What is LOPA?
LOPA (Layer of Protection Analysis) is a semi-quantitative risk assessment method that calculates, for each hazardous scenario, how often the undesired consequence still occurs once all independent protection layers have done their job, and compares that result with a predefined tolerable risk. The method works in orders of magnitude: frequencies and failure probabilities are rounded to powers of ten. This lets a team decide whether the existing measures are sufficient or whether an extra layer is needed, usually a safety instrumented system with a particular SIL.
LOPA turns the scenarios from a HAZOP into a number: how much risk reduction is still missing, and therefore which SIL does a new safety function need?
LOPA emerged in the chemical industry in the 1990s. The US Center for Chemical Process Safety (CCPS) captured the method in 2001 in Layer of Protection Analysis: Simplified Process Risk Assessment. At the end of 2014 a second CCPS book followed on initiating events and protection layers, with more detailed requirements and reference values.
🎯 Why do process companies use LOPA?
A HAZOP produces dozens to hundreds of scenarios with causes, consequences and existing safeguards, but it does not say whether those safeguards are enough. A full quantitative risk analysis for every scenario is too expensive. LOPA sits in between and is a core tool of process safety. It helps you to:
- Justify risk reduction - with a traceable calculation rather than a gut feeling
- Assign SIL levels - to safety instrumented functions (SIFs), as IEC 61511 requires
- Spot unnecessary safeguards - if the risk is already well within the criterion, no extra SIF is needed
- Find weak spots - safeguards that on closer inspection are not independent or are never tested
- Record decisions - for the regulator, for audits and for later modifications through change management
Both IEC 61511-3 and IEC 61508-5 describe LOPA in an informative annex, alongside the qualitative risk graph. The method is therefore not mandatory, but it is the usual way to carry out the SIL determination required by IEC 61508 and IEC 61511.
🧱 How does a LOPA calculation work?
Each LOPA scenario is a single cause–consequence pair. The core formula multiplies the frequency of the cause by the probability of failure of each protection layer:
f(consequence) = f(initiating event) × conditional factors × PFD₁ × PFD₂ × … × PFDₙ
- Initiating event - the cause, expressed in events per year, for example a failing control loop or a leaking pump seal
- Conditional factors - enabling conditions (the process is only in the hazardous state for part of the time) and conditional modifiers (probability of ignition, of personnel being present, of fatal injury)
- PFD per layer - the probability of failure on demand: the chance that the layer fails at the moment it has to act
- Tolerable frequency - the company criterion, for example 10⁻⁵ per year for a scenario with a potential fatality
If the calculated frequency is higher than the criterion, the ratio between the two gives the missing risk reduction. A shortfall of a factor of 10 to 100 calls for a SIF with SIL 1, a shortfall of 100 to 1,000 for SIL 2, and so on.
✅ When does a measure count as an independent protection layer?
Not every safeguard may be credited in LOPA. An independent protection layer (IPL) has to meet strict conditions. In its 2014 guidelines CCPS lists, among others:
- Independent - the layer shares no sensor, logic solver, final element or power supply with the initiating event or with another credited layer
- Functional and specific - the layer can actually stop the scenario, fast enough and with sufficient capacity
- Reliable and with integrity - the PFD is backed by design, failure data and maintenance
- Auditable - the function is tested periodically and those tests are recorded
- Protected against access and change - settings cannot be altered unnoticed, physically or digitally
Training, work procedures and change management are therefore not IPLs, although they are needed to keep real IPLs reliable. A mechanical device does count, even though it falls outside the scope of functional safety standards. Inherently safer process design goes a step further: a vessel rated for the highest pressure that can occur, or a line sized so that a blockage poses no danger, can remove the scenario altogether instead of merely lowering its frequency.
| Protection layer | Example | Typical PFD |
|---|---|---|
| Basic process control (DCS or PLC) | Independent control loop that corrects the deviation | 0.1 (IEC 61511 allows a factor of 10 at most) |
| Alarm with operator response | High-pressure alarm in SCADA or the DCS on its own measurement, with enough time to respond (often at least ten minutes) | 0.1 |
| Safety instrumented function | Pressure measurement that shuts off the feed via a safety PLC | 0.1 to 0.001 depending on SIL 1–3 |
| Mechanical pressure relief | Relief valve or rupture disc, correctly sized | 0.01 |
| Containment | Bund or drip tray that limits a spill | 0.01 |
| Interlock in the basic control system | Pump trip on low level, in the same system as the control | 0.1, provided it is independent of the cause |
Alarms only qualify as an IPL when the alarm system is set up properly in line with alarm management and ISA-18.2. An operator facing an alarm flood of hundreds of messages will not achieve a PFD of 0.1.
🧠 What does a LOPA example look like?
Take a reactor whose pressure control uses a control valve to regulate the steam supply. The HAZOP found the scenario control valve fails open, pressure rises, vessel may rupture.
| Step | Value | Explanation |
|---|---|---|
| Initiating event | 0.1 per year | Failure of the pressure control loop in the basic control system |
| Consequence | Vessel rupture, potential fatality | Severity class from the company risk matrix |
| IPL 1: high-pressure alarm | PFD 0.1 | Own pressure measurement, separate from the control loop, with sufficient response time |
| IPL 2: relief valve | PFD 0.01 | Mechanical, sized for this scenario and tested periodically |
| Frequency with existing layers | 1 × 10⁻⁴ per year | 0.1 × 0.1 × 0.01, or once every 10,000 years |
| Tolerable frequency | 1 × 10⁻⁵ per year | Company criterion |
| Missing risk reduction | Factor 10 | New SIF with PFDavg ≤ 0.1: SIL 1 |
Two lessons follow from this example. The high-pressure alarm can only be credited because it has its own measurement: if it ran on the same transmitter as the failing control loop, it would not be independent. And the answer does not always have to be a SIF: a second, independent relief valve or a stronger vessel can close the gap as well.
