Skip to main content
    QHSEtech
    All templatesOil & Gas · 3 pages · Updated 20 October 2026

    Layer of Protection Analysis (LOPA) Worksheet Template

    PDF ExcelFree, no email

    Three-page worksheet for one LOPA scenario: scenario reference and linked PHA record, the initiating event with its frequency, source and date, enabling conditions and conditional modifiers, the independent protection layers claimed each with your own probability of failure on demand and the reasons it is independent, effective and auditable, nine calculation steps with the formula printed and your values written in, the tolerable frequency from your own criteria, the gap, recommendations with owner and due date, and sign-off. The form prints no typical value and no tolerable frequency, and it does not show that a layer qualifies. LOPA is a voluntary method: 29 CFR 1910.119(e) does not name it. The CCPS LOPA book and IEC 61511 are paid texts and are not reproduced.

    What's inside

    Page 1: the scenario, the initiating event and the probabilities around it

    1. Scenario: scenario reference and the linked PHA record (study, node, recommendation number), facility or unit with revision and date, who prepared it, the hazard scenario description with its consequence (one cause-consequence pair), and the severity category on your own scale with the criteria document it comes from
    2. Initiating event, frequency, source and date: the first event that starts the sequence, its frequency per year written by you, where the number came from and when, and who checked it
    3. Enabling conditions and conditional modifiers: two small tables for the probabilities you enter, each with its source or basis and why it applies and is not counted twice. A short box of terms from the CCPS glossary, paraphrased, sits under them

    Page 2: the protection layers and the arithmetic

    1. Independent protection layers claimed: five lines: the device, system or action and what it does for this scenario, its probability of failure on demand written by you, the source and date, why it is independent, how it is effective and auditable, and whether credit is taken. Under it, a list of layers considered and not credited, with the reason and what would make them creditable
    2. Calculation steps: nine steps with the printed formula, a column where you write each value and the result, and a column with an invented worked example. The form prints no typical value

    Page 3: tolerance, the gap and the actions

    1. Tolerable frequency, criterion and source: written by you, with the consequence endpoint, the criteria document and who approved it
    2. Gap and action: the gap ratio, the required reduction, options considered in order, and whether a safety instrumented function is proposed and how its target is set under your own procedure
    3. Recommendations, owner and due date: five lines with status and the date the resolution was recorded
    4. Review trigger and sign-off: when to review the scenario, the next review date, where the record is kept, and sign-off by operations, process engineering, HSE, maintenance and the site manager

    The section titles, the step numbers and the example numbers are ours, to change. The example numbers are invented and are not values to copy.

    What requires or shapes this record

    No source opened for this page requires a layer of protection analysis. The US process hazard analysis paragraph, 29 CFR 1910.119(e), lists What-If, Checklist, HAZOP, FMEA, Fault Tree Analysis and an appropriate equivalent methodology, does not name LOPA and does not use the words layer, probability or tolerable (eCFR text as of 16 October 2026, read 20 October 2026). HSE in Great Britain and CCOHS in Canada give general guidance on independence of protective systems and on risk assessment records; neither makes this method mandatory in the pages read. Your own procedure, a contract, a regulator or a company standard may ask for one, and that is for you to check. The CCPS glossary entries that were free to read define the terms, and the CCPS LOPA book and IEC 61511 are paid texts that were not read, so the form uses none of their values or criteria and does not claim to follow them. Law and standards differ by country and change. This is general information, not legal advice.

    • CCPS (Center for Chemical Process Safety, AIChE), Process Safety Glossary, free public entries read 20 October 2026

      The free glossary entries describe the terms this form uses. Layer of protection analysis analyses one incident scenario (cause-consequence pair) at a time, using predefined values for the initiating event frequency, the failure probabilities of independent protection layers and the consequence severity, and compares the scenario risk estimate with risk criteria to decide where more risk reduction or a more detailed analysis is needed; scenarios are identified elsewhere, typically in a HAZOP. A HAZOP/LOPA study evaluates the frequency, severity and layer effectiveness on an order-of-magnitude basis. An independent protection layer is a device, system or action able to prevent the scenario reaching the undesired consequence without being adversely affected by the initiating event or any other layer, and it meets the requirements when designed and managed to seven core attributes (independent, functional, integrity, reliable, validated-maintained-and-audited, access security, management of change). Further entries define a safeguard, an enabling condition (a condition or operating phase that is not a failure, error or layer, expressed as a probability), a conditional modifier (examples include probability of ignition and of personnel presence), probability of failure on demand, semi-quantitative analysis, risk tolerance criteria and ALARP. The CCPS LOPA book on initiating events and independent protection layers is paid and was not read, so no criteria or typical value from it is used; its text is not reproduced.

