Aurorisk FR

LOPA — Layer of protection analysis: method and software

LOPA checks, for a severe scenario, whether the independent protection layers in place reduce its frequency enough, and how much protection must otherwise be added.

Schematic

The method

LOPA (Layer of Protection Analysis) is a semi-quantitative method. It starts from a single scenario — one initiating event leading to one consequence — often taken from a HAZOP.

The initiating event frequency is multiplied by the probability of failure on demand (PFD) of each independent protection layer (IPL): alarm with operator response, relief valve, safety instrumented function, bund… The result is compared with a tolerable frequency set by the company.

Any gap shows the risk reduction required. LOPA is widely used to determine the safety integrity level (SIL) of a safety instrumented function under IEC 61511. The reference text is the CCPS book (2001).

Scenario frequency (log scale)10⁻¹ /yrInitiatingevent10⁻² /yr+ Alarm andoperator response(PFD 0.1)10⁻⁴ /yr+ Relief valve(PFD 0.01)10⁻⁵ /yr+ Safetyinstrumented SIL 1(PFD 0.1)Tolerable frequency
Illustrative example (made-up values): each independent protection layer divides the scenario frequency by the inverse of its probability of failure, until the tolerable frequency is reached.

When to use it

  • After a HAZOP, for scenarios severe enough to require a numerical demonstration.
  • To size a safety instrumented function (SIL selection).
  • To choose between several possible barriers for one scenario.

Watch out for

  • A layer only counts if it is independent of the initiating event and of other layers: the same sensor cannot be credited twice.
  • Frequency and probability values must come from a consistent, documented database approved by the company.
  • LOPA handles one scenario at a time; for complex combinations a fault tree is better suited.

Steps

  1. Select a scenario: one initiating event and one consequence.
  2. Set the initiating event frequency from documented data.
  3. Identify protection layers and keep only those that are independent, effective and auditable.
  4. Assign each layer its probability of failure and compute the resulting frequency, with any conditional modifiers (occupancy, ignition probability).
  5. Compare with the tolerable frequency; if exceeded, add or strengthen a layer, for example a safety instrumented function with a suitable SIL.

LOPA software

List from the Aurorisk catalogue, links checked on 2026-09-26. Confirmed free access is listed first; unknown information is labelled.

ToolSource · licence · accessScopeDescription
Kenexis Open-PHA ↗Commercial publisherFreeUnited StatesHAZOP scenarios linked to LOPA scenarios.
Polyodos ↗Commercial publisherFree for teachingInternationalHAZOP and LOPA with action tracking.
BakerRisk PHA-Tool ↗Commercial publisherUnited StatesSuite for facilitating PHA studies.

Standards and references

Related methods

Related course : Functional safety: SIS and SIL

← All guides · Methods