Layer of protection analysis (LOPA) is a semi-quantitative method: it takes one cause–consequence pair from the hazard study, estimates how often the consequence would occur with the existing protection, compares that with a tolerable frequency, and turns the gap into a required risk reduction for a SIF.
The sequence
- Define the scenario: one initiating cause leading to one consequence. "Upstream pressure control valve fails open → separator overpressure → loss of containment → fire."
- Consequence and tolerable frequency (TMEL) from the company's risk criteria for that consequence category.
- Initiating event frequency (IEF), per year, from the company LOPA table or site history.
- Enabling conditions: probability that the plant is in the state where the cause can lead to the consequence (for example, the fraction of time a batch is in its exothermic phase).
- Conditional modifiers: probability of ignition, of a person being present, of a fatal outcome. Use them only if the company rules allow and the TMEL is defined for the final outcome.
- Independent protection layers (IPLs): each with a probability of failure on demand, credited only if it meets the IPL criteria.
- Mitigated event frequency (MEF) = IEF × enabling × modifiers × IPL PFDs.
- Required risk reduction RRF = MEF / TMEL; required PFDavg = TMEL / MEF; target SIL from the RRF band (10–100 SIL 1, 100–1,000 SIL 2, 1,000–10,000 SIL 3).
Worked example
| Item | Value | Basis |
|---|---|---|
| Initiating event: BPCS pressure loop fails | 0.1 per year | Company table (illustrative) |
| Relief valve, sized for blocked outlet but not the full blow-by | 0.01 | Independent, tested |
| BPCS high pressure alarm, operator response | not credited | Same BPCS as the cause |
| Probability of ignition | 0.3 | Company table (illustrative) |
| Probability of a person in the area | 0.4 | Occupancy study (illustrative) |
| MEF | 0.1 × 0.01 × 0.3 × 0.4 = 1.2 × 10⁻⁴ per year | |
| TMEL (multiple fatalities) | 1 × 10⁻⁶ per year | Company criterion (illustrative) |
| RRF | 1.2 × 10⁻⁴ / 1 × 10⁻⁶ = 120 | |
| Required PFDavg | 8.3 × 10⁻³ | |
| Target | SIL 2 |
The SIF that closes the separator inlet on high-high pressure must then be verified to PFDavg ≤ 8.3 × 10⁻³, not merely "SIL 2" (which would allow up to 10⁻²).
Pitfalls reviewers look for
- Two causes merged into one scenario, or one cause counted twice.
- Credit for an alarm or control loop in the same BPCS as the initiating cause.
- Conditional modifiers applied while the TMEL is defined for the release, not the fatality.
- Enabling conditions used to describe what is really an IPL, or vice versa.
- An RRF above 10,000: a single SIF cannot deliver it. Change the design, add independent layers.
In First Out AI
LOPA tab: load the "Separator overpressure" example to see this case, press Calculate, then "Apply to linked SIF" to send the target SIL and required PFDavg to SIF-101. The frequency chart shows each layer's reduction and the gap the SIF must close.
Written for First Out AI as engineering guidance. It supports engineering work and does not replace it; check every value against your standards, certificates and company rules with a competent functional safety engineer.