LOPA (Layers of Protection Analysis) — what, why and how?
Process safety
LOPA is a semi-quantitative risk method that assesses whether your independent protection layers are sufficient to reduce process risks. It follows logically from HAZOP and helps determine what additional risk reduction (and possibly which SIL level) is needed.
What is LOPA?
Layers of Protection Analysis (LOPA) evaluates, for each scenario, the likelihood of an undesired event and the effect of existing or planned Independent Protection Layers (IPLs). You compare the resulting likelihood with predefined risk criteria. This gives you a substantiated decision on whether additional measures are needed.
Place in the safety lifecycle:
A LOPA usually follows a Process Hazard Analysis (PHA), often a HAZOP, which provides the scenarios and causes. Based on the LOPA, you define the necessary Safety Instrumented Functions (SIFs), the required Safety Integrity Level (SIL) and the Safety Requirements Specification (SRS) for design and validation.
Protection layers (the “Swiss cheese” idea):
LOPA distinguishes between preventive layers (preventing things from going wrong) and mitigating layers (limiting the consequences). Think of: inherently safe design, process control, operator intervention on alarm, a Safety Instrumented System (SIS), active and passive safeguards (pressure relief, extinguishing), and emergency measures (evacuation, firefighting). It is important that each layer is independent of the others.
SIS, SIF and SIL in LOPA:
An SIS consists of one or more SIFs (for example, shutting off on high pressure). The reliability of a SIF is expressed as a SIL. In LOPA you determine which SIL is needed to bring the scenario back to the acceptable risk level. The end result feeds directly into the design, the test strategy and the maintenance regime.
The LOPA steps (compact and practical):
- Scenario selection: select the relevant hazards with their causes and consequences from the PHA/HAZOP.
- Frequencies: determine the frequency of the cause and calculate the scenario frequency, taking current layers into account.
- IPLs & PFD: identify independent layers and quantify their Probability of Failure on Demand (PFD).
- Tolerability check: compare with your risk acceptance criteria; determine the risk gap and the required risk reduction.
- Measures: specify additional or improved layers and, where necessary, translate this into SIF/SIL requirements and an SRS.
Why use LOPA?
Fast and substantiated: more robust than purely qualitative, less demanding than a full QRA.
Transparent: clear allocation of risk reduction per layer and traceable choices.
Design-oriented: direct input for SIS/SIF/SIL, investments and lifecycle management.
