LOPA vs. HAZOP vs. QRA: When to Use Each Method
LOPA, HAZOP, and QRA are three different safety analysis tools: HAZOP finds possible hazards, LOPA checks if safety layers are strong enough, and QRA calculates how likely and severe accidents really are.
⚠️ Why It Matters
📘 Definition
Layer of Protection Analysis (LOPA) is a semi-quantitative method used to evaluate the adequacy of independent protection layers (IPLs) against specific hazardous scenarios by estimating initiating event frequency and IPL failure probabilities. It bridges qualitative hazard identification (e.g., HAZOP) and fully quantitative risk assessment (QRA), assigning risk reduction factors (RRFs) to IPLs and verifying whether the residual risk meets tolerable risk criteria. LOPA is standardized in IEC 61511 and CCPS guidelines, requiring explicit definition of scenario causality, IPL independence, and verification of IPL effectiveness.
🎨 Concept Diagram
AI-generated illustration for visual understanding
💡 Engineering Insight
LOPA is not a substitute for engineering judgment — it is a consistency check. A 'passing' LOPA with SIL-2 SIS does not guarantee safety if the IPL’s response time exceeds process dynamics (e.g., runaway reaction time < 2 min), or if human IPLs rely on untrained personnel during night shift. Always validate IPL timing, diagnostics coverage, and human factors context — not just PFD numbers.
📖 Detailed Explanation
Next, each proposed IPL (e.g., pressure relief valve, high-pressure shutdown system, operator intervention) is rigorously assessed for independence: it must act without reliance on components or signals used by other IPLs, and its failure must not affect others. PFD is assigned using recognized reliability data, with conservative assumptions applied where uncertainty exists (e.g., using upper 90% confidence bound for PFD).
At advanced levels, LOPA integrates dynamic considerations: time-to-failure vs. time-to-intervention (TTI), common cause failures (CCF) via beta-factor or MGL models, and uncertainty propagation using Monte Carlo methods. Modern practice also links LOPA outcomes directly to SIS configuration (e.g., 1oo2 vs. 2oo3 architecture), proof test intervals, and diagnostic coverage requirements — making it a living input to functional safety lifecycle execution, not a static worksheet.
🔄 Engineering Workflow
📋 Decision Guide
| Rock/Field Condition | Recommended Design Action |
|---|---|
| Scenario with high consequence (e.g., toxic release >1 ton) but low initiating frequency (<1E−3/yr) and no existing IPLs | Perform LOPA to quantify required RRF; assign SIL-2 SIS + procedural IPL (e.g., operator response <10 min) with documented independence and testing. |
| HAZOP identified multiple credible scenarios sharing one common IPL (e.g., shared DCS alarm system) | Reject as invalid IPL; redesign to ensure true independence (e.g., separate hardwired SIS) or split scenarios and re-evaluate each separately. |
| PFD uncertainty exceeds ±1 order of magnitude (e.g., based on generic OREDA data without site-specific proof test records) | Treat as 'LOPA not valid'; escalate to QRA or require empirical reliability data before proceeding. |
📊 Key Properties & Parameters
Initiating Event Frequency (IEF)
1E−6 to 1E−1 /yr (e.g., 0.1/yr for common operator errors; 1E−6/yr for SIS hardware failures)Estimated frequency per year at which a specific hazardous initiating event (e.g., valve failure, human error) occurs.
Drives required Risk Reduction Factor (RRF) — lower IEF allows higher PFD for same target risk.
PFD (Probability of Failure on Demand)
1E−2 to 1E−4 (e.g., 0.01 for manual shutdown; 1E−4 for SIL-3 certified SIS)The likelihood that an Independent Protection Layer (e.g., SIS, relief valve) will fail to perform its required safety function when demanded.
Directly determines achievable RRF (RRF = 1/PFD); governs SIL assignment and verification testing intervals.
Risk Reduction Factor (RRF)
10 to 10,000 (corresponding to SIL 1–4 per IEC 61511)The factor by which an IPL reduces the frequency of a hazardous scenario (RRF = 1 / PFD).
Determines whether a proposed IPL satisfies the required risk reduction to achieve tolerable risk (e.g., RRF ≥ 100 needed if IEF = 0.1/yr and target = 1E−3/yr).
Tolerable Risk Target
1E−4 to 1E−6 fatalities/year (e.g., 1E−4/yr for site boundary offsite fatality per UK HSE guidelines)The maximum acceptable frequency of a specific consequence (e.g., fatality, major release) defined by corporate policy or regulation.
Sets the numerical threshold against which LOPA-calculated residual risk is compared — drives design decisions and IPL justification.
📐 Key Formulas
Residual Frequency
f_res = f_init × PFD₁ × PFD₂ × ... × PFDₙCalculates post-IPL frequency of a hazardous scenario
| Symbol | Name | Unit | Description |
|---|---|---|---|
| f_res | Residual Frequency | 1/year | Post-IPL frequency of a hazardous scenario |
| f_init | Initial Frequency | 1/year | Frequency of hazardous scenario before IPLs |
| PFD₁ | Probability of Failure on Demand for IPL 1 | dimensionless | Probability that the first independent protection layer fails when required |
| PFD₂ | Probability of Failure on Demand for IPL 2 | dimensionless | Probability that the second independent protection layer fails when required |
| PFDₙ | Probability of Failure on Demand for IPL n | dimensionless | Probability that the nth independent protection layer fails when required |
Required Risk Reduction Factor (RRF_req)
RRF_req = f_init / f_targetMinimum RRF needed from IPLs to meet tolerable risk
| Symbol | Name | Unit | Description |
|---|---|---|---|
| RRF_req | Required Risk Reduction Factor | Minimum RRF needed from IPLs to meet tolerable risk | |
| f_init | Initial Frequency of Hazardous Event | per year | Frequency of the hazardous event before implementation of IPLs |
| f_target | Target Frequency of Hazardous Event | per year | Maximum tolerable frequency of the hazardous event after implementation of IPLs |
🏭 Engineering Example
ExxonMobil Baton Rouge Refinery — Coker Fractionator Overpressure Scenario
N/A (process safety context)🏗️ Applications
- SIL assignment for safety instrumented systems
- Justification of mechanical IPLs (e.g., PSVs, dikes)
- ALARP demonstration for regulatory submissions (e.g., COMAH, OSHA PSM)
🔧 Try It: Interactive Calculator
📋 Real Project Case
Chemical Reactor Overpressure Mitigation at Midwest Petrochemical Plant
Retrofit of exothermic batch reactor system handling nitration chemistry