LOPA and safety integrity levels

Layer of protection analysis (LOPA) sits between the qualitative methods, such as HAZOP and what-if, and full quantitative risk assessment. It takes one scenario at a time, usually from a HAZOP, and asks a precise question: is the frequency of this consequence, after counting the independent protection layers, low enough to meet the company's risk criteria? If not, how much more risk reduction is needed? The method was developed in the 1990s and is described in the CCPS books Layer of Protection Analysis: Simplified Process Risk Assessment (2001) and Guidelines for Initiating Events and Independent Protection Layers (2015). It is also one of the methods in IEC 61511 for determining the safety integrity level (SIL) required of a safety instrumented function.

This lesson is an awareness-level introduction. It will help you take part in a LOPA, check the arithmetic and understand what a SIL means. Designing safety instrumented systems, verifying SIL and signing off LOPA studies require specialist training and competence assessment under IEC 61511, and in some jurisdictions professional engineering licensure.

The LOPA scenario

A LOPA scenario is a single cause-consequence pair: one initiating event leading to one consequence, such as "cooling water pump fails, leading to reactor runaway and rupture with potential fatalities". Each scenario is analyzed separately. The steps are: define the consequence and its severity; select the target frequency from the company's criteria; estimate the initiating event frequency; identify the conditional modifiers, such as the probability that a person is present or that a release ignites; identify the independent protection layers (IPLs) and their probability of failure on demand (PFD); and calculate the mitigated event frequency.

LOPA works in orders of magnitude. Initiating frequencies and PFDs are usually rounded to powers of ten, such as 0.1 per year or a PFD of 0.01. This is deliberately conservative and simple; LOPA is meant to be quick and consistent, not precise.

Initiating events

Initiating event frequencies come from company data, industry tables in the CCPS guidelines, or failure databases. Typical values used in many companies are: basic process control system loop failure, 0.1 per year; pump seal failure, 0.1 per year; human error in a routine task done about once a month, 0.1 per year (roughly 12 opportunities a year at about 0.01 errors per opportunity for a well-trained task, rounded); large external fire, 0.01 per year; and full-bore pipe rupture, 0.00001 per metre per year for some pipe sizes. Companies should publish an approved table so that teams use consistent values.

Independent protection layers

An IPL is a device, system or action that can prevent the scenario from reaching the consequence, regardless of the initiating event or any other protection layer. To be credited, an IPL must be effective (able to prevent the consequence if it works, fast enough and sized correctly), independent (of the initiating event and of every other IPL credited in the scenario) and auditable (its performance can be validated through testing and records). Some guidance adds that it must be specific to the scenario and reliable. Many things that seem protective fail these tests: training and procedures, by themselves, are not IPLs; a control loop cannot be both the initiating event and an IPL; and a pressure alarm on the same transmitter as the failed control is not independent.

Safety integrity levels

A safety instrumented function (SIF) is a function carried out by a safety instrumented system, made of sensors, a logic solver and final elements such as valves, that takes the process to a safe state when a dangerous condition is detected. IEC 61508 (for manufacturers and general systems) and IEC 61511 (for the process industry) define four safety integrity levels for functions operating in low-demand mode, based on the average probability of failure on demand (PFDavg). Each level is a factor of ten better than the last. The risk reduction factor (RRF) is the reciprocal of the PFD.

A SIL is a property of a function, not of a device. Saying "this transmitter is SIL 2" really means the transmitter is suitable for use in a SIL 2 function under certain conditions. Achieving a SIL requires the whole function to meet the PFD target through its architecture, component reliability, proof test interval and coverage, plus requirements for hardware fault tolerance, systematic capability and a full lifecycle of specification, design, verification, validation, operation, maintenance and management of change. If an analysis says a SIL 3 or higher function is needed, most companies treat that as a signal to redesign the process to reduce the hazard rather than rely on one very reliable function.

LOPA pitfalls

LOPA is easy to misuse. Teams sometimes credit IPLs that are not independent, such as an operator response to an alarm generated by the same failed control system. They use initiating frequencies that are too optimistic, or round PFDs downward. They forget conditional modifiers in one scenario and stack them unrealistically in another, such as multiplying occupancy, ignition, fatality and weather probabilities until a high-risk scenario looks negligible. Many companies limit the total credit for conditional modifiers and require approval for any scenario that relies on them for more than one order of magnitude. Finally, LOPA assumes IPLs are maintained and tested; credited layers that are bypassed or overdue for testing provide no protection.

In Canada, IEC 61511 is used widely in the process industries and is published as a CSA standard; provincial pressure equipment regulators, such as ABSA in Alberta and TSSA in Ontario, and company standards often expect LOPA or an equivalent method for sizing safety instrumented functions. CSA Z767 refers to protection layers as part of hazard and risk analysis.

Recording a LOPA

A LOPA worksheet records, for each scenario, the consequence and its severity category, the target frequency, the initiating event and its frequency with the source of the value, each conditional modifier with its justification, each IPL with its PFD and the reason it qualifies, the mitigated frequency, the gap and the recommendation. Clear records allow a reviewer to check every number and are essential at revalidation, when someone will ask why a particular layer was credited.