LOPA Tutorial

Section I: Introduction

A Layers of Protection Analysis (LOPA), is a semi-qualitative study that identifies safeguards

available and determines if there are enough safeguards to prevent against a given risk. LOPA is
conducted to ensure that process risks are successfully mitigated to an acceptable level. Below in
Figure 1, is a visual to represent the layers of protection for a given process. The layers in the
diagram are ranked from 1-9 as most-least desirable safeguards.

Figure 1. Layers of Protection Example Visual [5]

LOPA is developed on the basis of a risk identification analysis, such as a Hazard and
Operability Study (HAZOP). HAZOP is done first, and is then followed by a LOPA study.
HAZOP is a structured analysis of process design to identify process safety incidents that a
facility is vulnerable to. A detailed overview of HAZOP can be found in the HAZOP tutorial.
Major hazardous scenarios, which have the potential to cause serious harm to people,
environment, or business, that are discovered in HAZOP are subject to LOPA. HAZOP identifies
potential hazards, while LOPA quantifies the probability of the hazard, analyzes the system at
risk, and identifies the mitigation measures against the hazard. These mitigation safety measures,
or “layers of protection” must meet the Center for Chemical Process Safety (CCPS) criteria of
being Independent Protection Layers (IPL).

Section II: Definitions

Independent

Not requiring or relying on something else

 Requirements for Independent Protection Layers (IPL)

1) An IPL is effective in preventing the consequence

2) An IPL functions independently of the initiating event of the scenario and
functions independently of all other layers that are used for that same scenario
3) An IPL is auditable (must be capable of validation including review, testing, and
documentation)

There are many different possible independent protection layers that can be used in a
process. Here is a list of examples of IPL:

● Inherently Safer Design

○ Reducing the quantity of material involved
○ Changing process condition
○ Eliminating flanges
○ etc.
● BPCS
○ First layer of protection during normal operation which is designed to
maintain process within a safe operating region
● SIF
○ Detects out of limit conditions and acts to bring the process back to a safe
state
● Physical Detection Devices
○ Provide a high degree of protection against overpressure
● Passive Devices
○ Dike
○ Blast walls

There are also many actions that are not considered independent layers of protection.
Some examples of are NOT considered an IPL are fire brigade, manual deluge systems,
and community responses.

Categories of Consequences
Potential consequences are ranked by their risk into categories 1-5. Category 1 includes
consequences that are the least severe and category 5 includes consequences that are the
most severe. Consequence can be in terms of “health and safety” or “financial” or both.
There could be an incident which is category 5 for safety, but category 3 for financial.

Table 1. Consequence Categories

Severity Safety Impact Business Impact Example

Category 1 Slight First Aid $0 - 100,000 Release of 1-1,000 lb of

Treatment combustible liquid
Case
 Category 2 Minor Minor Injury: $100,000 - Release of 1,000-100,000 lb
Day Away 1 million of combustible liquid
from Work

Category 3 Severe Serious Injury: $1 - 10 million Release of 1-10 lb of

Hospital Stay extremely toxic material
above its boiling point

Category 4 Major Single Fatality $10 - 100 million Release of 10-100 lb of

extremely toxic material
above its boiling point

Category 5 Catastrophic Multiple > $100 million Release of more than 100 lb
Fatalities of extremely toxic material
above its boiling point

Frequency

Frequency of Initiating Event (FOIE):

FOIE describes how often the initiating event, which is the failure that causes the
given consequence, will occur. Initiating events can passive or active. Initiating
events could be a natural phenomenon, control system failure, human error, etc.
Probabilities of a given initiating event occurring can be found in Table 12-2 pgs
518-519 of Daniel Crowl and Joseph Louvar’s book “Chemical Process Safety:
Fundamentals with Applications” 4th edition.

Probability of Failure of IPL on demand (PFD):

PFD describes how often the protection layer will fail. Probabilities that a given
layer will fail can be found in tables 12-3 and 12-4 on pgs 520-521 of Daniel
Crowl and Joseph Louvar’s book “Chemical Process Safety: Fundamentals with
Applications” 4th edition.

Mitigated consequence frequency (MCF):

MCF describes how often an initiating event will occur and the IPL will fail.
MCF is the frequency that a given consequence (examples in Table 1) will occur.
MCF is calculated by the given formula:

𝑀𝐶𝐹 = 𝑃𝐹𝐷 𝑥 𝐹𝑂𝐼𝐸

Section III: LOPA Process

 1) Identify a single consequence to a potential process safety hazard
2) Identify an accident scenario and cause associated with the consequence
3) Identify the initiating event for the scenario and estimate the frequency of initiating event
(FOIE).
4) Identify the independent protection layers that are available for this particular
consequence and estimate the probability of failure on demand (PFD) for each protection
layer
5) Combine the frequency of initiating event (FOIE) with the probability of failure (PFD) of
the independent protection layer (IPL) to determine the mitigated consequence frequency
(MCF) for the given initiating event
6) Plot the consequence frequency vs consequence severity to estimate the level of risk as
seen below in Table 2.

