Free calculator · no sign-up
LOPA calculator
From initiating event to target SIL for one scenario: enabling conditions, conditional modifiers and independent protection layers, the mitigated event frequency, and the risk reduction a safety instrumented function must deliver.
Conditions and protection layers
- Required SIF PFDavg
- –
Frequency after each factor, in the order entered, on a log scale; the last bar is the frequency with a SIF that just meets the requirement. Hover or tap a bar for its value, or focus the chart and use the arrow keys.
One scenario, frequencies per year, each factor applied once. The full First Out AI tool keeps a register of scenarios per hazard, records independence notes for each layer, calibrates risk matrices and risk graphs with your company's criteria, and passes the required PFD straight into the SIL verification. Calculations run in your browser; nothing you enter here is sent anywhere.
Method
How the target is calculated
MEF = IEF × Π EC × Π CM × Π PFD(IPL) RRF = MEF / TMEL PFDreq = TMEL / MEF = 1 / RRF RRF ≤ 1 no SIF needed 1 < RRF ≤ 10 no SIL requirement 10 < RRF ≤ 100 SIL 1 100 < RRF ≤ 1,000 SIL 2 1,000 < RRF ≤ 10,000 SIL 3 RRF > 10,000 SIL 4 or beyond: redesign EC enabling condition CM conditional modifier
Values are rounded to ten significant digits before the band check, so that a result such as 0.1 × 0.1 ÷ 10⁻⁵ counts as exactly 1,000 and not as 1,000.0000001. The same rule runs in the First Out AI engine and this page is tested against it.
Worked check
A level control loop fails at 0.1 per year. Ignition probability 0.3 and occupancy 0.5 are conditional modifiers; an independent high level alarm with a defined operator response is credited at PFD 0.1. MEF = 0.1 × 0.3 × 0.5 × 0.1 = 1.5 × 10⁻³ per year. Against a tolerable frequency of 10⁻⁵ per year the required RRF is 150: SIL 2, with the SIF needing PFDavg below 6.7 × 10⁻³.
What reviewers check first
- The initiating event is not also credited as a layer: a failed control loop cannot protect against itself.
- Every layer is independent of the initiating event and of the other layers, including shared sensors, valves and operators.
- Alarms are credited only with enough process safety time for the operator to act.
- Conditional modifiers are not double-counted with the consequence severity or with the tolerable frequency.
Questions
Short answers; the knowledge library has the long ones.
How is the required SIL found from a LOPA?
Multiply the initiating event frequency by each enabling condition, conditional modifier and protection layer to get the mitigated event frequency. Divide by the tolerable frequency for the required risk reduction factor. Above 10 and up to 100 needs SIL 1, up to 1,000 SIL 2, up to 10,000 SIL 3.
What counts as an independent protection layer?
A layer that can on its own stop the scenario reaching the consequence, is independent of the initiating event and of the other layers credited, is designed for this scenario, and can be audited and tested. An alarm counts only when the operator has enough time and a defined response. See IPL criteria.
What is the difference between an enabling condition and a conditional modifier?
An enabling condition must be present for the initiating event to lead to the scenario at all, such as a seasonal or batch operating state. A conditional modifier changes the probability that the scenario ends in the consequence assessed, such as ignition or a person being present.
Where does the tolerable frequency come from?
From your company's risk criteria for the consequence category: safety, environment, asset or reputation. Use the value your organisation has approved; it differs between companies and countries. See tolerable risk criteria.
What if the LOPA asks for SIL 4?
In the process sector a SIL 4 requirement usually means the design should change: reduce the initiating event frequency, add independent layers or reduce the consequence. A required risk reduction above 100,000 cannot be met by one safety instrumented function.
Updates by email
New calculators, worked examples and articles, about once a month.
Short, technical and free. No third-party marketing; unsubscribe from any email with one click.
Keep every scenario, its layers and the independence argument in one register, then verify the SIF against the target.
Free engineering aid. It supports engineering judgement and does not replace it; it is not certified software. A LOPA is a team study: check every frequency, credit and criterion with a competent functional safety engineer and your company's procedures.