LOPA (Layer of Protection Analysis) Quantitative Thresholds and SIL Assignment

Industry Applications

Refineries, chemical plants, LNG terminals, pharmaceutical manufacturing

Key Standards

IEC 61511, ISA 84.00.01, CCPS Guidelines

Typical Scale

Applied per scenario — 5–50 scenarios per unit; 1–3 hours per LOPA study

Regulatory Drivers

OSHA 29 CFR 1910.119, EPA 40 CFR Part 68, UK COMAH

⚠️ Why It Matters

1

Inadequate SIL assignment

↓

2

Under-designed safety instrumented function (SIF)

↓

3

Failure to mitigate credible high-consequence scenarios

↓

4

Regulatory noncompliance (e.g., OSHA PSM, EPA RMP)

↓

5

Unmitigated escalation to major process safety events (fire, toxic release, explosion)

📘 Definition

Layer of Protection Analysis (LOPA) is a semi-quantitative risk assessment technique used to evaluate the adequacy of existing or proposed Independent Protection Layers (IPLs) and assign a required Safety Integrity Level (SIL) to instrumented safety functions. It bridges qualitative hazard analysis (e.g., HAZOP) and quantitative reliability engineering by estimating initiating event frequency, consequence severity, and IPL effectiveness using order-of-magnitude ranges. SIL assignment is derived from target risk reduction requirements aligned with tolerable risk criteria defined in standards such as IEC 61511.

🎨 Concept Diagram

AI-generated illustration for visual understanding

💡 Engineering Insight

LOPA is not a reliability calculator—it’s a disciplined *risk decision gate*. Over-crediting IPLs (e.g., treating operator response as creditable without verifying response time < 5 min and error probability < 0.1) is the most common cause of under-assigned SILs. Always trace IPL creditability to documented procedures, training records, and human factors validation—not just 'it’s in the SOP'.

📖 Detailed Explanation

LOPA begins by isolating a single hazardous scenario—such as overpressure in a reactor due to cooling water failure—and estimating how often that initiating event might occur. It then applies conservative, order-of-magnitude ranges (e.g., 'rare' = 1E−4 to 1E−3/yr) rather than precise probabilities, making it more robust and less data-hungry than full QRA.

The core of LOPA lies in identifying Independent Protection Layers (IPLs): safeguards that are truly independent in design, function, and failure mode from both the initiating event and each other. A pressure relief valve is only creditable if it’s mechanically isolated, has no shared power or instrumentation, and its failure mode doesn’t propagate to the control system. Each IPL’s PFD must be justified—not assumed—and documented with evidence (e.g., vendor SIL certificates, field failure data).

Advanced LOPA practice integrates uncertainty explicitly: using bounding PFD values (e.g., PFDmin/PFDmax), applying conservatism factors for common cause failures (e.g., β-factor models), and performing sensitivity analysis on key assumptions (e.g., operator response time). Modern practice also links LOPA outcomes directly to SIS lifecycle activities—including diagnostic coverage targets, hardware fault tolerance requirements (e.g., HFT ≥ 1 for SIL 2), and systematic capability assessments per IEC 61511 Clause 8.2.1.

🔄 Engineering Workflow

Step 1

Step 1: Identify hazardous scenario and initiating event from HAZOP/PHA output

→

Step 2

Step 2: Quantify initiating event frequency using historical data, databases (e.g., CCPS, exida), or expert judgment

→

Step 3

Step 3: Evaluate consequence severity and assign tolerable risk criteria (TRC) per corporate or regulatory policy

→

Step 4

Step 4: Identify and validate Independent Protection Layers (IPLs) — verify independence, reliability, audibility, and functionality

→

Step 5

Step 5: Calculate residual risk and required risk reduction factor (RRF); assign SIL using IEC 61511 Table A.2 or company matrix

→

Step 6

Step 6: Specify SIF architecture, diagnostics, proof test interval, and validation methods (e.g., FMEDA, PFD calculation)

→

Step 7

Step 7: Document LOPA basis, assumptions, IPL justification, and SIL verification plan in Safety Requirements Specification (SRS)

📋 Decision Guide

Rock/Field Condition	Recommended Design Action
IEF = 0.01/yr, TRC = 1E−4/yr, no creditable IPLs exist	Assign SIL 2 SIF; select redundant architecture (e.g., 1oo2HFT or 2oo3) with proof test interval ≤ 4 years
IEF = 0.1/yr, TRC = 1E−3/yr, one creditable IPL (PFD = 0.01) already in place	Remaining RRF needed = 10 → SIL 1 SIF sufficient; single-channel logic solver with periodic proof testing acceptable
IEF = 1E−2/yr, TRC = 1E−5/yr, two independent IPLs (PFD = 0.1 each) already exist	Residual risk = 1E−4/yr — still above TRC → add SIL 3 SIF (RRF ≥ 1,000) or strengthen IPLs (e.g., reduce PFD to ≤ 0.01)

📊 Key Properties & Parameters

Initiating Event Frequency (IEF)

1E−4 to 1E−1 /yr

Estimated frequency per year at which a specific hazardous initiating event (e.g., valve failure, controller fault) occurs.

