LOPA • Independent protection layers • SIL identification • ALARP
Layer of Protection Analysis
Structured, semi-quantitative LOPA studies that test whether existing or proposed safeguards provide sufficient risk reduction for clearly defined hazardous scenarios.
ExConform facilitates multidisciplinary teams to evaluate initiating-event frequency, enabling conditions, conditional modifiers and independent protection layers, then compare the resulting mitigated event likelihood with the organisation’s tolerable-risk criteria.
A focused bridge between HAZOP and detailed risk assessment
What a LOPA Study Is Designed to Answer
Layer of Protection Analysis is a semi-quantitative, scenario-based risk assessment method. It examines a single initiating cause and consequence pair, applies agreed order-of-magnitude data and determines whether the credited protection layers reduce risk to the organisation’s target level.
LOPA is commonly used after a HAZOP has identified scenarios that need more consistent evaluation, where safeguard independence must be demonstrated, or where the required performance of a safety instrumented function needs to be established. It is more structured than qualitative risk ranking, while remaining less data-intensive than a full quantitative risk assessment.
How the study is performed
A Clear and Traceable LOPA Workflow
Effective LOPA depends on disciplined scenario definition, transparent assumptions and consistent application of the organisation’s risk criteria. Each step is documented so that reviewers can understand how the final risk-reduction requirement was derived.
The risk-reduction concept
Protection Layers Work Together to Close the Risk Gap
The unmitigated process risk associated with a hazardous scenario is reduced by prevention, control, protection and mitigation measures. LOPA makes this layered concept explicit by quantifying the portion of risk reduction that can be credited to each valid protection layer.
The total reduction achieved by all credited layers is compared with the necessary risk reduction required to reach the tolerable-risk target. Existing non-SIS layers should be considered before assigning the remaining gap to a safety instrumented function.
This supports proportionate design decisions and helps avoid both under-protection and unnecessary dependence on instrumented safeguards.
Independent protection layers
Safeguards Are Credited Only When They Meet IPL Criteria
A safeguard identified during HAZOP is not automatically an Independent Protection Layer. The team must demonstrate that the layer can prevent or mitigate the scenario without being defeated by the initiating event or by the failure of another credited layer.
Effective and Specific
The layer must act on the defined scenario and be capable of preventing or mitigating the stated consequence endpoint.
Independent
The layer must not be compromised by the initiating cause, by the same failure mechanism or by another protection layer credited in the calculation.
Dependable and Auditable
The claimed performance must be supported by design, inspection, testing, maintenance, procedures, competence and records.
Example study record
A LOPA Worksheet Makes the Decision Basis Visible
The example worksheet covers hydrogen-generation scenarios including toxic exposure during maintenance, electrocution and inadvertent remote start-up. For every scenario, the worksheet records the cause, expected frequency, consequence severity and the target mitigated event likelihood before protection-layer credit is applied.
Credited safeguards are then listed with their assigned probability of failure on demand. The worksheet calculates the resulting mitigated event likelihood, the LOPA ratio or risk gap, the required risk reduction factor and any recommended SIL.
Recommendations and comments provide traceability for design changes, operating controls, assumptions, exclusions and the rationale for “No SIL” outcomes where non-instrumented measures are sufficient.
Transparent Calculation, ALARP Demonstration and Recommendation Logic
LOPA does not seek false numerical precision. It uses controlled, order-of-magnitude assumptions to support consistent decisions. Every frequency, modifier, PFD and risk criterion should have a documented source or justification, and uncertainty should be made visible to the decision-makers.
Where the calculated mitigated event likelihood remains above the target, the study identifies additional prevention or protection measures and records why the selected solution is reasonably practicable. The output can therefore support ALARP demonstration, provided it is integrated with engineering judgement, option evaluation and the wider risk-management process.
Mitigated event likelihood = initiating-event frequency × enabling-condition factors × conditional modifiers × PFD of each credited IPL
SIL, PFD and risk reduction factor
Translating a Risk Gap into a SIL Target
Where additional risk reduction is to be provided by a safety instrumented function, the LOPA output can be used to identify the required Safety Integrity Level. In low-demand applications, the SIL bands correspond to target ranges of average probability of failure on demand and their reciprocal risk reduction factors.
A SIL target is a performance requirement for the complete safety instrumented function—not simply for an individual sensor, logic solver or valve. The subsequent functional safety lifecycle must define the Safety Requirements Specification, verify the design, manage systematic capability, validate the function and maintain the required performance throughout operation.
Human factors in LOPA
Operator Actions Need the Same Discipline as Engineered Layers
Alarm-and-operator-response layers and procedural safeguards can only be credited when the required action is clear, timely, achievable and supported by reliable detection, alarm presentation, procedures, competence and working conditions.
