Layer of Protection Analysis (LOPA) is a structured process safety method used to evaluate whether existing safeguards provide enough protection against a hazardous scenario.
In a typical process plant, a single hazard may have several safeguards around it. These can include basic process controls, alarms, operator actions, shutdown systems, relief devices, physical protection and emergency response measures. The important question is not simply how many safeguards exist. The real question is whether the safeguards are sufficiently independent and reliable to reduce the risk to an acceptable level.
This is where Layer of Protection Analysis becomes useful.
LOPA provides a disciplined way to examine a specific hazardous scenario, identify the initiating event, assess the consequences, determine which safeguards can legitimately be credited as Independent Protection Layers (IPLs), and estimate the remaining risk.
It is widely used as part of process safety and functional safety activities, particularly when organizations need to determine whether additional protection is required or whether a Safety Instrumented Function may be necessary.
What is Layer of Protection Analysis?
Layer of Protection Analysis is a semi quantitative risk assessment technique that evaluates a defined hazardous scenario using initiating event frequencies, consequence information and the risk reduction provided by qualifying Independent Protection Layers.
The basic idea is straightforward.
A hazardous event does not normally occur because of one isolated failure. An initiating event occurs, and the scenario can progress toward an unwanted consequence unless one or more effective protection layers stop it.
For example, consider a process vessel that could become overpressurized because of a failure in the cooling system.
The sequence might look like this:
Cooling failure → temperature increases → reaction rate increases → pressure rises → high pressure condition develops → vessel overpressure
Depending on the design, several protection layers may be available to prevent or mitigate the consequence.
LOPA examines those layers individually rather than simply assuming that the presence of several safeguards automatically makes the process safe.
Why is Layer of Protection Analysis Important?
Modern process plants depend on multiple layers of protection because no single safeguard can be expected to work perfectly under every circumstance.
A control system can fail. An alarm may not be noticed in time. An operator may be unavailable. A shutdown function may fail on demand. A relief device may not be suitable for every credible scenario.
LOPA helps determine whether the combination of protection layers provides sufficient risk reduction for the scenario being studied.
It is particularly valuable when:
- A HAZOP or PHA identifies a potentially serious consequence
- Existing safeguards need to be reviewed
- A new process or equipment package is being designed
- A process modification is being considered
- A Safety Instrumented Function may be required
- SIL determination is being performed
- Existing protection layers need to be validated
- A facility is reviewing its process safety risk profile
The objective is not to add as many safeguards as possible. The objective is to understand the risk and provide the right level of protection.
How Does LOPA Fit into Process Safety?
LOPA should not normally be treated as an isolated study.
It is often performed after a hazard identification study such as HAZOP or PHA has identified a credible hazardous scenario that requires further evaluation.
A simplified relationship can be viewed as:
PHA or HAZOP → Hazardous Scenario → LOPA → Risk Evaluation → Additional Safeguards or SIL Determination
HAZOP and LOPA serve different purposes.
A HAZOP systematically examines process deviations and their possible causes and consequences. LOPA takes selected scenarios from hazard identification studies and examines them in greater detail using defined initiating event frequencies and protection layer performance.
This distinction is important.
LOPA is not simply a more detailed HAZOP, and a HAZOP should not be replaced by LOPA.
The two methods complement each other.
Understanding the Layers of Protection
The concept behind LOPA is often explained using the idea of multiple layers surrounding a hazardous process.
A typical process may have:
- Inherently safer process design
- Basic Process Control System
- Alarms and operator response
- Safety Instrumented Functions
- Physical protection such as relief systems
- Mechanical or passive protection
- Emergency response and mitigation
Not every layer will qualify as an Independent Protection Layer.
That distinction is one of the most important aspects of a LOPA study.
A safeguard can only receive LOPA credit when it meets the requirements established by the selected methodology.
What is an Independent Protection Layer (IPL)?
An Independent Protection Layer is a device, system or action capable of preventing a hazardous scenario from progressing to its undesired consequence independently of the initiating event and independently of other protection layers being credited for the same scenario.
In practical terms, three questions should always be asked:
- Does the safeguard actually perform a protective function?
- Is it sufficiently independent of the initiating event?
- Is it sufficiently independent of the other protection layers being credited?
CCPS identifies several important attributes when evaluating IPLs, including independence, functionality, integrity, reliability and auditability.
This is why simply writing “alarm provided” or “operator action available” in a LOPA worksheet is not enough.
The protection layer needs to be examined properly before risk reduction is credited.
Examples of Potential Protection Layers
Depending on the process and the scenario, potential protection layers may include:
Basic Process Control System
The normal control system can prevent a process variable from moving outside its intended operating range.