    • HSE (Great Britain), Control systems, COMAH technical measures, page dated 19 August 2025, read 20 October 2026

      HSE's page says protective systems should be sufficiently independent of the control system and of other protective systems, that where components, utilities, environment or management systems are shared the method of independence should be defined and common cause failures considered, and that failure of a non-safety control system that raises the demand on a safety related system should have been considered in the design. It says a low demand system, one called on not more than once a year, has its likelihood of failure expressed as a probability of failure on demand, while high demand and continuous systems use a failure rate per hour. For an operator acting on an alarm it says a figure is typically assumed in a well designed system and a better one may be achievable only where exceptional care has been taken over alarm management, instructions and training and the arrangements are monitored and reviewed (the page prints figures that this form does not copy). It says an alarm system including the operator becomes safety related, needing a suitable safety integrity level, when the claimed risk reduction passes the level it states, and that high integrity protective systems do not remove the need for a hierarchical approach such as inherent safety or for care over common mode failures. IEC 61508 assigns four safety integrity levels. The HSE functional safety page names IEC 61511 as the benchmark for the process industries; the IEC text is paid and is not reproduced.

    • 29 CFR 1910.119(e), Process hazard analysis (United States), eCFR text as of 16 October 2026, read 20 October 2026

      Paragraph (e) asks the employer to perform a process hazard analysis, appropriate to the complexity of the process, on covered processes (e)(1); to use one or more of What-If, Checklist, What-If/Checklist, HAZOP, FMEA, Fault Tree Analysis or an appropriate equivalent methodology (e)(2); to address, among other things, engineering and administrative controls, the consequences of their failure and a qualitative evaluation of the possible effects of failure of controls on employees (e)(3); to use a team with the stated expertise (e)(4); to address the team's findings promptly, document their resolution, keep a written schedule and tell affected people (e)(5); to update and revalidate at least every five years (e)(6); and to keep the analyses and the documented resolutions for the life of the process (e)(7). Layer of protection analysis is not named anywhere in the section, and the words layer, probability and tolerable do not appear in it. Whether a LOPA counts as an appropriate equivalent methodology is not stated there: ask the regulator or your counsel. This is a US rule for covered chemicals and processes; it is not a statement about any other country.

    • CCOHS (Canada), Hazard and Risk: Risk Assessment, fact sheet revised 12 March 2025, read 20 October 2026

      CCOHS describes semi-quantitative methods as assigning numerical values or scores to qualitative risk factors and using them to rank or prioritise risk, a middle ground between qualitative and quantitative assessment. It says to keep records that show the hazard review, the risks determined, the control measures put in place and the monitoring, that the level of record keeping depends on the level of risk, the legal requirements and any management system, and to check local requirements for how long to keep them. It says to review assessments regularly so that changes in the workplace have not introduced new hazards. This is general guidance, not a process safety rule.

    Each source checked on 20 October 2026. Not legal advice; check the text in force for your site.

    Field by field

    The worksheet records one scenario and prints no number that you could mistake for a rule: every frequency, probability, modifier and tolerable frequency is written by you with a source and a date. The earlier version of this file printed credits for three layers and a table of integrity levels; this version does not, because a printed value reads as permission. The section titles, the step numbers and the example figures are ours and can be changed.

