1What is LOPA?
The LOPA (Layer Of Protection Analysis) is a semi-quantitative method that calculates an accidental scenario's residual frequency by multiplying the initiating-event frequency by the probability of failure on demand (PFD) of each independent protection layer (IPL) between the cause and consequence: f_residual = f_initiating × ∏ PFD(IPL).
LOPA sits between qualitative HAZOP, which identifies scenarios, and fully quantitative analysis. It is rigorous enough to justify a numerical risk level and fast enough for many HAZOP scenarios.
An IPL must be independent of other layers and the initiating cause, reliable with a documented PFD, and auditable — a measure that does not meet all three criteria cannot be counted as an IPL.
2Method steps
- Start from a scenario from HAZOP or PHA: initiating event → consequence.
- Estimate the initiating-event frequency per year using generic data or operating experience.
- Identify independent protection layers (IPLs) actually present, such as instrumented safety, relief valves, or detection plus qualified human intervention.
- Assign a PFD (probability of failure on demand) to each IPL.
- Apply conditional and modifying factors from CCPS where relevant, such as human-presence and ignition probabilities.
- Calculate the residual frequency and compare it with the organisation's acceptable-risk criterion.
- If insufficient, add or strengthen an IPL and recalculate.
Two IPLs that are independent are far better than one highly reliable layer. Common-cause failure—the same sensor or power supply—is the main pitfall to check before counting layers as independent.
3Example completed in Polyodos
Section to be completed — step-by-step overpressure scenario with relief valve and safety instrumentation, Polyodos screenshots and residual-frequency calculation.
4Common mistakes
| Mistake | Why it is a problem |
|---|---|
| Counting a preventive measure as an IPL | A measure acting before the initiating event, reducing its frequency, is not an IPL. An IPL acts afterto prevent the cause from escalating into the consequence. |
| Ignoring common-cause failures | Layers sharing the same sensor, power supply or root cause are not independent; multiplying their PFD values is invalid. |
| Overestimating human intervention | Operator action counts as a reliable IPL only when detection and response times are demonstrably compatible with scenario kinetics and supported by documented procedures and training. |