LOPA: Layer of Protection Analysis

The study that sits between qualitative and quantitative

A HAZOP tells you a scenario is credible. A QRA tells you how far its effects reach and how often. LOPA sits between them: it takes one scenario at a time, puts an order-of-magnitude frequency on the initiating event, credits the protection layers that genuinely apply, and asks whether what remains is below the tolerable frequency.

How the arithmetic works

• Initiating event frequency - how often the cause occurs, from industry failure rate data adjusted for what is actually installed.
• Enabling conditions and conditional modifiers where they genuinely apply, such as the fraction of time a mode is active.
• Credited independent protection layers, each contributing its probability of failure on demand.
• Mitigated frequency compared against the tolerable frequency your organisation has approved in writing.

Where the mitigated frequency still exceeds the criterion, the shortfall is what a safety instrumented function must close - which is precisely how a defensible SIL target is derived rather than assumed.

The discipline is in what you refuse to credit

Most weak LOPAs are weak in the same way: too many layers credited. A protection layer earns its place only if it is independent, effective and auditable. Operator response with no alarm, no time to act and no procedure is not a layer. A relief device sized for a different scenario is not a layer for this one. The control system that caused the deviation cannot also protect against it.

Being strict here is the entire value of the method. A study that credits generously produces comfortable numbers and no protection.

What you receive

• A worksheet per scenario showing initiating frequency, every layer considered, what was credited and what was rejected with the reason.
• Mitigated frequency against the agreed tolerable criterion.
• Required risk reduction for any scenario that does not meet it, expressed so it feeds directly into SIL determination.
• A recommendations register with owners, in the same close-out format as our HAZOP deliverables.

Studies are delivered across Mumbai and Navi Mumbai, Ankleshwar, Vapi and Vadodara.

Frequently Asked Questions

Where does LOPA sit between HAZOP and SIL?

HAZOP identifies the scenario qualitatively. LOPA puts an order-of-magnitude number on it and decides whether existing protection is enough. If it is not, the residual gap is what a safety instrumented function has to close, and that gap is what sets the SIL target. Running SIL determination without LOPA usually means the target was assigned by judgement rather than derived.

What qualifies as an independent protection layer?

It has to be independent of the initiating event and of every other credited layer, effective against that specific scenario, and auditable - meaning its performance can be demonstrated through testing and maintenance records. A layer that fails all three tests is a safeguard worth having, but it is not an IPL and should not be credited.

Can the basic process control system be credited as an IPL?

Only once, and only when the loop is genuinely independent of the initiating cause. If the control system caused the deviation, it cannot also be the protection against it. Crediting the BPCS twice in one scenario is one of the most common errors we find in reviewed studies.

Do we need documented risk criteria before starting?

Yes. LOPA compares a calculated frequency against a tolerable frequency, so without a written, management-approved tolerable risk criterion the output has nothing to be measured against. Agreeing that criterion is part of the scoping work.

How long does a LOPA take?

It depends on scenario count rather than plant size. A focused study on the scenarios a HAZOP flagged as high consequence is commonly a few workshop days plus reporting. Attempting LOPA on every HAZOP finding wastes effort on scenarios that were never close to the criterion.