    Scenario reference and linked PHA record
    Why: LOPA, as the CCPS glossary describes it, analyses one cause-consequence pair at a time, and the scenarios come from a hazard study such as a HAZOP. The link to the study record lets a reader see where the scenario came from, because the LOPA does not find scenarios itself.
    Common mistake: Putting several causes or several consequences on one sheet, so that a single product of failure probabilities is applied to sequences that are not the same.
    Facility or unit, revision and date
    Why: Frequencies, test results and criteria change. The revision and date show which assumptions the numbers belong to, and which sheet is current.
    Common mistake: Changing a value without a new revision, so that two printed copies disagree and nobody knows which one was approved.
    Hazard scenario description and consequence
    Why: States the cause, the loss event and the consequence in words before any number is written. The consequence decides which tolerable frequency applies in section 6.
    Common mistake: Describing only the loss event, such as 'release', and not the consequence that the criterion is written for.
    Severity category (your own scale, from your criteria document)
    Why: Kept from the earlier version of this file, which listed five categories. This form prints no scale, because an invented scale can be mistaken for a rule. The category is the one in your own criteria document.
    Common mistake: Using a category that does not exist in the criteria document used in section 6, so no tolerable frequency can be found for it.
    Initiating event, frequency, source and date
    Why: The CCPS glossary calls the initiating cause the first event in an incident sequence, the point where normal turns to abnormal. Its frequency is an input that you must source and date. The form gives none.
    Common mistake: A frequency with no source, or taken from a different service, plant or year than the one analysed.
    Enabling conditions
    Why: The CCPS glossary defines an enabling condition as a condition or operating phase that is not a failure, error or protection layer but must be present for the sequence to reach a loss event, expressed as a probability. Writing it apart from the layers shows where it was applied.
    Common mistake: Treating an enabling condition as a protection layer, or applying a time fraction that is not true in the operating mode in which the scenario can happen.
    Conditional modifiers
    Why: The glossary describes them as further probabilities used when the criterion is expressed as an impact such as a fatality instead of a loss event, with examples such as ignition and people being present. Each needs a basis you can show.
    Common mistake: Stacking modifiers that are not independent of each other, or applying one that the criterion already includes, so the result is lower than the facts support.
    Protection layer claimed: device, system or action
    Why: The glossary defines a protection layer as a device, system or human action. Naming what it does for this scenario stops a general safeguard being credited without a reason, and the glossary says a safeguard is not automatically an independent protection layer.
    Common mistake: Listing every safeguard from the hazard study as a layer.
    PFD (you enter it)
    Why: The glossary defines the probability of failure on demand as the probability that a system fails to perform its function when called on. The form prints no value, so that every credit has an author, a source and a date. HSE's control-systems page says the figure assumed for an operator acting on an alarm is a typical one in a well designed system, and that a better figure needs exceptional care in design, training and monitoring.
    Common mistake: Copying a number from a table or from another sheet without checking that this layer is built, tested and staffed as the number assumes.
    Independent: why
    Why: The glossary says an independent protection layer is not adversely affected by the initiating event or by any other layer on the scenario. HSE says protective systems should be sufficiently independent of control systems and other protective systems, and that where components, utilities, wiring routes or people are shared the method of independence is defined and common cause failures considered.
    Common mistake: Crediting an alarm and a trip that read the same transmitter, or a control loop whose failure is the initiating event.
    Effective and auditable
    Why: The glossary names seven attributes: independent, functional, integrity, reliable, validated-maintained-and-audited, access security and management of change. This column asks whether the layer acts in time for this scenario and how it is tested, maintained and evidenced. The detailed criteria are in the CCPS book, text not reproduced. HSE says an alarm system including the operator becomes safety related, and needs a suitable safety integrity level, when the claimed risk reduction passes the level its page states.
    Common mistake: Crediting a layer that nobody tests, that is bypassed in practice, or that depends on an operator who has no time to act.
    Layers considered and not credited, and why
    Why: A record of what was left out, and why, shows that credit was a decision. 'What would make it creditable' feeds the recommendations.
    Common mistake: Leaving it blank, so a reviewer cannot tell whether a safeguard was missed or judged and rejected.
    Calculation steps (you write each value and the result)
    Why: Writing each factor lets another person check the arithmetic. The multiplication printed in step 5 is our statement of what the glossary describes in words, and it is valid only if the layers are independent of the initiating event and of each other.
    Common mistake: Multiplying the failure probabilities of layers that share a component, which gives a result that is too low, or mixing a per-year frequency with a per-demand probability.
    Tolerable frequency, criterion and source (written by you)
    Why: The glossary defines risk tolerance criteria as a predetermined measure used to decide whether further effort to reduce risk is warranted. They are yours, so the form prints none. Write the figure, the endpoint it is for, the document, clause and revision and who approved it.
    Common mistake: Using a figure from an article or another company's criteria with no approval, or one written for a different consequence endpoint.
    Gap and action
    Why: The gap ratio is the mitigated frequency divided by the tolerable frequency, and the PFD needed from added layers is the reciprocal. HSE says even a high integrity instrumented system does not remove the need for a hierarchical approach, starting with inherent safety. The glossary describes ALARP as continuing to reduce risk until the sacrifice is grossly disproportionate to the gain, so where that principle applies, being below the tolerable frequency may not end the question.
    Common mistake: Closing the gap with a layer that is not independent of the existing ones, or going straight to an instrumented function without asking whether the hazard can be removed or reduced.
    Recommendations, owner and due date
    Why: 29 CFR 1910.119(e)(5), the US rule for covered processes, asks for a system to address findings promptly, document the resolution, keep a written schedule and tell affected people. An owner, due date, status and a recorded resolution make that traceable.
    Common mistake: Recommendations with no owner or date, closed without a note of what was done.
    Review trigger and sign-off
    Why: Credits are true only while the layers stay as described. The CCOHS fact sheet says to review assessments regularly and to check that changes have not introduced new hazards, and 29 CFR 1910.119(e)(6) asks for revalidation of a process hazard analysis at least every five years. The sign-off roles are kept from the earlier version of this file.
    Common mistake: Reviewing only at the five-year revalidation, so that a layer bypassed, changed or failing its test in between still earns credit.

