LOPA Fundamentals: Scenarios, IPLs and Risk Targets

By the Aetso Technical engineering team · Reviewed November 2026 · 10 min read

Layer of Protection Analysis (LOPA) was developed to answer a question that qualitative hazard studies struggle with: for this scenario, are the safeguards enough? It does that by estimating, to within an order of magnitude, how often a scenario would lead to its consequence with the existing safeguards in place, and comparing the result with a tolerable frequency.

1. Define one scenario

LOPA examines one cause–consequence pair at a time. A scenario consists of an initiating event (for example, failure of a level control loop), the consequence (overfill and release of a flammable liquid leading to a pool fire), and any enabling conditions or conditional modifiers, such as the fraction of time the process is in a vulnerable mode, the probability of ignition, or the probability that someone is present.

2. Estimate the initiating event frequency

Frequencies are usually taken from a company-approved table based on industry data, such as values published by CCPS. Typical entries include basic process control loop failure, pump seal failure or operator error in a routine task. Values should be used consistently and checked against site experience.

3. Identify the independent protection layers

Each safeguard is tested against the IPL criteria:

• Independent of the initiating event and of other IPLs in the same scenario.
• Effective — able to prevent the consequence on its own, in time.
• Auditable — can be inspected and tested.
• Dependable — has a quantifiable probability of failure on demand (PFD).

Typical IPLs include a separate alarm with defined operator response, a safety instrumented function, a relief device sized for the scenario, or a check valve in clean service. Each is assigned a PFD from the approved data set.

4. Calculate the mitigated frequency

Worked example (illustrative values only): a level control failure with a frequency of 0.1 per year, an independent high-level alarm with operator response (PFD 0.1) and a probability of ignition of 0.1 gives a mitigated frequency of 0.1 × 0.1 × 0.1 = 1 × 10^-3 per year for a fire. If the tolerable frequency for this consequence category is 1 × 10^-5 per year, a further risk reduction factor of 100 is required — for example, a SIL 2 safety instrumented function or a design change that removes the scenario.

5. Decide and document

If the gap is closed, the IPLs credited must be captured in the mechanical integrity and testing programs, or the credit is not real. If not, the team recommends additional protection, an inherently safer design change, or a reduction in the initiating event frequency.

Common LOPA errors

• Crediting the BPCS twice — once as a control loop and once for an alarm generated in the same controller.
• Double-counting conditional modifiers already reflected in the consequence or frequency.
• Crediting IPLs that are not in the testing program.
• Using optimistic data that differ from team to team or site to site.
• Defining scenarios so broadly that the initiating events are not clear.

Explore the layers of protection interactively on our LOPA & Risk Assessment page.