Hazard Studies & Risk Assessment

Layer of Protection Analysis (LOPA)

Order-of-magnitude risk-reduction analysis — the most-used SIL allocation method worldwide

What this study delivers

Layer of Protection
Analysis (LOPA)

LOPA, formalised by CCPS in 2001 and now embedded in IEC 61511 Ed.2 Annex F, is the order-of-magnitude technique that converts HAZOP scenarios into IPL-credited risk reduction and SIF SIL targets. Its power lies in transparency — every credit (BPCS 0.1, alarm with operator action 0.1, mechanical SIF 0.01 or better) is auditable and challenge-able. Its weakness is the same — disciplined IPL eligibility (independence, dependability, audit, dependency check) is non-negotiable. Mature LOPA execution rests on rigorous initiating-event frequency calibration (CCPS LOPA Cookbook, OREDA), realistic conditional modifiers (ignition, occupancy, escape, weather), and honest treatment of enabling conditions and human IPLs. Modern variants — Bow-Tie-aligned LOPA, hybrid LOPA-QRA, and CCPS LOPA II — extend the method to high-consequence and multi-IPL scenarios.

Layer of Protection Analysis (LOPA) — Overview
Study execution

How the study is executed

A structured, facilitated process — from scope definition through close-out — producing defensible, actionable outputs.

Scenario Scoping & IE Frequency Calibration

Select LOPA-eligible scenarios from HAZOP action register; calibrate Initiating Event (IE) frequency from CCPS LOPA Cookbook, OREDA, and site history; define consequence severity tiers and site-specific Tolerable Frequency (TF) per consequence category.

IPL Eligibility Testing

Apply CCPS strict four-part IPL test — independence, dependability, audit, and validation — to each safeguard identified in HAZOP; disqualify non-eligible controls (BPCS-dependent alarms, inadequate test frequency, shared initiator); document eligibility decisions.

LOPA Worksheets & Risk Gap Calculation

Build per-scenario LOPA worksheets applying eligible IPL credits (BPCS 10⁻¹, operator-action IPL per CCPS rules, mechanical SIF per architecture); calculate mitigated event likelihood and risk gap = TF / mitigated frequency.

Conditional Modifiers & Enabling Conditions

Apply ignition probability, presence / occupancy factor, atmospheric conditions, and escape factor as conditional modifiers; handle enabling conditions (equipment in maintenance mode, abnormal configuration) separately from IPL credit.

SIL Target Derivation & Option Register

Derive Required Risk Reduction Factor and SIL target per SIF; identify scenarios requiring additional non-instrumented IPLs; register passive, active-hardware, and administrative options with ALARP implication and SIL-inflation avoidance rationale.

Integration Package & SIL Handover

Issue LOPA worksheets, IPL eligibility log, IE frequency basis, conditional-modifier basis document, risk-gap summary, SIL allocation per SIF, and cross-reference map to HAZOP findings and Bow-Tie barrier register for downstream workflow.

Layer of Protection Analysis (LOPA) — Scope
Study scope

What the study covers in full

Initiating event frequency banking from CCPS LOPA Cookbook, OREDA, and site history
IPL eligibility per CCPS strict tests — independence, dependability, audit, validation
BPCS credit limited to 10⁻¹ per IEC 61511 (one BPCS per scenario unless special architecture)
Human-action IPL credit per CCPS rules — alarm time, occupancy, training, stress
Conditional modifiers: ignition probability, presence factor, escape, weather, time-at-risk
Enabling-condition handling separate from credit (mode of operation, position)
Risk-gap calculation against site tolerable frequency (TF) for each consequence severity
SIL target derivation with explicit RRF = TF / mitigated-event-likelihood logic
ALARP gap identification — additional IPL or SIF need where TF gap remains
Integration with Bow-Tie barrier register and PHA action close-out
Why it matters

Outcomes of Layer of Protection Analysis (LOPA)

IPL Credit Quality & Scenario Coverage
  • Quantifies the gap between initiating-event frequency and tolerable risk per scenario
  • Surfaces scenarios protected only by BPCS or single alarm — the silent SIL-2/3 needs
  • Documents IPL credit on a per-scenario basis for line-of-sight defence
  • Prevents conflation of multiple non-independent protections into double-counted credit
IEC 61511 / CCPS LOPA Defence
  • Audit-defensible under IEC 61511 Clause 9 / Annex F
  • Provides traceable evidence for OSHA 1910.119 PHA action close-out
  • Maps directly onto Bow-Tie safety-case argument for COMAH and Seveso
  • Satisfies API RP 14C SIL determination on offshore facilities
IPL Governance & Demand Realism
  • Drives realistic IPL governance — proof tests, performance standards, MOC controls
  • Reveals when administrative IPLs are credited but never audited
  • Supplies the input dataset for SIS asset-management software
  • Anchors the realistic demand-rate input for SIS verification
SIL Allocation Efficiency
  • Avoids SIL inflation — over 30% of conservative SIL allocations downgrade under proper LOPA
  • Captures cheap administrative IPL credit where appropriate, deferring SIF capex
  • Targets SIS rebuild capex to genuine SIL-3 needs, not perceived ones
  • Defends ALARP investment decisions against regulator and underwriter challenge
Get Started

Ready to start your project?

Speak with our team to scope an engagement tailored to your facility, regulatory context, and lifecycle stage.