of protection, each with a probability of failure on demand, and calculates the residual risk. The required risk reduction factor, RRF drives the target SIL of any new SIF.
What LOPA, Layer of Protection Analysis means.
LOPA emerged from CCPS, Center for Chemical Process Safety guidance in the early 2000s as a more rigorous alternative to qualitative risk-matrix scoring. The methodology is semi-quantitative. Initiating event frequencies, layer-of-protection failure probabilities, and consequence severity are estimated from generic data libraries rather than from full quantitative risk assessment, QRA. LOPA is the bridge between HAZOP, qualitative hazard identification and IEC 61511 SIL determination, quantitative SIL targeting. A LOPA study is typically conducted on the same nodes as the HAZOP, by a team that overlaps with the HAZOP team, after the HAZOP has identified the scenarios that warrant LOPA.
How does LOPA structure a scenario.
Each LOPA scenario starts with an initiating event, a deviation from HAZOP, such as 'control valve fails open' or 'operator opens manual valve in wrong sequence'. The initiating event has an estimated frequency, typically per year from generic data. Existing layers of protection sit between the initiating event and the consequence. Each layer has a probability of failure on demand, PFD. Layers of protection include the BPCS, basic process control system, PFD ~ 0.1, operator response to alarm, PFD ~ 0.1 with rich procedural support, higher otherwise, relief devices, PFD ~ 0.01 with regular proof testing, pre-existing SIS protection, PFD per the SIL of the existing SIF. The product of the initiating event frequency and the PFDs of all layers between the event and the consequence gives the residual frequency of the consequence.
How does LOPA produce the target SIL.
If the residual frequency of the consequence exceeds the tolerable risk target, set by the company's risk-matrix tolerable region, typically 10^-5 per year for severe consequences, the gap must be closed by adding a new independent protection layer. The required risk reduction factor, RRF is the ratio of the residual frequency to the tolerable target. The RRF translates to a target SIL. RRF 10-100 SIL 1, RRF 100-1000 SIL 2, RRF 1000-10000 SIL 3, RRF 10000-100000 SIL 4. The target SIL becomes the design constraint for the new SIF. SIL verification under IEC 61511 then confirms whether the as-designed architecture achieves the target.
What makes a layer of protection independent.
Independence is the central LOPA discipline. A layer of protection is independent if its failure does not share a common cause with the initiating event or with another layer being credited. The BPCS, the same system whose deviation initiated the scenario cannot be credited as an independent layer for the same scenario. A relief valve sized for the same overpressure case cannot be credited twice. Operator response to an alarm whose setpoint is set by the BPCS, whose failure initiated the scenario is not independent. Each credited layer must pass an independence test. Failed independence reduces the credited PFD product and increases the required RRF.
Worked example, a LOPA that lands on a SIL target.
Take an overpressure scenario on a vessel. The initiating cause is failure of a control loop that would otherwise throttle the inlet, and the site's own frequency table gives that a rate of 1.0E-01 per year, or once in ten years. Two independent protection layers are credited. The first is a high pressure alarm on a separate transmitter, with well over forty minutes for the operator to act, credited at 1.0E-01. The second is a relief valve sized for this scenario, credited at 1.0E-02. Multiply through: 1.0E-01 times 1.0E-01 times 1.0E-02 gives a mitigated event frequency of 1.0E-04 per year. The site's risk criteria for this consequence call for 1.0E-05 per year. The gap between the two is a factor of ten, so an additional risk reduction factor of 10 is required, which places the new safety instrumented function at SIL 1. Two details decide whether that arithmetic holds. The alarm cannot be credited if it reads the same transmitter as the failed control loop, because it would then not be independent of the initiating cause. And IEC 61511 allows only one basic process control system credit in a single scenario, so a second control loop cannot be added to close the gap.
Typical independent protection layer credits used in LOPA
Order of magnitude values published in CCPS layer of protection analysis guidance and widely used in industry. A site's own LOPA procedure states the values it will accept and the conditions it attaches; these are the common starting figures, not a site's rules.
| Protection layer | Typical PFD credit | Conditions usually attached |
|---|---|---|
| Basic process control system loop | 1.0E-01 | Independent of the initiating cause; IEC 61511 allows no more than one BPCS credit in a single scenario |
| Operator response to an alarm, more than 40 minutes to act | 1.0E-01 | The alarm is independent, the operator is trained, and the response is written down |
| Operator response to an alarm, 10 to 40 minutes to act | Credited only with specific justification | Rarely credited when there is less than 10 minutes |
| Relief valve | 1.0E-02 | Sized for the scenario, inspected and tested, and not subject to plugging or fouling in that service |
| Rupture disc | 1.0E-02 | Sized for the scenario, with a clear discharge path |
| Dike or bund | 1.0E-02 | Sized for the inventory and maintained |
| Underground drainage system | 1.0E-02 | Adequately sized and free draining |
| Open vent with no valve | 1.0E-02 | Physically incapable of being blocked |
| Fireproofing | 1.0E-02 | Applied and maintained, and credited only for the fire scenario |
| Blast wall or bunker | 1.0E-03 | Designed for that specific scenario |
| Safety instrumented function at SIL 1 | 1.0E-01 to 1.0E-02 | Designed, verified and proof tested to IEC 61511 |
| Safety instrumented function at SIL 2 | 1.0E-02 to 1.0E-03 | As above, with the architecture the target requires |
| Safety instrumented function at SIL 3 | 1.0E-03 to 1.0E-04 | As above, with the architecture the target requires |
What makes a layer independent, and what disqualifies it
A layer that fails for the same reason as the initiating event is not a layer. These four tests are what a LOPA session actually argues about.
| Test | What it asks | Common reason a candidate fails it |
|---|---|---|
| Independent | Does it fail for a reason unrelated to the initiating cause and to every other credited layer | The same transmitter drives the control loop and the alarm |
| Specific | Does it prevent this scenario, rather than hazards in general | A general area gas detection system credited against a specific overpressure |
| Dependable | Can the risk reduction be relied on, with the failure data to show it | A layer with no test regime and no failure history |
| Auditable | Is it designed, documented, tested and maintained so it can be checked | A procedural control with no record that it is followed |
Common questions
What is the typical initiating event frequency data source.
What is the typical layer-of-protection PFD data source.
What is the tolerable risk target.
Can LOPA conclude that no SIF is required.
How often is LOPA repeated.
Get the SIL verification workbook.
PFDavg by voting arrangement, with proof-test interval and the architectural constraint on the same sheet. Plain .xlsx.