What LOPA is and where it fits after a HAZOP study
Layer of Protection Analysis (LOPA) is a semi-quantitative risk assessment method. It takes one scenario, usually a high-consequence scenario from a HAZOP study, and answers a precise question: do the existing safeguards reduce the frequency of this outcome to a tolerable level, and if not, how much more risk reduction is needed?
LOPA sits between qualitative methods such as HAZOP and a full quantitative risk assessment. It works with order-of-magnitude numbers. That is its strength: a team can run through dozens of scenarios in a few days, and anyone can follow the arithmetic. The Center for Chemical Process Safety (CCPS) described the method in 2001, and IEC 61511-3 includes LOPA as one of the accepted methods for determining safety integrity levels.
The building blocks of a LOPA scenario
Every LOPA scenario uses the same elements:
| Element | What it means |
|---|---|
| Consequence | The outcome you want to prevent, for example a vessel rupture that could injure someone |
| Initiating event | The failure or error that starts the scenario, as a frequency per year. A failed loop in the basic process control system (BPCS) is a common one |
| Independent protection layer (IPL) | A safeguard that can stop the scenario on its own, with a probability of failure on demand (PFD) |
| Conditional modifier | A factor such as the chance that someone is present, or that a release ignites |
| Tolerable frequency | The highest acceptable frequency of the consequence, from your company risk criteria |
The mitigated event frequency is the initiating event frequency multiplied by the PFD of every IPL and by any conditional modifiers. If that number is higher than the tolerable frequency, the gap must be closed, often with a safety instrumented function (SIF).
When does a safeguard count as an independent protection layer?
Not every safeguard in a HAZOP worksheet is an IPL. To count, it has to be independent: it shares no components with the initiating event or with any other IPL in the same scenario. It has to be effective, meaning it detects the problem and acts in time to prevent the consequence without help. And it has to be auditable, so you can test it and show the results. A procedure that says "the operator will check the level" usually fails at least one of these.
The table below shows typical generic PFD values used in LOPA studies. They are starting points from industry guidance such as CCPS. Your own company values or site data take precedence.
| Protection layer | Typical PFD | Risk reduction |
|---|---|---|
| BPCS control loop (not the initiating loop) | 0.1 | 10 |
| Operator response to an alarm, with enough time | 0.1 | 10 |
| Spring-operated pressure relief valve | 0.01 | 100 |
IEC 61511-1:2016 limits the risk reduction you may claim for a BPCS protection layer to a factor of 10, unless the BPCS is designed and managed to the requirements of the standard.
SIL bands in IEC 61511
When a gap remains, the required risk reduction factor (RRF) of the safety instrumented function decides its safety integrity level. IEC 61511-1:2016 defines the bands below for the low demand mode of operation, which applies to most process trips.
| SIL | Average PFD | Risk reduction factor |
|---|---|---|
| SIL 1 | 0.01 to 0.1 | more than 10, up to 100 |
| SIL 2 | 0.001 to 0.01 | more than 100, up to 1,000 |
| SIL 3 | 0.0001 to 0.001 | more than 1,000, up to 10,000 |
| SIL 4 | 0.00001 to 0.0001 | more than 10,000, up to 100,000 |
SIL 4 is very rare in the process industry. When a LOPA ends at SIL 3 or higher, it is usually better to change the design so that the hazard itself becomes smaller.
Worked example: overpressure of a separator
A HAZOP team identified that a failure of the pressure control loop on a separator can lead to overpressure and vessel rupture. The scenario has the potential to injure an operator who is near the vessel. The numbers below are illustrative.
The pressure control loop fails about once every ten years, so the initiating event frequency is 0.1 per year. The separator has a correctly sized pressure relief valve, credited with a PFD of 0.01. There is also a high-pressure alarm, but it is not credited: pressure rises too fast for an operator to respond in time. Someone is in the affected area about half the time, so the occupancy modifier is 0.5.
| Step | Value |
|---|---|
| Initiating event: pressure control loop failure | 0.1 per year |
| IPL: pressure relief valve | PFD 0.01 |
| Conditional modifier: person present | 0.5 |
| Mitigated event frequency (0.1 × 0.01 × 0.5) | 5 × 10⁻⁴ per year |
| Tolerable frequency for this consequence | 1 × 10⁻⁵ per year |
| Required risk reduction (5 × 10⁻⁴ ÷ 1 × 10⁻⁵) | 50 |
A safety instrumented function with a risk reduction factor of at least 50, which is a PFD of 0.02 or lower, closes the gap. That puts it in the SIL 1 band.
Common LOPA mistakes
A classic error is double counting the BPCS. If a failed control loop starts the scenario, that same loop cannot also protect against it. It sounds obvious on paper, but it is easy to miss when the BPCS has several functions in one controller.
Alarms are the second trap. An operator needs time to notice the alarm, work out what is going on and act. If the process gets to the consequence faster than that, the alarm is not a protection layer, however reassuring it looks in the worksheet. Other mistakes to watch for:
- two layers that share a transmitter, a power supply or a valve, which means they are not independent;
- stacking conditional modifiers until almost any scenario looks acceptable, instead of following a written company rule;
- treating the SIL number as the end of the job, when it is only the requirement the design still has to meet.
From SIL determination to SIL verification
LOPA gives you the SIL target. SIL verification then calculates whether the chosen sensors, logic solver and final elements, with their architecture and proof test interval, actually achieve the required average PFD. Both steps sit within the IEC 61511 safety lifecycle, together with the safety requirements specification, validation and periodic proof testing.
If you need support with these steps, read how I work on SIL classification and SIL verification under IEC 61511. To keep the resulting barriers healthy during operation, a bow-tie analysis is a useful next step.
Frequently asked questions
What is the difference between SIL classification and SIL verification?
SIL classification, also called SIL determination, sets the required safety integrity level of a safety instrumented function, for example with LOPA. SIL verification checks whether the actual hardware design and test regime achieve that level.
Can the BPCS be both an initiating event and a protection layer?
Not in the same scenario. If a failure of a control loop starts the scenario, that loop cannot also be credited as an independent protection layer.
What does PFD mean?
PFD stands for probability of failure on demand: the chance that a protection layer does not work when it is needed. A PFD of 0.01 means the layer fails on 1 in 100 demands, which equals a risk reduction factor of 100.
Does IEC 61511 require LOPA?
No. IEC 61511-1:2016 requires a hazard and risk assessment and the allocation of safety functions to protection layers, but it does not prescribe one method. IEC 61511-3 describes LOPA as one of several accepted methods.
Note: this article is general information, not engineering advice for your specific installation. Standards and legislation are referenced as they apply at the date of publication. For decisions on your plant, involve a qualified engineer who knows your process and your company risk criteria.
Process Safety, Process and Project Engineer with over 12 years of experience across Oil & Gas, Petrochemical and Food & Feed. MSc Sustainable Process & Energy Technologies (TU Delft), Certified Functional Safety Engineer and HAZOP Chairman.
