What is LOPA?

 LOPA = Layer of Protection Analysis

 LOPA is a semi-quantitative methodology that can be used to
identify safeguards that meet the independent protection layer
(IPL) criteria
 LOPA provides specific criteria and restrictions for the evaluation
of IPLs
 LOPA is limited to a single cause-consequence pair as a
scenario
Layer of Protection analysis (LOPA) is a simplified quantitative tool for analyzing and assessing
risk. LOPA was developed by user organizations during the 1990s as a streamlined risk assessment
tool, using conservative rules and order of magnitude estimates of frequency probability and
consequence severity. When the method was shown to be an efficient means to access risk, several
company published papers describing the driving forces behind their efforts to develop the method,
their experience of LOPA and examples of their use. In particular, the papers and discussions
amount the attendees at the Center for Chemical Process Safety (CCPS) international conference
and workshop on risk analysis in Process safety in 1997 brought agreement that a book describing
the LOPA method should be developed. This led to the publication of the concept book: Layer of
Protection Analysis: simplified Process Risk Assessment (CCPS, LOPA) in 2001.

LOPA has grown greatly in popularity and usefulness since the publication of CCPS LOPA (2001) on
the subject. Guidelines for Initiating Events and Independent Layers of Protection build on LOPA by:

 Providing additional examples of initiating events (IE) and

independent protection layers (IPLs)
 Provides more guidance for determining the value of each
prospective initiating event frequency (IEF and IPL probibility of
failure on demand (PFD)
 Proving more information on the overall management systems as
well as other considerations specific to a particular IE or IPL,
which are needed to support the use of the values provided in
this database.

Basic LOPA Steps

1. Identify the consequence to screen the scenario
2. Select an accident scenario
3. Identify the initiating event & determine the initiating event frequency
4. Identify the IPLs & estimate Probability of Failure on Demand (PFD)
 5. Estimate the risk, determine the frequency of the mitigated
consequence by mathematically combining the initiating event
frequency and IPL PFDs
6. Evaluate the risk and see if additional IPL is needed

LOPA Components
Initiating Events
The minimum combination of failures or errors necessary to start the propagation of an incident
sequence.

See Initiating Events

Independent Layer of Protection
An independent protection layer (IPL) is a device, system, or action that is capable of preventing a
scenario from proceeding to its undesired consequence independent of the initiating event or the
action of any other layer of protection associated with the scenario.

See Independent Protection Layers

Conditional Modifier
 Probabilistic condition that is not intertwined with the scenario
itself
 Probabilities generally associated with the post-release part of an
incident sequence.
Learn about Conditional Modifiers
Enabling Conditions
 Enabling conditions are situations which must occur
simultaneous with a given initiating event to allow the specific
cause for a scenario to propagate to a consequence of interest.
 Consists of an operation or condition that does not directly cause
the scenario, but that must be present or active in order for the
scenario to proceed to a loss event
 Not all LOPA have enabling conditions
Learn about Enabling Conditions
Note: Not every LOPA have enabling condition and conditional Modifiers

CCPS LOPA Initiating Events

You can view the list of LOPA Initiating Events below. If you'd like to see the details, you'll need to
log in as a CCPS member. Learn more about corporate membership.
1. Above ground piping: leak (pipe size ≤ 150 mm, 6 in)
 2. Aboveground piping in typical service: full breach failure (pipe
size > 150 mm, 6 in)
3. Aboveground piping: full breach failure (pipe size ≤ 150 mm, 6 in)
4. Aboveground piping: leak (pipe size >150 mm, 6 in)
5. Atmospheric tank: catastrophic failure
6. Atmospheric tank: continuous 10 mm diameter leak
7. BPCS control loop failure
8. Complete primary pump seal failure
9. Failure of double check valves in series
10. Fire-resistant insulation and cladding on vessel
11. Hose failure, leak and rupture
12. Human error during a routine task that is performed >=once per
week
13. Human error during a task that is performed < once per month
14. Human error during a task that is performed between once per
month and once per week
15. Localized loss of power - Single circuit loss of power
16. Premature opening of spring-loaded relief valve
17. Pressure regulator failure
18. Pressure vessel: catastrophic failure
19. Pump seal leak
20. Pump, compressor, fan, or blower failure
21. Screw conveyor failure
22. Screw conveyor overheating of materials
23. Single check valve failure
24. Single circuit loss of power
25. Spurious operation of SCAI

CCPS LOPA Independent Protection

Layers
You can view the list of LOPA IPS below. If you'd like to see the details, you'll need to log in as a
CCPS member. Learn more about corporate membership.