RISK = Severity X Consequence

Table 2. Risk Matrix

Category 5

Category 4

Category 3

Category 2

Category 1

Rare: Unlikely: Possible: Probable: Highly

1 consequence 1 consequence 1 consequence 1 consequence Probably:
every 10,000 every 1000 every100 years every 10 years 1 consequence
years years (MCF = (MCF = every 1 year
(MCF ≤ (MCF = 0.01/year - 0.1/year - (MCF ≥
0.0001/year) 0.001/year - 0.1/year) 1/year) 1/year)
0.01/year)

___ severe risk

___ major risk
___ moderate risk
___ minor risk

7) Compare risk found in step 6 to an acceptable level of risk and evaluate if additional IPLs
are necessary

Section IV: Example Using Explosion at Carribean Petroleum Company (CAPECO)

1) Identify a single consequence to a potential process safety hazard

 At CAPECO, the potential process safety hazard was the inaccurate filling of gasoline
storage tanks. The consequence was overfilling of flammable gasoline which could lead
to fire.

2) Identify an accident scenario and cause associated with the consequence

The storage tank could overflow due to operator error and lead to a fire.

3) Identify the initiating event for the scenario and estimate the frequency of initiating event
(FOIE).
The initiating event would be operator error. According to table 12.2 in Daniel Crowl
and Joseph Louvar’s“Chemical Process Safety: Fundamentals with Applications” 4th
edition the frequency of operator error is 1x10-1.
FOIE = 1x10-1/year

4) Identify the protection layers that are available for this particular consequence and
estimate the probability of failure on demand (PFD) for each protection layer
PFD values can be found in table 12.3 and 12.4 in Crowl “Chemical Process Safety:
Fundamentals with Applications”4th edition. In this example, we will use two layers of
protection.

IPL1. A possible protection layer would be implementing inherently safer design, such as
changing process condition and reducing the quantity of flow directed to each tank.

PFD(Inherently Safer Design) = 1x10-2

IPL2. The tank farm already had a dike which reduces the frequency of large
consequences of a tank overfill or spill.
PFD(Dike) = 1x10-2

5) Combine the frequency of initiating event (FOIE) with the probability of failure (PFD) of
the independent protection layer (IPL) to determine the mitigated consequence frequency
(MCF) for the given initiating event

MCF = FOIE X PFD(Inherently Safer Design) X PFD(Dike) =

1x10-1 X 1x10-2 X 1x10-2 = 1x10-5/year

6) Plot the consequence frequency vs consequence severity to estimate the level of risk as
seen below in Table 2
An MCF of 1x10-5/year would mean there is 1 event every 10,000 years, which is
“Rare.”

As in the CAPECO incident, if >100,000-lb of flammable liquid are released and if

ignited would result in a vapor cloud explosion and fire, risk of 2-3 fatalities, and risk of
equipment damage and requiring plant shutdown for repair, the consequence would be
category 5 according to table 12.2 in Crowl “Chemical Process Safety: Fundamentals
with Applications” 3rd edition.
 Using Table 2 above, a rare event of category 5 is a moderate risk.

7) Compare risk found in step 6 to an acceptable level of risk and evaluate if additional IPLs
are necessary
In this case, a moderate risk would be acceptable. The two layers of protection,
inherently safer design and dike, would be adequate.

If the risk was too high, additional layers of protection would need to be implemented. To
do this, iterate back through steps 1-6, but using additional layers and PDF values. Then
evaluate again until the risk is at an acceptable level.

Section V: LOPA Application

LOPA studies generally address around 5% of the significant risks issues. Companies develop
limits for LOPA studies, often focusing on major consequences of category 4 or 5 and accidents
with fatalities. Most accidents occur during startup and shut down, so LOPA is often focused on
consequences from incidents involving startup and shut down of equipment. LOPA studies can
be conducted with few resources, focus attention on major issues, eliminate unnecessary
safeguards, establish valid safeguards to improve processes, and provides a basis for managing
layers of protection.

References

[1] “LOPA – Layer of Protection Analysis.” Process and HSE Engineering, 2 Feb. 2012,
[Link]/lopa-layer-of-protection-analysis/.

[2] Summers, Angela E. (July 2014). “Introduction to Layer of Protection Analysis” (July 2014).
SIS-Tech.

[3] “Risk Assessment .” Chemical Process Safety: Fundamentals With Applications, by Daniel
A. Crowl and Joseph F. Louvar, 3rd ed., Pearson, 2011, pp. 577–587.

[4] Gate Inc.“Introduction to Layer of Protection Analysis (LOPA)”. Gate Keeper: A Technical
Newsletter for the Oil & Gas Industry (July 2014).

[5] Spencer, Gabi. “Multiple Layers of Protection & Mitigation.” ESC, 26 Jan. 2109,
[Link]/guidance-for-performing-an-effective-lopa-2/multiple-layers-of-protection-
mitigation/.
[6] Shuttleworth, Mike. “Qualitative and Quantitative Risk Analysis. What Is the Difference?”
Project Risk Manager, 13 Oct. 2019, [Link]/blog/qualitative-and-
quantitative-risk-analysis/.

[7] “Independent.” Merriam-Webster, Merriam-Webster, [Link]-

[Link]/dictionary/independent.

[8] Crowl, Daniel A., and Joseph F. Louvar. Chemical Process Safety: Fundamentals with
Applications. Pearson, 2019.

Prepared in collaboration with Lydia Peters