⚡ Engineering Impact:

Drives minimum required risk reduction and directly determines SIL target (e.g., IEF = 0.1/yr → SIL 2 often required for Tolerable Risk = 1E−3/yr)

Conditional Probability of Failure on Demand (PFD)

1E−2 to 1E−4 (for SIL 1–SIL 3)

Probability that an IPL fails to perform its intended safety function when required, expressed as a dimensionless value.

⚡ Engineering Impact:

Determines whether a proposed IPL qualifies as creditable; PFD > 1E−2 invalidates IPL credit per IEC 61511 Annex F

Tolerable Risk Criteria (TRC)

1E−3 to 1E−4 fatalities/year for off-site consequences

Maximum acceptable frequency of a specific consequence (e.g., fatality, major environmental release), typically set by company policy or regulatory requirement.

⚡ Engineering Impact:

Sets the risk reduction factor (RRF) threshold that defines SIL: RRF = IEF / TRC

Risk Reduction Factor (RRF)

10–100 (SIL 1), 100–1,000 (SIL 2), 1,000–10,000 (SIL 3)

Ratio of unmitigated risk to tolerable risk; equal to the inverse of required PFD for a SIF.

⚡ Engineering Impact:

Directly maps to SIL: RRF ≥ 100 → SIL 2; RRF ≥ 1,000 → SIL 3 — dictates hardware architecture (e.g., 1oo2 vs. 2oo3 voting)

📐 Key Formulas

Risk Reduction Factor (RRF)

RRF = IEF / (TRC × ∏PFD_IPL)

Calculates total risk reduction provided by all IPLs; used to determine if additional SIF SIL is required.

Variables:

Symbol	Name	Unit	Description
RRF	Risk Reduction Factor		Total risk reduction provided by all Independent Protection Layers (IPLs)
IEF	Initiating Event Frequency	1/year	Frequency of the initiating event before IPLs are applied
TRC	Test and Repair Cycle	hours	Time interval between testing and repair of IPLs
PFD_IPL	Probability of Failure on Demand for IPL		Probability that an Independent Protection Layer fails to act when required

Typical Ranges:

Refinery hydrocarbon release

10 – 10,000

Ammonia refrigeration system

100 – 5,000

⚠️ RRF must exceed 10× for SIL 1, 100× for SIL 2, 1,000× for SIL 3 per IEC 61511 Table A.2

Required PFD for SIF

PFD_required = 1 / RRF_remaining

Minimum average probability of failure on demand for the safety instrumented function to meet target risk reduction.

Variables:

Symbol	Name	Unit	Description
PFD_required	Required Probability of Failure on Demand	dimensionless	Minimum average probability of failure on demand for the safety instrumented function to meet target risk reduction
RRF_remaining	Remaining Risk Reduction Factor	dimensionless	Target risk reduction factor that must be achieved by the safety instrumented function

Typical Ranges:

SIL 1

1E−2 – 1E−1

SIL 2

1E−3 – 1E−2

SIL 3

1E−4 – 1E−3

⚠️ PFD must be verified via FMEDA or field data; certified components must meet target PFD at specified proof test interval

🏭 Engineering Example

ExxonMobil Baton Rouge Refinery — Alkylation Unit Upgrade (2019)

N/A (process facility; included for structural consistency)

IEF

0.05/yr (acid pump seal failure)

TRC

1E−4 fatalities/yr

Assigned SIL

SIL 2

Required RRF

500

Existing IPLs

Relief valve (PFD = 0.05), DCS alarm + operator action (PFD = 0.1)

SIF Architecture

2oo3 transmitters, 1oo2 logic solver, final element 1oo2 valves

🏗️ Applications

Design of emergency shutdown systems (ESD)
Verification of fire & gas detection coverage
Justification of manual intervention as IPL
SIL verification for legacy systems during MOC

📋 Real Project Case

Ammonia Refrigeration System HAZOP & LOPA Integration at Midwest Food Processing Plant

Retrofit of legacy ammonia chiller system serving 300k sq ft food processing facility

Challenge: Unplanned releases during maintenance due to undocumented isolation points and missing P&IDs

Read full case study →

Ethylene Oxide Sterilization Facility QRA and Bow-Tie Implementation Grain Elevator Dust Explosion Mitigation Using ASTM E1226-Based Risk Model Offshore LNG Transfer System Fault Tree Analysis and SIS Architecture Optimization

🎨 Technical Diagrams

📚 References

[1]

IEC 61511-1:2016 Functional safety — Safety instrumented systems for the process industry sector — Part 1: Framework, definitions, system, hardware and software requirements — International Electrotechnical Commission (IEC)

[2]

CCPS Guidelines for Initiating Event Frequency Determination — Center for Chemical Process Safety (AIChE)

[3]

Layer of Protection Analysis: Simplified Process Risk Assessment — CCPS / Wiley

🔗 Related Knowledge

SIL Verification Calculations per IEC 61511 N/A