Service
LOPA & Risk Assessment
Semi-quantitative and qualitative risk tools that answer the essential question: are the safeguards on this scenario enough?
What Layer of Protection Analysis is
Layer of Protection Analysis (LOPA) is a semi-quantitative risk assessment method that takes individual high-consequence scenarios — usually from a PHA — and asks whether the independent safeguards against each scenario reduce its frequency enough to meet the company's tolerable risk criteria.
LOPA sits between qualitative hazard studies and full quantitative risk assessment. It uses order-of-magnitude estimates of initiating event frequencies and the probability that each protection layer fails on demand. That is precise enough to make consistent, defensible decisions — including how much risk reduction a safety instrumented function must deliver — without the cost of a full QRA.
A typical flow is PHA → risk ranking → LOPA for high-consequence scenarios → SIL target for any required safety instrumented function → SIS design and verification. Inconsistent LOPA is one of the most common root causes of both over- and under-designed safety systems.
Layers of protection
Protection is arranged in layers around the hazard. Inner layers prevent a release; outer layers reduce its consequences. Select a layer — on the diagram or the list — to see its role and what it takes to credit it in LOPA.
Interactive layers of protection
Select a layer
Process design
- Role
- Inherently safer design removes or reduces the hazard itself: smaller inventories, lower pressures, less hazardous materials, equipment rated to contain the worst credible pressure.
- LOPA credit
- Inherent design features usually change the scenario (or eliminate it) rather than being credited as a numerical IPL. They are the most reliable layer because they do not depend on anything working.
Basic process control system
- Role
- The control system keeps the process within normal limits. A control loop that would correct a deviation before it escalates can be a safeguard.
- LOPA credit
- IEC 61511 limits the risk reduction claimed for the BPCS as a protection layer to no more than a factor of 10, and only if it is independent of the initiating cause. A BPCS loop failure is also one of the most common initiating events.
Alarms & operator response
- Role
- A distinct alarm prompts a trained operator to take a defined action in time to stop the scenario.
- LOPA credit
- Creditable only if the alarm is independent of the initiating cause, the required response is clear and trained, and there is enough time to detect, diagnose and act. Alarm management (ISA-18.2) supports this credit.
Safety instrumented system
- Role
- A safety instrumented function (sensors, logic solver and final elements) automatically takes the process to a safe state when a limit is exceeded.
- LOPA credit
- Credit equals the function's verified risk reduction, set by its SIL. It must be designed, verified, validated, proof-tested and managed under IEC 61511 / ISA 61511.
Relief devices
- Role
- Pressure relief valves and rupture disks prevent vessel rupture by relieving pressure — usually to a safe location or treatment system.
- LOPA credit
- Credit depends on the device being sized for the scenario, correctly installed, and inspected and tested. Note that relief prevents rupture but still creates a release that must go somewhere safe.
Containment (post-release)
- Role
- Dikes, bunds, blast walls and drainage limit the spread or effect of a release after it has occurred.
- LOPA credit
- These mitigate consequences. In LOPA they may modify the outcome of a scenario rather than prevent it, so they are applied with care.
Plant emergency response
- Role
- Fire-fighting, isolation, evacuation and shelter-in-place procedures reduce harm once an event begins.
- LOPA credit
- Usually not credited as an IPL in LOPA because their effectiveness is hard to assure, but they remain essential and are required by PSM and RMP.
Community emergency response
- Role
- Coordination with local responders, community notification and public protective actions.
- LOPA credit
- Not credited in LOPA. EPA RMP requires coordination with local emergency responders and, for some facilities, field exercises.
What makes an independent protection layer
Not every safeguard listed in a PHA qualifies as an independent protection layer (IPL). To be credited, a safeguard is generally expected to be:
- Independent of the initiating event and of every other IPL credited for the same scenario — no shared sensors, logic, valves, power or people.
- Effective — capable on its own of preventing the consequence, with enough capacity and response time.
- Auditable — its design, installation, testing and maintenance can be verified.
- Dependable — its probability of failure on demand can be estimated and is supported by its management system.
Procedures, training, PPE and general "operator attention" are important, but they are generally not credited as IPLs.
The LOPA calculation
For each scenario, the mitigated event frequency is estimated by multiplying the initiating event frequency by any enabling conditions or conditional modifiers and by the probability of failure on demand (PFD) of each IPL:
Mitigated frequency = Initiating event frequency × Enabling conditions × Conditional modifiers × PFDIPL1 × PFDIPL2 × …
| SIL | Average PFD | Risk reduction factor |
|---|---|---|
| SIL 1 | ≥ 0.01 to < 0.1 | > 10 to ≤ 100 |
| SIL 2 | ≥ 0.001 to < 0.01 | > 100 to ≤ 1,000 |
| SIL 3 | ≥ 0.0001 to < 0.001 | > 1,000 to ≤ 10,000 |
| SIL 4 | ≥ 0.00001 to < 0.0001 | > 10,000 to ≤ 100,000 |
Initiating event frequencies and IPL failure probabilities should come from a documented, company-approved data set — commonly based on CCPS published values — and should be justified against site performance where possible.
Risk criteria and the risk matrix
Risk matrices let a team rank scenarios consistently by combining consequence severity and likelihood. The matrix below is illustrative only — every company must define and approve its own categories and tolerability criteria. Select a cell to see how a typical framework would interpret it.
Illustrative 5 × 5 risk matrix
Severity × likelihood
Select a cell in the matrix.
Bowtie analysis
A bowtie diagram shows a single hazardous event at its center, the threats that can cause it on the left with prevention barriers, and the consequences on the right with mitigation barriers. It is an excellent communication tool for operators and leadership and a natural way to show which barriers depend on which management-system activities.
Typical scope and deliverables
- Development or review of LOPA rules: risk criteria, initiating event and IPL data, conditional modifiers
- Facilitated LOPA sessions following the PHA, or as a standalone study
- Scenario worksheets showing every assumption and credit
- Required risk reduction and SIL targets for safety instrumented functions
- An IPL register for the mechanical integrity and testing programs
- Bowtie diagrams for major accident hazards
- Consistency reviews of existing LOPAs across units or sites
Frequently asked questions
Is LOPA required by OSHA or EPA?
Neither OSHA PSM nor EPA RMP names LOPA specifically. However, IEC 61511 / ISA 61511 requires a documented basis for the risk reduction allocated to safety instrumented functions, and LOPA is the most widely used method for that purpose.
Can a scenario take credit for two alarms?
Only if they are truly independent — different sensors, different alarm systems and a credible, independent operator response. In practice, multiple alarms responded to by the same operator are rarely credited as separate IPLs.
What if LOPA shows a gap?
Options include inherently safer design changes, a new or upgraded IPL such as a safety instrumented function or relief device, or reducing the initiating event frequency. The choice should consider reliability, cost and operability.
When is a full QRA needed instead of LOPA?
When risk depends on many interacting scenarios, when off-site societal risk or building occupancy matters, or when decisions involve major capital, a quantitative risk assessment gives a more complete picture.
Need consistent, defensible LOPA?
We can facilitate new studies, review existing ones or help you build LOPA rules and data that every team applies the same way.