What Is LOPA (Layer of Protection Analysis) and How Does It Reduce Process Risk?

Layer of Protection Analysis (LOPA) is a semi-quantitative risk assessment method used primarily in the process industries to evaluate whether existing safeguards—called independent protection layers (IPLs)—are sufficient to reduce a hazardous event's risk to a tolerable level. Developed from the principles in the CCPS Layer of Protection Analysis guideline, LOPA sits between a simple qualitative review (like HAZOP) and a full quantitative risk analysis (QRA). It helps teams make consistent, defensible decisions about risk reduction without requiring complex probabilistic modeling.

What It Is

LOPA is a streamlined risk evaluation technique that estimates the frequency of an undesired consequence by multiplying the initiating event frequency by the probability of failure on demand (PFD) of each independent protection layer. Unlike HAZOP, which identifies hazards, LOPA focuses on scenario frequency and risk tolerance. It answers a specific question: Given this initiating event and the existing IPLs, is the residual risk acceptable?

The CCPS guideline defines an IPL as a device, system, or action that is:

• Independent of the initiating event and other IPLs,
• Reliable enough to meet its required PFD,
• Auditable (can be verified and maintained),
• Specific to preventing or mitigating the consequence.

Common IPLs include basic process control systems (BPCS), alarms with operator response, safety instrumented functions (SIFs), pressure relief devices, and physical containment.

How It Works: Formula and Steps

LOPA uses a simple multiplicative model for a single scenario:

Scenario frequency (per year) = Initiating event frequency (per year) × PFD₁ × PFD₂ × … × PFDₙ

Where each PFD is the probability that the IPL fails to perform when demanded. The risk is then compared to a tolerable risk target (e.g., a maximum allowable frequency for a specific consequence).

The typical LOPA workflow follows these steps:

1. Identify the scenario — select a specific cause–consequence pair from a HAZOP or similar study.
2. Determine the initiating event frequency — use plant data, industry databases, or CCPS-recommended values.
3. Identify the independent protection layers — list all safeguards that could prevent or mitigate the consequence.
4. Assign PFD values — use standard ranges (e.g., a BPCS IPL typically has a PFD of 0.1; a properly designed SIF with SIL 2 has a PFD of 0.01 to 0.001).
5. Calculate the mitigated event frequency — multiply the initiating frequency by all IPL PFDs.
6. Compare with the risk tolerance criterion — if the calculated frequency exceeds the target, additional risk reduction (e.g., a new IPL) is required.
7. Document and review — record assumptions, IPL justifications, and results for future audits.

A Worked Illustrative Example

Example data (illustrative only):

Consider a storage tank with a level control loop. The hazardous scenario is tank overfill leading to a release to the environment.

• Initiating event: BPCS level control fails → frequency = 0.1 per year (illustrative value).
• IPL 1: Independent high-level alarm with operator response → PFD = 0.1.
• IPL 2: Safety instrumented function (SIL 1) that closes the inlet valve → PFD = 0.1.

Mitigated event frequency = 0.1 × 0.1 × 0.1 = 0.001 per year (i.e., once in 1,000 years).

If the company's risk tolerance for an environmental release is 1 × 10⁻³ per year, this scenario meets the criterion. If the target were stricter (e.g., 1 × 10⁻⁴ per year), an additional IPL—such as a higher SIL rating or a physical overflow weir—would be required.

Common Pitfalls

• Counting non-IPLs as IPLs — a simple alarm without a documented operator response procedure is not an IPL. It must meet the independence, reliability, and auditability criteria.
• Double counting — if two safeguards share a common power source or sensor, they are not independent and cannot both be counted.
• Using overly optimistic PFD values — standard values from CCPS are based on proven performance; do not assign lower PFDs without strong justification.
• Ignoring initiating event frequency uncertainty — LOPA is only as good as its inputs; use conservative estimates when data are sparse.

---

LOPA is a practical, defensible tool for prioritizing risk reduction investments. To streamline your LOPA calculations and documentation, try the free LOPA (Layer of Protection Analysis) tool at https://www.6sq.com/tools/lopa/ — it follows the CCPS methodology and helps you focus on engineering judgment rather than arithmetic.