However, its ability to qualify as an IPL depends on the specific scenario, architecture, independence and methodology being applied.
Alarm and Operator Response
A high pressure, high temperature or high level alarm may provide an additional layer of protection when a trained operator has sufficient time, information and means to respond effectively.
The response cannot simply be assumed.
The analysis should consider whether the alarm will be available, whether it will be recognized, whether the operator has enough time to act and whether the required action is clearly defined.
Safety Instrumented Function
A Safety Instrumented Function may detect a hazardous condition and automatically place the process in a safe state.
When LOPA identifies a required risk reduction that must be achieved through a SIF, the result can support SIL determination in accordance with the applicable functional safety methodology.
LOPA therefore often forms an important part of the connection between process hazard analysis and functional safety.
Pressure Relief Devices
Relief systems may provide protection against overpressure for suitable scenarios.
However, the relief system must be appropriately designed for the credible overpressure case. It should not automatically receive credit simply because a relief valve is installed.
The protected equipment, relieving scenario, sizing basis, discharge destination, set pressure and other relevant design considerations need to be evaluated.
Passive Protection
Certain passive design features may provide protection without requiring an active response.
Examples can include suitable containment or inherently safer design features, depending on the scenario and the methodology used.
What is an Initiating Event in LOPA?
An initiating event is an event that starts the sequence leading toward the hazardous consequence being evaluated.
Examples can include:
- Equipment failure
- Instrument failure
- Utility failure
- Loss of cooling
- Incorrect operation
- Valve failure
- Control system failure
- Loss of containment
- Human error
- External events
The initiating event should be defined clearly enough that its frequency can be reasonably estimated using appropriate data or a justified engineering basis.
CCPS describes an initiating event as the minimum combination of failures or errors necessary to start the propagation of an incident sequence.
How is a LOPA Study Performed?
A good LOPA study follows a structured process.
1. Define the Hazardous Scenario
The first step is to clearly define the scenario being evaluated.
The team should establish:
- What process or equipment is involved?
- What deviation or initiating event occurs?
- What hazardous condition develops?
- What is the credible consequence?
- What operating conditions apply?
A poorly defined scenario can produce an unreliable LOPA result, so this step deserves careful attention.
2. Identify the Initiating Event
The team identifies the cause or combination of failures that could start the scenario.
The initiating event frequency is then estimated using suitable data, site information, company data or other justified sources.
The quality of this input matters because the initiating event frequency directly influences the calculated risk.
3. Identify the Consequence
The consequence should be clearly defined.
Depending on the process, this may include:
- Fire
- Explosion
- Toxic release
- Equipment damage
- Loss of containment
- Personnel exposure
- Environmental impact
- Production loss
The LOPA should focus on the consequence relevant to the scenario and the risk target being evaluated.
4. Identify Existing Protection Layers
The team then reviews the safeguards that could prevent the scenario from progressing.
This may include control systems, alarms, operator actions, shutdown functions, relief systems and other protective measures.
Each potential safeguard must then be evaluated to determine whether it qualifies for LOPA credit.
5. Verify IPL Independence
This is one of the most critical parts of the study.
If two safeguards depend on the same sensor, power supply, control system, final element or common failure mechanism, they may not provide the independent risk reduction that the LOPA initially appears to show.
Common cause and common dependency issues therefore need to be considered carefully.
6. Assign Probability of Failure on Demand
For qualifying IPLs, a Probability of Failure on Demand (PFD) is assigned according to the methodology and supporting reliability data.
PFD represents the likelihood that a protection layer will fail to perform its required function when it is demanded.
The lower the PFD, the greater the potential risk reduction provided by the protection layer.
The data source and assumptions used to assign the PFD should be documented.
7. Calculate the Mitigated Scenario Frequency
The initiating event frequency and credited protection layers are combined to estimate the frequency of the consequence after the credited protection layers have been considered.
A simplified LOPA calculation can be represented as:
Mitigated frequency = Initiating event frequency × PFD of IPL 1 × PFD of IPL 2 × …
Conditional modifiers and enabling conditions may also be relevant depending on the scenario and the LOPA methodology being used.
CCPS specifically identifies initiating events, IPLs, enabling conditions and conditional modifiers as components that may be considered in LOPA.
8. Compare the Result with the Risk Target
The calculated scenario frequency is compared with the organization’s defined tolerable risk or risk acceptance criterion.
If the existing protection layers do not provide sufficient risk reduction, additional protection may be required.
This could involve:
- Process design changes
- Additional engineering safeguards
- Improved alarms
- Additional shutdown functions
- Pressure protection
- Safety Instrumented Functions
- Changes to operating procedures
- Inherently safer design measures
The solution should be selected based on the actual risk and the hierarchy of controls rather than simply adding another alarm or instrument.