    Worked example

    IllustrativeOne LOPA scenario with invented numbers, worked through the nine steps of the form (invented plant, criteria and people)

    SectionEntry
    1 ScenarioScenario S-014 (invented), from HAZOP record 22 (invented). Vessel V-101 (invented) overpressures after loss of cooling water and ruptures, releasing a flammable liquid. Consequence endpoint: serious injury to one person, as defined in the invented 'Site risk criteria, revision C'.
    2 Initiating eventLoss of cooling water after a pump trip. Frequency 0.2 per year, from the plant's own trip log, dated (invented).
    3 Enabling condition and modifiersEnabling condition: the unit runs at the high feed rate for half of the time, probability 0.5. Conditional modifiers: ignition of the release 0.3; a person in the affected area 0.25 (all invented, each with a stated basis on the real sheet).
    4 Layers claimedLayer 1: high-pressure alarm with operator action, PFD 0.2. Layer 2: relief valve to a safe location, PFD 0.05 (both invented; on a real sheet each has its source, test record and reason for independence). Not credited: the pressure control loop, because it uses the same transmitter as the alarm and so is not independent of layer 1.
    5 CalculationProduct of PFDs: 0.2 x 0.05 = 0.01. Product of modifiers: 0.3 x 0.25 = 0.075. Mitigated frequency: 0.2 x 0.5 x 0.01 x 0.075 = 0.000075 = 7.5E-5 per year.
    6 Tolerable frequency1E-5 per year for the serious-injury endpoint, taken from clause 4.2 of the invented criteria document and approved by the site manager (invented).
    7 GapGap ratio R = 7.5E-5 / 1E-5 = 7.5, above 1, so there is a gap. Required PFD of added layers = 1E-5 / 7.5E-5 = 0.133, so 0.13 or lower.
    8 Action and checkRecommendation: add a high-high pressure trip with its own transmitter, logic and shutdown valve, PFD 0.1 (invented), owner the process engineer, due in 90 days (invented). Check: 7.5E-5 x 0.1 = 7.5E-6, below 1E-5. Credit starts only after the trip is installed, validated and tested.

    Every figure is invented to show the method and none is a recommendation or a typical value. Check of the arithmetic: 0.2 x 0.05 = 0.01; 0.3 x 0.25 = 0.075; 0.2 x 0.5 = 0.1; 0.1 x 0.01 = 0.001; 0.001 x 0.075 = 0.000075; 7.5E-5 / 1E-5 = 7.5; 1E-5 / 7.5E-5 = 0.1333; 7.5E-5 x 0.1 = 7.5E-6, which is below 1E-5. Real values, and the decision whether a layer qualifies, come from your own sources and your own procedure.

    When a spreadsheet stops being enough

    A paper sheet or a spreadsheet works for a handful of scenarios analysed in one workshop by one team. It stops working when many scenarios credit the same layers, when a failed test or a bypass of one layer must change every scenario that relies on it, when the same frequency or probability source has to be traced across many sheets, and when recommendations from many sheets must be followed to closure.

    A software record can link each scenario to its hazard study node, hold each layer once and show every scenario that depends on it, keep the calculation reproducible with its sources and dates, show the status of recommendations and flag a credited layer that is bypassed, overdue for test or changed. Ask what happens to every scenario when one probability is edited, whether a layer can be credited without a recorded reason for independence, and where the history of changes is kept. The list below applies the process safety management rule used by the guide. Nothing in it shows that a product holds a layer of protection analysis, so test it with one of your own scenarios.

    Same rule for every product: tagged “Process Safety”, “Barrier Management”, “Risk Management”, “Risk Assessment”, “Control of Work”, “Permit to Work” or “Asset Integrity”, with a sourced process safety (PHA, barrier or management-of-change) capability in its record, or one the vendor stated to us, labelled as vendor-stated. Documented and conditional capabilities qualify; check the linked scope before treating a module as included.

    Tekmon pays for a sponsored placement (above); its place in this list follows the same rule as every entry. How lists are ordered

    All 23 matching profiles are shown. Documentation review, not hands-on testing or a claim of compliance.