Layer of Protection Analysis LOPA

Steps to determine the maximum allowable PFDj,vg for a SIF using LOPA methodology 

Step 1 - Complete the LOPA without taking any credit for the SIF. First, determine the initiating events from HAZOP/What-if/EMEA study. Next, evaluate frequencies of all initiating events from company database and industry experience. Then, determine the probability that each IPL will function successfully from an industrial database. PFO yg of some typical protection layers are (CCPS, 2000) BPCS control loop = 0.10 Operator s response to alarm = 0.10 Rehef safety valve = 0.01 to 0.001 and vessel failure probability at maximum design pressure = 10 . Finally, compare the calculated risk with the tolerable risk target 

Step 2 - SIL Requirements. If the calculated risk is less than the tolerable risk target, the instrumented protection need not be classified with any SIL rating. Otherwise, back calculate the PFD yg necessary to achieve the tolerable risk target. This represents the maximum allowable FFD yg for SIL rating 

Step 3 - Selection of SIF SIF of the proposed layer should be chosen for the necessary PFDavg shortfall. The output from the SIL architecture is verified for correctness and consistency with respect to the products and standards provided as input 

Step 4 - Repeat the Analysis Repeat steps 1 to 3 using the revised PFDa, g value of the proposed instrumented modification, to recalculate the overall incident frequency meeting the risk target 

---

Layer of protection analysis (LOPA) is a simplified form of event tree analysis. Instead of analyzing all accident scenarios, LOPA selects a few specific scenarios as representative, or boundary, cases. LOPA uses order-of-magnitLide estimates, rather than specific data, for the frequency of initiating events and for the probability the various layers of protection will fail on demand. In many cases, the simplified results of a LOPA provide sufficient input for deciding whether additional protection is necessary to reduce the likelihood of a given accident type. LOPAs typically require only a small fraction of the effort required for detailed event tree or fault tree analysis. 

Risk is the product of the probability of a release, thepjpbability of exposure, and the consequences of the exposure. Risk is usually described graphically, as shown in Figure 11-15. All companies decide their levels of acceptable risk and unacceptable risk. The actual risk of a process or plant is usually determined using quantitative risk analysis (QRA) or a layer of protection analysis (LOPA). Other methods are sometimes used however, ORA and LOPA are the methods that are most commonly used. In both methods the frequency of the release is determined using a combination of event trees, fault trees, or an appropriate adaptation. 

Layer-of-protection analysis (LOPA) A method, based on event tree analysis, of evaluating the effectiveness of independent protection layers in reducing the likelihood or severity of an undesired event. 

Layers-of-protection analysis (LOPA) is a semiquantitative methodology for analyzing and assessing risk. It is typically applied after a qualitative hazards analysis has been completed, which provides the LOPA team with a listing of hazard scenarios with associated safeguards for consideration. LOPA uses simplified methods to characterize the process risk based on the frequency of occurrence and consequence severity of potential hazard scenarios. The process risk is compared to the owner/operator risk criteria. When the process risk exceeds the risk criteria, protection layers are identified that reduce the process risk to the risk criteria. 

Many methods have been developed that are suitable for assessing risks associated with the operation of facilities involving chemical reactivity hazards. The more commonly used methods are summarized in Table 4.9. They differ in their applicability, level of effort, and how systematic they are in identifying accident scenarios. All of the methods except layer of protection analysis (LOPA) may be applied qualitatively, and all except checklist reviews may be performed in at least a semiquantitative manner. CCPS (1992a) is a basic source of information on each of these methods. 

Fault tree analysis (FTA) and event tree analysis (ETA) are the methods most commonly applied quantitatively. Since they only address the likelihood of undesired events, these methods are often combined with consequence severity calculations in a quantitative risk analysis, as described by CCPS (1999b). Layer of protection analysis (LOPA) uses a semiquantitative, order-of-magnitude approach. It is documented with worked examples in CCPS (2001b). 

Layer of Protection Analysis (LOPA) Scenario- based Order-of- magnitude By preidentified scenario Processes likely to require independent protection layers, such as safety instrumented systems, to meet predefined risk criteria Dependent on comprehensiveness of scenario list identified by other method(s) Higher... 

Once the precautions that are needed to control exposures are determined, the next step is to compare the level of controls needed against what controls are already in place. There frequently are multiple control strategies that will minimize the potential for exposure. The determination of which control strategy is the best to use is determined by the hierarchy of control principle. Our particular approach to managing risk is to use this hierarchy to evaluate possible risk management approaches for a specific project in conjunction with a modified layer of protection analysis (LOPA) approach.5... 

Addition of layer of protection analysis (LOPA) in PHA to determine the safety integrity level (SIL) gap for safety instrumented systems (SIS)... 

First, the importance of learning lessons from past process safety incidents is highlighted in Section 3.2. The subsequent section presents preliminary hazard review procedure, risk matrix, what-if method, plot plan and layout review, pressure relief system review and fire safety design aspects. Section 3.4 presents PHA techniques and procedures hazards and operability analysis (HAZOP), failure modes and effects analysis (FMEA), instrumented protective system (IPS) design, fault trees, event trees, layer of protection analysis (LOPA) and finally SIS life eyele. The importanee of revision of PSI is highlighted in Seetion 3.5. 

Layer of protection analysis (LOPA) Semi-quantitative... 

FIGURE L.1 Example of Layers of Protection Analysis (LOPA) Worksheet. (Worksheet Example courtesy of Dyadem.)... 

Implementation of one or more Safety Instrumented Functions. A SIS is composed of any combination of sensor(s), logic solver(s), and final elements). A SIS usually has a number of safety functions with different safety integrity levels (SIL) so it is best to avoid describing it by a single SIL. See also Layers of Protection Analysis (LOPA) Safety Integrity Level (SIL). 

The level of overall availability for a system component is calculated as 1 minus the sum of the average probability of dangerous failure on demand. SIL-1 availability of 90-99 percent SIL-2 availability of 99-99.9 percent SIL-3 availability of 99.9-99.99 percent. See also Layers of Protection Analysis (LOPA) Safety Instrumented Function (SIF) Safety Instrumented System (SIS). 

The CSB recommended that risks identified during PHA s and incidents should be evaluated, prioritized and promptly miti ted via corrective actions. Furthermore the CSB recommended the use of Layers of Protection Analysis (LOPA) for high-risk concerns to reduce the likelihood of a catastrophic event. 

NOTE - Layer of protection analysis (LOPA) is often implemented as an order-of-magnitude assessment. Consequently, it is typical for the purpose of the LOPA calculation to assume a rounded off risk reduction factor of 10 for an operator action IPL implemented in the BPCS layer when it has met the other criteria discussed in this Annex and in Annex F. 

---