Skip to main content
    QHSEtech
    Updated
    All glossary terms
    Content date: · No individual check logged· AI use

    LOPALayer of Protection Analysis

    Definition

    Layer of Protection Analysis — an order-of-magnitude method that tests whether independent protection layers make a hazard scenario tolerable.

    Editorial definition: The QHSE Standard, updated 3 October 2026 · https://qhsetech.com/glossary/lopa

    What IChemE and OSHA say about layer of protection analysis

    Layer of protection analysis, LOPA, is described in IChemE's Loss Prevention Bulletin 265 (February 2019) as a simplified, numerical way of assessing risk. It works to an order of magnitude, with figures such as 0.1, 0.01 or 10 to the minus 3 per year, not precise values. The bulletin says CCPS, the process safety body of AIChE, published the technique in 2001, that it works from qualitative studies such as HAZOP, and that its aim is to reduce risk using independent protection layers. Its purpose is to decide whether a scenario has enough safeguards. It is designed so that general technical staff, such as process engineers without a process safety specialism, can contribute, and applied properly it gives a consistent basis for judging similar situations within a company.

    An IChemE course description adds the uses: assigning tolerable frequencies to hazardous events, deciding how many independent protection layers a scenario needs, understanding what a layer must meet to be accepted as one, and deciding whether a process needs a safety instrumented system and what safety integrity level it must reach. The bulletin also lists limits. LOPA looks at a single cause and consequence pair and cannot treat common cause failure mathematically. The AIChE book, it says, warns that LOPA may not suit events with very high consequences. A scenario with many initiating events may suit fault tree analysis better. The bulletin reports mistakes seen in reviews, including conditional modifiers for exposure time that underestimate risk.

    OSHA's 29 CFR 1910.119(e) does not name LOPA. It lists what-if, checklist, what-if/checklist, HAZOP, FMEA, fault tree analysis and an appropriate equivalent methodology for a process hazard analysis. Whether a company's criteria, data and layer rules suit a given process is for the company and its regulator. This is general information, not legal or engineering advice, and CCPS text is not reproduced.

    Sources opened :

    What a LOPA record holds in software

    • The scenario reference and the study that raised it, such as a HAZOP worksheet and its revision, so a changed study entry can be traced.
    • The consequence and its severity category, taken from the organisation's own scheme.
    • The initiating event and its frequency, with the source of the figure.
    • Each protection layer, with the reason it is treated as independent and its probability of failure on demand.
    • Any conditional modifier, with its justification and the data behind it.
    • The tolerable frequency target and where it comes from, with the version of the criteria.
    • The result, the gap if there is one, the action raised, its owner and the re-evaluation.
    • The assumptions made and the people who reviewed the sheet.

    LOPA, HAZOP, SIL and the risk matrix

    A HAZOP finds scenarios and LOPA tests the safeguards for one of them. SIL is the integrity level required of a safety instrumented function, and the IChemE course description lists deciding the required SIL among the uses of LOPA. A risk matrix places a scenario in a category by judgement. LOPA works with order-of-magnitude frequencies, so each figure needs a stated source. The bulletin's concern about mistakes in practice applies to every input.

    A hypothetical example: a storage tank overfill

    The scenario below is invented and describes no real site. Its figures are made up for the arithmetic and are not data. A HAZOP raised the scenario of an overfilled storage tank. The sheet records the consequence, an initiating event of level control failure at 0.1 per year, and one layer: a high-level alarm with an operator response, taken at the probability of failure on demand of 0.1. The mitigated frequency is 0.1 times 0.1, which is 0.01 per year. The company's target for this consequence, invented here, is 0.0001 per year, so the gap is a factor of 100. The action is an independent high-high trip with the probability of failure on demand of 0.01, which would bring the result to the target.

    At review, the reviewer finds that the proposed trip would use the same level transmitter as the alarm. A shared device is a shared cause of failure, so the trip is not credited as independent and the result still shows the gap. The action is changed to a separate sensor, the sheet is re-evaluated, and the reasoning for independence is recorded in the layer's field with the reviewer's name and the date.

    Common misunderstandings about LOPA

    • LOPA does not replace the qualitative study. It depends on the scenarios that study identified, and a scenario nobody raised is never analysed.
    • Order-of-magnitude figures are not precise. Quoting a result to several digits suggests an accuracy the method does not have.
    • A layer drawn on a diagram does not count by being there. It counts only if it meets the method's rules for an independent protection layer, and independence needs evidence.
    • One sheet covers one cause and consequence pair. A scenario with several initiating events needs several sheets or another technique.
    • A LOPA result is not an acceptance decision. The target comes from the organisation's criteria, which should be recorded with their version.
    • Software that calculates the result does not make the inputs correct. The frequency, probability and modifier figures still need sources.

    How LOPA relates to other glossary terms

    LOPA follows a qualitative study and feeds decisions about safeguards.

    • HAZOP: a qualitative study whose recorded scenarios LOPA can take as its starting point.
    • HIRA: the wider hazard identification and risk assessment from which scenarios for analysis are drawn.
    • Bow-tie analysis: shows threats, consequences and barriers as a diagram, while LOPA tests the barriers with frequencies.
    • PHA: the overall hazard analysis in which a LOPA is one possible follow-up step.

    Records and evidence that usually exist for a LOPA

    • The worksheet for each scenario, with its source study and revision.
    • The data sources for initiating frequencies and probabilities of failure on demand, with their dates.
    • The criteria document, its version and who approved it.
    • Test and maintenance records for each layer that is credited.
    • The action log and the re-evaluation after each action.
    • The review record showing who checked independence.
    • The reviewer's notes on any conditional modifier used.

    What a software tool needs to capture for LOPA

    • Scenario sheets linked to the source study, so a changed HAZOP entry shows which sheets are affected.
    • A library of frequencies and probabilities that records the source and revision of every figure.
    • A field for the independence reasoning of each layer, not only a number.
    • Arithmetic that shows its inputs, so a reviewer can check the result.
    • The version of the criteria used, kept with each result.
    • Test and maintenance dates for each credited layer, so an overdue test shows against the result.
    • Gap actions tracked to a re-evaluation, with an export for an auditor.

    Catalog profiles documenting bow-tie and barrier management

    This list applies the barrier-management rule, and a listed product has not been shown to calculate a LOPA or to hold independence reasoning. Ask for a worked scenario.

    Same rule for every product: tagged “Barrier Management”, “Risk Assessment”, “Risk Management” or “Process Safety”, with a sourced bowtie or barrier management capability in its record, or one the vendor stated to us, labelled as vendor-stated. Documented and conditional capabilities qualify; check the linked scope before treating a module as included.

    Ordered by how closely our sources document this process, not by quality. Sponsored placements are labelled. How lists are ordered

    All 10 matching profiles are shown. Documentation review, not hands-on testing or a claim of compliance.

    Related software

    Frequently asked questions

    Is LOPA the same as a HAZOP?

    No. A HAZOP is a qualitative study that finds scenarios. An IChemE bulletin describes LOPA as building on studies such as HAZOP and using independent protection layers to test whether the safeguards for a scenario are sufficient.

    Does LOPA give an exact risk figure?

    No. It is an order-of-magnitude method. The bulletin warns that conservative figures accumulate and that exposure-time modifiers have been used in ways that underestimate risk.

    When might LOPA not be enough?

    The bulletin notes that it treats one cause and consequence pair and cannot handle common cause failure mathematically, where it names fault tree analysis, and that it may not suit very high consequence events, which may call for techniques nearer to full quantitative risk assessment.

    More safety terms

    Related guides