🔄 How does LOPA compare with other analysis methods?
| Method | Type | What does it deliver? | When to use it? |
|---|---|---|---|
| HAZOP | Qualitative | Scenarios, causes, consequences, existing safeguards | First, as input for LOPA |
| Risk graph | Qualitative | Quick SIL estimate from parameters for consequence, exposure, possibility of avoidance and demand rate | Screening functions with a low SIL |
| LOPA | Semi-quantitative | Frequency per scenario and missing risk reduction | Standard approach for SIL allocation |
| Fault tree or QRA | Quantitative | Detailed probability calculation, including common causes | Complex scenarios or high SIL |
| BOW-TIE | Qualitative, visual | Overview of causes, barriers and consequences around one top event | Communication and barrier management |
| FMEA | Component-focused | Failure modes and effects per part | Design of equipment and SIS components |
LOPA is therefore a filter. Low-risk scenarios already drop out at the HAZOP stage, LOPA handles the large middle ground, and only the most difficult scenarios move on to a full quantitative analysis.
🧭 How do you carry out a LOPA step by step?
- Select scenarios - take the scenarios with severe consequences from the HAZOP; each scenario has exactly one cause and one consequence.
- Determine severity and criterion - classify the consequence with the risk matrix and read off the tolerable frequency.
- Choose the frequency of the cause - use fixed company values, such as 0.1 per year for a failing control loop or 10⁻² to 10⁻³ per opportunity for operator error in a routine task.
- Identify the IPLs - test each safeguard for independence, effectiveness and auditability, and only then assign a PFD.
- Calculate and compare - multiply, add conditional factors and determine the gap with the criterion.
- Decide and document - choose a SIF with the right SIL or another measure, and record the assumptions in the safety requirements specification.
- Keep it current - repeat the LOPA when the process changes and review the assumptions during the periodic HAZOP revalidation.
In the Netherlands, inspectors at Seveso sites regard IEC 61511 as the state of the art, and with it a justified SIL determination (see Seveso and Cybersecurity). Note the difference with external safety: the Dutch limit of 10⁻⁶ per year for location-based risk at vulnerable buildings concerns the surroundings, whereas LOPA criteria are internal company criteria per scenario.
🔐 What does cybersecurity mean for LOPA?
LOPA assumes random, independent failures. A cyberattack is exactly the opposite: an attacker can disturb the control loop, suppress the alarm and disable the safety PLC at the same time. The TRITON malware targeted that last layer at a petrochemical plant in Saudi Arabia in 2017. In that case, multiplying PFDs no longer holds.
That is why IEC 61511 has required a security risk assessment of the SIS in clause 8.2.4 since the 2016 edition. The standard points to guidance such as ISA TR84.00.09 and the IEC 62443 series; for the partitioning into zones and conduits many companies now use IEC 62443-3-2. In practice this means:
- Shield programmable IPLs - put the SIS in its own zone and only allow changes from a managed engineering workstation
- Value non-hackable layers - relief valves, rupture discs and bunds keep working during an attack
- Add attack scenarios - consider which HAZOP scenarios an attacker could trigger and which layers they could then bypass
- Rethink design choices - Cyber-Informed Engineering uses the same scenarios to remove digital dependencies at the design stage
In this way security complements LOPA and makes defence in depth hold up digitally as well.
❓ Frequently asked questions
What does LOPA stand for?
LOPA stands for Layer of Protection Analysis. It is a semi-quantitative method for determining, per hazardous scenario, whether the independent protection layers reduce the risk sufficiently. CCPS documented the method in 2001.
Is LOPA mandatory under IEC 61511?
LOPA is not mandatory under IEC 61511. The standard does require you to justify the required risk reduction and the SIL of each safety function, and it names LOPA and the risk graph as suitable methods in the informative Part 3. In the process industry, LOPA is the most widely applied approach for this.
What is the difference between a safeguard and an IPL?
A safeguard is any measure a HAZOP team lists, from a procedure to a safety valve. An IPL is a safeguard that is also independent, effective and auditable, so it may be given a PFD in LOPA. Every IPL is a safeguard, but not every safeguard is an IPL.
Can the basic process control system be credited in LOPA?
The basic process control system can be credited as a protection layer in LOPA, but under IEC 61511 with a risk reduction of a factor of 10 at most. In addition, the layer must not use the same components as the initiating event. If the control loop itself fails, that same control loop cannot stop the scenario.
How long does a LOPA study take?
A LOPA study usually takes a few days to a few weeks, depending on the number of scenarios from the HAZOP. The team usually consists of a process engineer, an operator, an instrumentation specialist and a LOPA facilitator, often the same people who took part in the HAZOP. Good preparation with fixed company values for frequencies and PFDs speeds up the process considerably.
Does LOPA take cyberattacks into account?
A classic LOPA does not take cyberattacks into account, because the method assumes random and independent failures. An attack can disable several programmable layers at once. That is why a security risk assessment of the SIS under IEC 61511 clause 8.2.4 belongs alongside LOPA.
📌 In summary
LOPA calculates per scenario how often a hazardous consequence still occurs after all independent protection layers, and so determines how much extra risk reduction and which SIL are needed. The method bridges the HAZOP and the SIS design under IEC 61511. Its strength depends on honest assumptions about independence, sound alarm management and, since TRITON, an SIS that is protected digitally as well.