1

Introduction to LOPA
Muhammad Raihan Syah Iman S.T, B. Eng (Hons)
PT Lebah Solusi Indonesia (LebSolution), Komplek Ruko Golden Madrid 2, Blok I-22, Banten 15310, Indonesia
+62-812-8488-7575; muhammad.iman@lebsolution.com
Wednesday, 11 May 2022

Introduction 1. Consequence Identification and Scenario

D
uring my time studying chemical engineering,
my exposure to the process safety industry has
been limited to class room discussion on major
industrial accidents with extensive investigations and
media coverage. Bhopal, Piper Alpha, Buncefield, and
Odessa are all too familiar for professionals and
budding engineers alike. While this has proven to be an
excellent approach to engaging students and inspiring
engineers such as myself, it lacks in teaching students
about the wide range risk assessment methods
corporations use to prevent such incidents in the first
place!
As such, I would like to provide a short introduction to
one of the many methods process safety engineers use
to ensure that the risks imposed on us, our environment,
and our assets are kept within tolerable levels. In this
article we will discuss one such method of risk
assessment, known as the Layer of Protection Analysis
or LOPA.
What is a LOPA?
Layer of Protection Analysis (LOPA) is a simplified
form of risk assessment that uses order of magnitude
categories for initiating event frequencies, consequence
severity, and likelihood of failure of independent
protection layers (IPLs) to approximate the risk of a
scenario. The primary purpose of which is to determine
whether or not sufficient layers of protection against a
particular scenario have been implemented. The
analysis builds upon information developed during a
qualitative hazard evaluation; such as a Process Hazard
Analysis (PHA), on a single cause-consequence pair
basis. The resulting risk estimation can be extended to
assist in making risk judgements on how much
additional risk reduction measures may be required to
reach a tolerable level of risk. In general, the LOPA
process can be broken down into 6 steps (CCPS, 2001);
Screening
2. Scenario Selection
3. Initiating Event Identification and Frequency
Determination
4. IPL Identification and Determining Probability
of Failure on Demand
5. Risk Estimation
6. Evaluation of Risk and Decision Making
Step 1: Identify the consequence to screen the
scenarios
LOPA begins with screening scenarios that has been
developed in a prior study, such as a HAZOP study.
These scenarios are often screened based on their
evaluated consequences.
Several approaches can be taken in this evaluation to
provide a semi-quantifiable result; including release
size/characterization, simplified injury/fatality
estimates, simplified injury/fatality estimates with
adjustments, or detailed injury/fatality estimates. In any
case, the method used for consequence characterization
should be consistent with the company’s risk
assessment methodology and risk tolerance criteria.
Step 2: Select an accident scenario
A scenario is defined as an unplanned event or sequence
of events that results in an undesirable consequence.
Each scenario consists of at least 2 elements; the
initiating event and a consequence.
Scenario = Initiating Event + Consequence
Although, in addition, it may also include enabling
events or conditions, failure of safeguards, probability
of ignition, and/or probability of human presence in the
affected area.

2022 PT Lebah Solusi Indonesia

2
Step 3: Identify the initiating event of the
scenario and determine the initiating event
frequency
LOPA is limited to a single initiating event for each
scenario. The frequency of the initiating event is
commonly expressed in events per year, but can also be
expressed as events per 106 hours or failure per 103
demand. Acquisition of IEF from an established and
well-maintained database of the company subjected to
the LOPA is favourable as the data better reflects actual
conditions and experiences. However, the frequency
data can also be obtained from varying sources
including industry data in the Guidelines for Initiating
Events and Independent Protection Layers in Layer of
Protection Analysis (CCPS, 2015), Guidelines for
Process Equipment Reliability Data (CCPS, 1989), and
many more.
Step 4: Identify IPLs and estimate the
probability of failure on demand of each IPL
A safeguard is a device, system, or action that is capable
of preventing a scenario from proceeding to its
undesired consequence and/or reduce the severity of its
consequences. In the context of a LOPA only preventive
safeguards are taken into account, as the desired
outcome is an evaluation of the likelihood of a scenario
and how the safeguard affects it and not how it mitigates
the consequences. This safeguard is considered an
Independent Protection Layer (IPL) when it is
independent of the initiating event or the action of any
other layer of protection associated with the scenario.
Remember: All IPLs are safeguards but not all
safeguards are IPLs!
The effectiveness of an IPL is quantified in terms of its
probability of failure on demand (PFD). The smaller the
value of the PFD, the larger the reduction in frequency
of the consequence for a given initiating event.
Step 5: Estimate the risk of the scenario by
mathematically combining the consequence,
initiating event and IPL data
The risk and frequency of a given scenario can be
quantified by multiplying the initiating event frequency
with the multiplication product of all the existing IPL’s
PFD. This value can be expanded upon by incorporating
the probability of ignition (flammable release),
probability of human presence in the affected area,
and/or probability of injury.
2022 PT Lebah Solusi Indonesia
This value is written in order of magnitude, e.g.
10-1, 10-2, and so on. The smaller the value, the less
likely it is for the scenario to occur.
Step 6: Evaluate the risk to reach a decision
concerning the scenario
Generally risk management decisions can be
categorized as either the management of risk with the
existing systems at its current tolerable level, mitigation
of the risk to a tolerable level, or abandoning the risk
(avoid the risk entirely by altering the design and/or
operation mode) due to it being too high. The
application of a LOPA allows for a quantifiable
comparison of the existing risk with a pre-determined
risk tolerance criteria and for cost-benefit analysis of
competing options of safeguards should a risk be
deemed intolerable.
Summary
A Layer of Protection Analysis or LOPA is a form of
risk assessment used by corporations to provide a
reproducible assessment of the risk imposed by a given
scenario based on estimations of the likelihood for the
initiating event to occur and the probability that of the
independent layers of protection will fail.
The resulting value can then be used to assess whether
additional layers of protection are required to reduce the
risk to a tolerable level.
References
1. CCPS, 1989. Guidelines for Process Equpment
Reliability Data. New York: AIChE.
2. CCPS, 2001. Layer of Protection Analysis:
Simplified Process Risk Assessment. New
York: AIChE.
3. CCPS, 2015. Guidelines for Initiating Events
and Independent Protection Layers in Layer of
Protection Analysis. New York: Wiley.