What is Risk Reduction Factor in LOPA?
Risk Reduction Factor, or RRF, is commonly used to express the amount of risk reduction associated with a protection layer.
For a protection layer with a PFD of 0.1:
RRF = 1 / PFD = 10
This means the layer provides a nominal risk reduction factor of 10 under the assumptions used in the analysis.
RRF should not be treated as a universal performance guarantee. The actual reliability of a protection layer depends on its design, testing, maintenance, independence and operating conditions.
LOPA and SIL Determination
LOPA is frequently associated with Safety Integrity Level determination, but the two concepts should not be confused.
LOPA can be used to determine whether additional risk reduction is required from a Safety Instrumented Function.
For example, if the existing independent protection layers do not reduce the scenario risk sufficiently to meet the defined tolerable risk target, the LOPA may identify the amount of additional risk reduction required from a SIF.
That required risk reduction can then support SIL determination under the applicable functional safety framework.
A SIL is not simply selected because a process is considered dangerous.
It is determined from the required risk reduction and the safety lifecycle methodology being applied.
This distinction is important because LOPA is a risk analysis technique, while SIL is a measure used in functional safety to specify the required integrity of a safety function.
LOPA vs HAZOP
LOPA and HAZOP are complementary studies, but they answer different questions.
| HAZOP | LOPA |
|---|---|
| Identifies process deviations and hazards | Evaluates defined hazardous scenarios |
| Primarily qualitative | Semi quantitative |
| Examines causes and consequences | Examines initiating event frequency and protection layers |
| Reviews process deviations systematically | Focuses on selected scenarios |
| Identifies existing safeguards | Determines which safeguards can receive IPL credit |
| Can identify scenarios requiring further assessment | Can quantify the risk reduction provided by qualifying IPLs |
A HAZOP may therefore identify the scenario, while LOPA can provide a more structured evaluation of whether the existing protection layers are sufficient.
LOPA vs QRA
LOPA and Quantitative Risk Assessment are also different in scope.
LOPA generally evaluates specific scenarios using simplified, predefined assumptions and data.
QRA can consider a much broader range of scenarios and may include detailed consequence modelling, frequency analysis, escalation effects, individual risk, societal risk and other quantitative measures depending on the study scope.
LOPA is therefore not a replacement for a full QRA where a detailed quantitative risk assessment is required.
Instead, the appropriate method should be selected based on the complexity of the hazard, the decision that needs to be made and the applicable risk assessment framework.
Common Mistakes in LOPA Studies
A LOPA can produce a precise looking number while still being technically weak if the assumptions are poor.
Some common problems include:
Taking Credit for Every Safeguard
The presence of a safeguard does not automatically make it an IPL.
The safeguard must meet the requirements of the selected LOPA methodology.
Ignoring Common Cause Failures
Two protection layers may appear independent on paper but depend on the same equipment, power supply, sensor or control architecture.
Such dependencies can significantly reduce the actual protection available.
Overestimating Operator Response
An operator action should not be credited without considering alarm availability, recognition, diagnosis, time available and the practicality of the required response.
Using Unverified Reliability Data
PFD and initiating event frequencies should have a documented technical basis.
Using arbitrary values can distort the risk result.
Treating Procedures as Automatically Independent
A written procedure does not necessarily provide a reliable independent protection layer.
Its effectiveness depends on how the action is initiated, communicated, performed and verified.
Ignoring Human Factors
People are part of many process safety scenarios.
Workload, alarm design, training, access, time pressure and the clarity of procedures can all affect whether a human response can realistically be relied upon.
Treating LOPA as a Compliance Exercise
The purpose of LOPA is not to fill out a worksheet.
The purpose is to understand whether the protection strategy is adequate for the scenario and whether additional risk reduction is required.
When Should a LOPA Study Be Performed?
LOPA may be appropriate at several stages of the process lifecycle.
During New Plant Design
LOPA can help identify protection requirements before equipment and control architectures are finalized.
Early analysis can also reduce the cost and complexity of later modifications.
During Process Modification
Changes to equipment, chemistry, operating conditions or control systems can change the original risk profile.
LOPA may therefore form part of a Management of Change process where the modification introduces scenarios requiring additional evaluation.
During SIL Assessment
Where Safety Instrumented Functions are required, LOPA can support the determination of the required risk reduction and SIL target.
During Process Safety Reviews
Existing facilities can use LOPA to reassess important scenarios when operating conditions, safeguards or risk criteria change.
After Significant Incidents or Near Misses
An incident investigation may identify weaknesses in existing protection layers. A targeted LOPA can help determine whether additional or better independent protection is required.
What Information is Needed for a LOPA Study?
A meaningful LOPA depends on good process information.
