🎓 Lesson 6
D4
LOPA Step-by-Step: From PHA to IPL Validation
LOPA is a structured method to check if your safety systems are strong enough to prevent serious accidents after identifying hazards.
🎯 Learning Objectives
- ✓ Explain the step-by-step LOPA workflow from PHA output to IPL validation
- ✓ Analyze a scenario’s initiating event frequency and conditional probabilities to calculate the final consequence frequency
- ✓ Validate whether a proposed safeguard qualifies as an Independent Protection Layer using CCPS IPL criteria
- ✓ Apply industry-standard risk tolerance criteria (e.g., 10⁻⁴ /yr) to determine if additional IPLs are required
- ✓ Design a compliant LOPA worksheet documenting cause-consequence logic, IPL justification, and risk reduction credits
📖 Why This Matters
In mining and blasting operations—where high-energy processes interact with geotechnical uncertainty—a single failure (e.g., misfired blast, over-pressurized detonation chamber, or misaligned initiation sequence) can trigger catastrophic consequences: flyrock injuries, structural collapse, or environmental release. LOPA ensures that safety-critical safeguards—like blast perimeter interlocks, seismic monitoring cutoffs, or automated charge verification—are not just present, but *independent*, *reliable*, and *adequately credited*. Without LOPA, teams risk over-relying on procedural controls or under-designing instrumented safety functions—both leading to unmanaged risk. This step prevents 'layer erosion'—where multiple non-independent layers are mistakenly counted as separate protections.
📘 Core Principles
LOPA builds on PHA outputs (e.g., HAZOP or What-If worksheets) by selecting high-risk scenarios—those with severe consequences (e.g., fatality, major equipment damage, or environmental harm) and credible initiating causes. It then quantifies the scenario’s base frequency (e.g., 1/year for misfire due to faulty wiring), applies modifiers (enablers like 'blasting crew present', conditional modifiers like 'no exclusion zone signage'), and calculates the unmitigated frequency. Each IPL must satisfy six CCPS criteria: independence (no shared cause with other layers), functionality (detects and responds to the specific scenario), reliability (proven PFDavg ≤ 0.1), auditability (testable), and survivability (remains operational during upset conditions). Only IPLs meeting all criteria receive credit—typically 1–2 orders of magnitude risk reduction (10× to 100×). LOPA concludes with a risk decision: accept, reduce (add IPL), or reject (redesign process).
📐 Scenario Frequency Calculation
LOPA computes the final scenario frequency (F_final) by multiplying the initiating event frequency (F_IE), enabler probability (P_E), conditional modifier (C), and the product of failure probabilities of all non-IPL safeguards—and then dividing by the cumulative risk reduction from validated IPLs. The core calculation determines whether F_final falls below the site-specific tolerable frequency (e.g., 1 × 10⁻⁴ /yr for fatality).
Final Scenario Frequency
F_final = F_IE × P_E × C × ∏(PFD_non-IPL) × ∏(PFD_IPL)Calculates the estimated annual frequency of a hazardous scenario after accounting for all safeguards—both credited IPLs and non-credited barriers.
Variables:
| Symbol | Name | Unit | Description |
|---|---|---|---|
| F_IE | Initiating Event Frequency | /year | Base frequency of the initiating cause (e.g., valve failure, human error) |
| P_E | Enabler Probability | dimensionless | Probability that enabling conditions exist (e.g., pump running, vessel pressurized) |
| C | Conditional Modifier | dimensionless | Probability that consequence severity is realized given the initiating event |
| PFD_IPL | Probability of Failure on Demand (IPL) | dimensionless | Likelihood that an IPL fails to act when required; typically 0.01–0.1 for SIL 1–2 systems |
Typical Ranges:
Human error IE (blasting crew): 1 × 10⁻² – 1 × 10⁻¹ /yr
Mechanical failure IE (detonator circuit): 1 × 10⁻³ – 1 × 10⁻² /yr
Validated IPL PFD: 0.01 – 0.1 (SIL 1–2)
💡 Worked Example
Problem: HAZOP identifies 'unintended blast initiation during personnel access' with F_IE = 0.1 /yr. Enabler: 'access door open' (P_E = 0.3). Conditional modifier C = 0.5 (due to poor lighting increasing error likelihood). Non-IPL procedural control has PFD = 0.5. One IPL—hardwired door interlock with SIL 1 certification—is validated (PFD_IPL = 0.1). Tolerable frequency = 1 × 10⁻⁴ /yr.
1.
Step 1: Compute unmitigated frequency = F_IE × P_E × C = 0.1 × 0.3 × 0.5 = 0.015 /yr
2.
Step 2: Apply non-IPL PFD: 0.015 × 0.5 = 0.0075 /yr (this layer does NOT qualify as IPL—no independence or testability)
3.
Step 3: Apply IPL credit: 0.0075 × 0.1 = 0.00075 /yr (i.e., 7.5 × 10⁻⁴ /yr)
4.
Step 4: Compare to tolerable frequency: 7.5 × 10⁻⁴ > 1 × 10⁻⁴ → risk is unacceptable; requires additional IPL (e.g., redundant RF-tagged personnel detection + automatic abort)
Answer:
The final scenario frequency is 7.5 × 10⁻⁴ /yr, which exceeds the tolerable limit of 1 × 10⁻⁴ /yr—requiring at least one additional IPL to achieve ≥10× further risk reduction.
🏗️ Real-World Application
At Newmont’s Boddington Mine (WA), LOPA was applied to the explosive magazine loading sequence after a near-miss involving incorrect ANFO density measurement. PHA revealed 'overcharged drum initiation' as a high-consequence scenario (potential BLEVE). LOPA quantified F_IE = 0.05/yr (calibration drift + manual entry error), P_E = 0.8 (shift-based fatigue), C = 0.6 (poor HMI alarm visibility). Two IPLs were validated: (1) automated density verification via inline gamma densitometer (PFD = 0.05), and (2) dual-channel weight verification with voting logic (PFD = 0.03). Combined IPL credit reduced frequency from 0.024/yr to 3.6 × 10⁻⁵/yr—below the 1 × 10⁻⁴ tolerable threshold. This justified continued operation without redesign, but triggered mandatory quarterly IPL functional testing per IEC 61511.