Layer of protection analysis (LOPA) is one of many methods for assessing a given scenario to determine if the risk is acceptable. It uses rigid rules to simplify and standardise the definitions of independent protection layers (IPLs) and initiating events (IEs). If these rules are followed, then the risk assessment will give an order-of-magnitude approximation of the risk of a given cause-consequence pair (scenario).

The six major steps of the LOPA process, as undertaken by Applus+, are as follows:
  1. Record all reference documentation, including hazards analysis documentation, pressure relief valve design and inspection reports, protection layer design documents, etc.
  2. Document the process deviation and hazard scenario under consideration by the team. It is important to focus the team on a specific hazard scenario, such as high pressure resulting in pipeline rupture.
  3. Identify all of the initiating causes for the process deviation and determine the frequency of each initiating cause. The initiating-cause frequencies should be based on industry-accepted and standards-compliant failure-rate data for each device, system, or human.
  4. Determine the consequence of the hazard scenario. This evaluation should include an examination of safety, environmental and economic losses. In certain countries, federal or local regulatory authorities establish requirements for safety and environmental protection. In contrast, economic-loss prevention is strictly a company decision and is not covered by any regulatory mandate.
  5. List the IPLs that can completely mitigate all listed initiating causes. The IPLs must meet the independence, specificity, dependability and auditability requirements. For each IPL, determine the ‘probability to fail on demand’ (PFD). The PFD is a measure of the risk reduction that can be obtained using the IPL.
  6. Provide specific implementable recommendations. Recommendations from the LOPA team must be considered options for implementation.



LOPA can be used at any point in the life cycle of any given project or process, but it is most cost effective when implemented during front-end loading when process flow diagrams are complete and the P&IDs are under development.
For existing processes, LOPA should be used during or after the HAZOP review or
revalidation. LOPA is typically applied after a qualitative hazards analysis has been completed, which provides the LOPA team with a list of hazard scenarios with associated-consequence descriptions and potential safeguards for consideration.
Some of the benefits derived from a layer of protection analysis are:
  • More consistent definition of protection layers. Information from LOPA helps an organisation decide which safeguards to focus on during operation, maintenance and related training
  • The identification of operations and practices that were previously thought to have appropriate safeguards, but for which the more detailed LOPA analysis indicates there are far more safeguards than necessary
  • Improved evaluation in process hazard analyses of which “listed” safeguards are “valid” safeguards 
  • Justifying when a safety instrumented system (SIS) is not needed (proper determination of the safety integrity level can usually show this)
  • Faster quantification of severe risk scenarios. LOPA requires less time than quantitative risk analysis (QRA)
  • Conformity with the common language used by risk reviewers around the world
  • A rational basis for managing layers of protection that may be taken out of service (such as bypass of a shutdown interlock). LOPA also provides clarity on what to pay attention to when an IPL is out of service for testing or repair

Applus+ uses first-party and third-party cookies for analytical purposes and to show you personalized advertising based on a profile drawn up based on your browsing habits (eg. visited websites). You can accept all cookies by pressing the "Accept" button or configure or reject their use. Consult our Cookies Policy for more information.

Cookie settings panel