Depending on the study, the required information may include:
- Process flow diagrams
- Piping and instrumentation diagrams
- Process descriptions
- Operating procedures
- Equipment data
- Cause and effect diagrams
- Alarm philosophy
- Shutdown logic
- Safety Instrumented Function information
- Relief system information
- Process chemistry
- Operating conditions
- Hazard identification study results
- Failure data
- Site specific reliability information
- Existing protection layer information
The quality of the final result is strongly influenced by the quality of the information available to the study team.
How INDSAFE Approaches LOPA Studies
At INDSAFE, we approach LOPA as an engineering risk assessment rather than a standalone documentation exercise.
Our assessment begins with understanding the process, the hazardous scenario and the assumptions behind the initiating event.
We then review the available safeguards and determine which protection layers can legitimately receive credit based on their independence, functionality, reliability and other relevant criteria.
Where additional risk reduction is required, we focus on practical recommendations that can be implemented within the actual process and facility.
Depending on the project, LOPA can be integrated with:
- Process Hazard Analysis
- HAZOP Studies
- Functional Safety Studies
- SIL Determination
- Quantitative Risk Assessment
- Process Safety Management
- Management of Change
- Chemical Reaction Hazard Assessment
This integrated approach helps ensure that the conclusions from one process safety study are carried forward into the next stage of engineering and risk management.
What are the Key Outputs of a LOPA Study?
A typical LOPA study can provide:
- Defined hazardous scenarios
- Initiating event frequencies
- Identified protection layers
- IPL qualification and assumptions
- PFD values used for credited IPLs
- Estimated mitigated scenario frequency
- Risk comparison against the applicable target
- Required additional risk reduction
- Identification of scenarios requiring further protection
- Input to SIL determination where applicable
- Documented assumptions and recommendations
The exact deliverables should be agreed according to the project scope and the methodology being applied.
Frequently Asked Questions About LOPA
What does LOPA stand for?
LOPA stands for Layer of Protection Analysis.
What is the purpose of LOPA?
The purpose of LOPA is to evaluate whether the existing independent protection layers provide sufficient risk reduction for a defined hazardous scenario and to identify whether additional protection is required.
Is LOPA qualitative or quantitative?
LOPA is generally considered a semi quantitative risk assessment method. It uses numerical frequencies and probability values but applies a simplified approach compared with a full quantitative risk assessment.
Is LOPA the same as HAZOP?
No. HAZOP systematically examines process deviations, causes and consequences. LOPA evaluates selected hazardous scenarios in greater detail by considering initiating event frequencies and qualifying independent protection layers.
Is LOPA required for every process?
No. The need for LOPA depends on the process, hazards, company methodology, regulatory requirements, project requirements and the decisions that need to be supported by the study.
Can LOPA determine SIL?
LOPA can support SIL determination by identifying the additional risk reduction required from a Safety Instrumented Function. The overall functional safety process should follow the applicable functional safety methodology and lifecycle requirements.
Can an alarm be an IPL?
A properly designed alarm with an effective operator response may qualify as an IPL when the applicable criteria are satisfied. The alarm should not automatically receive IPL credit simply because it exists.
How often should LOPA be reviewed?
The appropriate review interval depends on the organization’s process safety management system and applicable requirements. LOPA should also be revisited when significant process, equipment, control or operating changes affect the assumptions used in the original analysis.
Building Safer Processes Through Better Risk Decisions
Layer of Protection Analysis is most valuable when it helps an organization make better engineering decisions.
The objective is not to create more layers simply because more layers appear safer. It is to understand the hazardous scenario, identify credible initiating events, evaluate the protection that is genuinely available, and determine whether the remaining risk is acceptable.
When performed with sound process information, appropriate reliability data and a multidisciplinary engineering team, LOPA can provide a practical basis for strengthening process safety and functional safety decisions.
For facilities handling hazardous chemicals, flammable materials, high pressures, high temperatures or reactive processes, understanding how protection layers work together is an important part of preventing major process safety incidents.
Need a LOPA Study for Your Facility?
INDSAFE provides Layer of Protection Analysis and process safety consulting services for new and existing industrial facilities.
Our engineers can support LOPA studies alongside HAZOP, PHA, SIL determination, QRA, Functional Safety and broader Process Safety Management activities.
Contact INDSAFE to discuss your process, risk assessment requirements and project scope.
Technical References
- Center for Chemical Process Safety (CCPS), AIChE – Layer of Protection Analysis (LOPA) resources and methodology
- CCPS, AIChE – Layer of Protection Analysis: Simplified Process Risk Assessment
- CCPS, AIChE – Guidelines for Initiating Events and Independent Protection Layers in Layer of Protection Analysis