Machine Risk Assessment Using LOPA: Guarding, Light Curtains, and Safety Relays as IPLs

LOPA begins by isolating one hazardous scenario—such as a worker entering a press die area while the ram is descending—and estimating its base frequency (e.g., 1/year from HAZOP). Then, every safeguard—guard door interlock, light curtain, emergency stop—is assessed for independence: it must operate without relying on other layers, human action, or the basic process control system (BPCS). Only those meeting strict criteria (e.g., certified hardware, documented proof testing, no common cause vulnerabilities) qualify as IPLs.

Each qualified IPL is assigned a Probability of Failure on Demand (PFDavg) based on its architecture (e.g., 1oo2 vs. 2oo3), diagnostics coverage, and field reliability data—not marketing claims. For instance, a safety relay with 90% diagnostic coverage and MTTFd = 120 years yields PFDavg ≈ 1.2×10⁻³ (SIL 2), but only if proof-tested every 12 months. The total risk reduction is multiplicative: two SIL 2 IPLs provide ~10⁶ reduction—not additive.

Advanced LOPA practice integrates common cause failure (CCF) analysis per IEC 61508-6 Annex D, applies demand-rate correction for high-frequency scenarios (e.g., packaging line photoeyes), and cross-validates IPL performance using FMEDA (Failure Modes Effects and Diagnostic Analysis) reports from certified vendors. It also accounts for systematic weaknesses—like identical firmware versions across redundant sensors—that can nullify apparent diversity. Ultimately, LOPA success hinges on traceability: every PFDavg value must link to a verifiable test procedure, calibration record, or certified component certificate.