Layer of Protection Analysis (LOPA)
We run order of magnitude risk reduction analysis, the most widely used SIL allocation method in the world
Layer of Protection
Analysis (LOPA)
LOPA was formalised by the CCPS in 2001 and is now embedded in IEC 61511 Ed.2 Annex F, and it is the order of magnitude technique that converts HAZOP scenarios into IPL credited risk reduction and SIL targets for each safety instrumented function. Its power lies in transparency, because every credit, whether a basic process control system at 0.1, an alarm with operator action at 0.1 or a mechanical instrumented function at 0.01 or better, is something an auditor can see and challenge. Its weakness is the same, because disciplined IPL eligibility across independence, dependability, audit and the dependency check is not negotiable. When our team runs a mature LOPA it rests on rigorous initiating event frequency calibration from the CCPS LOPA cookbook and OREDA, on realistic conditional modifiers for ignition, occupancy, escape and weather, and on honest treatment of enabling conditions and human protection layers. Modern variants that we use, including Bow Tie aligned LOPA, a hybrid of LOPA and QRA, and CCPS LOPA II, extend the method to high consequence and multiple layer scenarios.
How the study is executed
A structured, facilitated process that runs from scope definition through close out and produces defensible, actionable outputs.
Select LOPA eligible scenarios from HAZOP action register, calibrate Initiating Event (IE) frequency from CCPS LOPA Cookbook, OREDA, and site history, define consequence severity tiers and site specific Tolerable Frequency (TF) per consequence category.
Apply CCPS strict four part IPL test, independence, dependability, audit, and validation, to each safeguard identified in HAZOP, disqualify non eligible controls (BPCS dependent alarms, inadequate test frequency, shared initiator), document eligibility decisions.
Build per scenario LOPA worksheets applying eligible IPL credits (BPCS 10⁻¹, operator action IPL per CCPS rules, mechanical SIF per architecture), calculate mitigated event likelihood and risk gap = TF / mitigated frequency.
Apply ignition probability, presence / occupancy factor, atmospheric conditions, and escape factor as conditional modifiers, handle enabling conditions (equipment in maintenance mode, abnormal configuration) separately from IPL credit.
Derive Required Risk Reduction Factor and SIL target per SIF, identify scenarios requiring additional non instrumented IPLs, register passive, active hardware, and administrative options with ALARP implication and SIL inflation avoidance rationale.
Issue LOPA worksheets, IPL eligibility log, IE frequency basis, conditional modifier basis document, risk gap summary, SIL allocation per SIF, and cross reference map to HAZOP findings and Bow Tie barrier register for downstream workflow.
What the study covers in full
Outcomes of Layer of Protection Analysis (LOPA)
- We quantify the gap between initiating event frequency and tolerable risk for each scenario
- We surface the scenarios protected only by a control system or a single alarm, which are the silent SIL 2 and SIL 3 needs
- We document IPL credit on a per scenario basis so the defence is easy to follow
- We prevent multiple non independent protections from being conflated into double counted credit
- We make the work defensible under IEC 61511 Clause 9 and Annex F
- We give you traceable evidence for OSHA 1910.119 PHA action close out
- We map the work directly onto the Bow Tie safety case argument for COMAH and Seveso
- We satisfy API RP 14C SIL determination on offshore facilities
- We drive realistic protection layer governance through proof tests, performance standards and MOC controls
- We reveal where administrative layers are credited but never audited
- We supply the input dataset for your safety instrumented system asset management software
- We anchor the realistic demand rate input for system verification
- We help you avoid SIL inflation, since more than 30 percent of conservative allocations downgrade under a proper LOPA
- We capture cheap administrative layer credit where appropriate so you can defer instrumented function capex
- We target system rebuild capex to genuine SIL 3 needs rather than perceived ones
- We defend your ALARP investment decisions against regulator and underwriter challenge
Codes & standards we work to
Triggers that signal the need
Where Layer of Protection Analysis (LOPA) applies
Wellheads, separators, gas compression, FPSO topsides, produced water systems.
Distillation columns, reactors, heat exchangers, storage spheres, LPG handling.
Cryogenic exchangers, liquefaction trains, BOG compressors, storage and sendout.
Reactive systems, batch reactors, solvent handling, runaway reaction scenarios.
Boilers, HRSGs, steam headers, hydrogen systems, ammonia SCR units.
Sterile vessels, CIP/SIP, pressure fermenters, solvent recovery, spray dryers.
Tangible deliverables
- LOPA worksheets per scenario with the full protection layer credit basis
- Protection layer eligibility decision log
- Initiating event frequency reference table calibrated to your site context
- Conditional modifier basis document
- Risk gap summary and SIL allocation per function
- Action register for additional protection layers or non instrumented risk reduction
- Integration map with the HAZOP and Bow Tie outputs
- Function register handover to the SIL verification stage
Ready to start your project?
Speak with our team to scope an engagement tailored to your facility, regulatory context, and lifecycle stage.