Detection and Diagnosis
The operator must receive an unambiguous indication, recognise the scenario and diagnose the required response without relying on the failed initiating function.
Available Response Time
The process safety time must allow detection, decision and action with a realistic margin for workload, access and abnormal operating conditions.
Competence and Assurance
Procedures, training, drills, alarm management, staffing and audit records must support the claimed human reliability and continued IPL performance.
Facilitated by Experienced Process Safety Personnel
LOPA studies are facilitated by experienced personnel with strong process safety and hazard-study experience across the energy sector, hydrogen plants, electrolysers, hydrogen refuelling stations, hazardous-waste incineration plants, aerospace facilities, tank farms, chemical processing lines, process tanks and effluent treatment plants.
This sector experience supports practical challenge of initiating events, maintenance and operating modes, safeguard independence, operator response, hydrogen hazards, toxic releases, fire and explosion scenarios, utilities and package-system interfaces.
Preparation and team composition
What Is Needed for an Effective LOPA Workshop
The quality of a LOPA depends on the quality of the underlying HAZOP scenarios and the availability of reliable technical and operational information. The study basis, risk criteria and data sources should be agreed before the workshop.
ExConform can support scenario screening, workshop planning, data preparation, attendee selection, facilitation, live recording and post-workshop reporting.
LOPA Study Deliverables
Deliverables are structured to provide a complete and reviewable decision basis for risk reduction, SIL identification, project assurance and subsequent functional safety activities.
Connected services and competence
Support Beyond the LOPA Workshop
LOPA often sits at the interface between Process Hazard Analysis, engineering design and functional safety. These related services help organisations carry the findings through to implementation and lifecycle assurance.
Industries We Support
Explore our experience across energy, hydrogen, aerospace, chemical processing, waste treatment, manufacturing and other hazardous operations.
View supported industriesFunctional Safety Support
Continue from SIL identification into Safety Requirements Specifications, lifecycle planning, verification, validation and functional safety management.
Explore functional safety supportFunctional Safety Course
Build the practical foundation personnel need to participate effectively in LOPA, SIL determination and functional safety lifecycle activities.
View the functional safety courseWhen to commission a LOPA
Typical Project and Operational Triggers
LOPA can support new designs, modifications and operating facilities whenever a hazardous scenario needs a more consistent and auditable assessment of safeguard adequacy.
After HAZOP
Assess scenarios escalated by the HAZOP team because of high consequence, uncertain safeguard adequacy or company risk-screening criteria.
SIL Identification
Determine whether a safety instrumented function is required and define the target risk reduction for the function.
Design Development
Compare alternative safeguards and establish whether proposed prevention or mitigation layers close the identified risk gap.
Management of Change
Reassess scenarios where process conditions, control logic, equipment, chemicals, occupancy or operating modes have changed.
Revalidation
Confirm that initiating-event assumptions, credited IPLs, testing arrangements and target criteria remain valid over time.
Incident Learning
Revisit scenarios where incidents, near misses, audit findings or industry learning challenge previous frequency or IPL assumptions.
Common questions
LOPA Study FAQs
What is the difference between HAZOP and LOPA?
HAZOP is a qualitative, guideword-based method used to identify deviations, causes, consequences and safeguards. LOPA takes selected cause-consequence scenarios and evaluates them semi-quantitatively using initiating frequencies, modifiers and credited IPL PFD values.
Does every HAZOP scenario need a LOPA?
No. Scenarios are normally screened using the organisation’s risk criteria. LOPA is most useful where the consequence is significant, safeguard adequacy is uncertain, a SIL target may be required, or company rules specify escalation.
Can any safeguard be credited as an IPL?
No. The safeguard must be effective for the scenario, sufficiently independent, dependable and auditable. Shared sensors, utilities, logic, final elements, human dependencies and common-cause failures must be challenged before credit is assigned.
Does LOPA prove that a SIF achieves its SIL?
No. LOPA identifies the required risk reduction or target SIL. Demonstrating that the SIF achieves and maintains that target requires specification, design verification, reliability calculation, validation, proof testing, management of change and other functional safety lifecycle activities.
Can LOPA be used for environmental or asset consequences?
Yes, provided the organisation has suitable consequence categories and tolerability criteria. The scenario definition should clearly identify whether the endpoint concerns people, environmental receptors, assets, business interruption or a combination of these.
Can a LOPA study be facilitated remotely?
Yes. Remote or hybrid LOPA can be effective when the HAZOP scenarios and supporting documents are mature, the calculation basis is agreed, the team can review worksheets clearly and sessions are planned to maintain concentration and challenge.
Need a LOPA or SIL Identification Study?
We can support scenario screening, data preparation, multidisciplinary workshop facilitation, IPL assessment, ALARP review, SIL target identification, action prioritisation and complete reporting for new projects, modifications and operating facilities.