1. Adjustable Movement-Limiting Device

2. Automatic Explosion Suppression System for Process Equipment
3. Automatic Fire Suppression System (within process equipment)
4. Automatic Fire Suppression System for a Room
5. Automatic Fire Suppression System for Local Application
6. Buckling Pin Isolation Valve (BPIV)
7. Buckling Pin Relief Valve
8. Captive Key/Lock System
9. Check Valve
10. Conservation Vacuum and/or Pressure Relief Vent
11. Continuous Pilot
12. Continuous Ventilation with Automated Performance Monitoring
13. Continuous Ventilation without Automated Performance Monitoring
14. Dikes, Berms, and Bunds
15. Drainage to Dikes, Berms, and Bunds with Remote Impoundment
16. Dual Spring-Operated Pressure Relief Valves
17. Emergency Ventilation Initiated by Safety Controls, Alarms, and Interlocks (SCAI)
18. End-of-Line Deflagration Arrestor
19. Excess Flow Valve
20. Explosion Isolation Valve
21. Explosion Panels on Process Equipment
22. Fire-Resistant Insulation and Cladding on Vessel
23. Frangible Roof on Flat-Bottom Tank
24. Gas Balance/Adjustable Set Pressure Surge Relief Valve
25. Human Response to an Abnormal Condition
26. Human Response to an Abnormal Condition with Multiple Indicators…
27. In-Line Deflagration Arrestor
28. In-Line Stable Detonation Arrester
29. In-Line Unstable Detonation Arrester
30. Line Containing a Fluid with the Potential to Freeze
31. Mechanical Overspeed Trip on a Turbine
32. Mechanically Activated Emergency Shutdown/Isolation Device
33. Multiple Mechanical Pump Seal System with Seal Failure Detection and Response
34. Overflow Line Containing a Passive Fluid or with a Rupture Disk
35. Overflow Line with no Impediment to Flow
36. Permanent Mechanical Stop that Limits Travel
37. Personal Protective Equipment (PPE)
38. Pilot-Operated Pressure Relief Valve
39. Pipeline Surge Dampening Vessel
40. Pressure Reducing Regulator
41. Restrictive Flow Orifice
42. Rupture Disk
43. Safety Control Loop
44. Safety Interlock
45. SIS Loop
46. Spring-Operated Pressure Relief Valve
47. Spring-Operated Pressure Relief Valve with Rupture Disk
48. Vacuum Breaker
49. Vent Panels on Enclosures

Conditional Modifiers
Click on any conditional modifier title to see a full description. Learn about when to use and when
not to use conditional modifiers.
List of Conditional Modifiers:

 Probability of a hazardous atmosphere

 Probability of ignition inside process equipment
 Probability of ignition outside process equipment
 Probability of uncontrolled reaction initiation
 Probability of Dust explosion
 Probability of vessel rupture explosion
 Probability of vapor cloud explosion
 Probability of deflagration to detonation transition
 Probability of personnel presence
 Probability of injury or fatality
 Probability of equipment damage or other financial impact
Appendix A: Simultaneous failure and “double jeopardy”
 Double jeopardy
 Revealed vs un-revealed failures
 Quantifying double jeopardy
 When the consideration of the Simultaneous failures is valid
Appendix B: Peak Risk Concepts

Time at Risk Enabling conditions:

 Seasonal Risk
 Process State Risk
 Campaigning Enabling Conditions
 Appendix C: Example Rule set for LOPA Enabling conditions