Layer of Protection Analysis (LOPA)

LOPA is typically used when a more detailed qualitative risk assessment like HAZOP is insufficient, and the risk level is unclear or seems unacceptable from these types of risk assessments. LOPA is useful for focusing on specific high-risk scenarios or hazards where there is uncertainty about the effectiveness of existing layers of protection. LOPA is often used to establish the Safety Integrity Level (SIL) of a Safety Instrumented System (SIS), as required by standards like IEC 61511 & 61508. By quantifying the required risk reduction, LOPA determines the SIL rating, which defines the reliability and robustness required for the SIS to achieve acceptable risk levels.

Finch employs a standard LOPA tool which is a proven method for determining the Safety Integrity Level (SIL) of a Safety Instrumented Function (SIF)/process. This approach allows us to visually map out the potential initiating events and consequences of identified hazards to pinpoint critical layers of protection required to keep the process in a safe operation. The following steps are carried out to ensure a great experience for Finch’s clients.

1. Identify the Hazard:

• Identify the main hazard which you are trying to prevent i.e. overfill of a storage tank.

2. Define the Consequences:

• Understand the consequences of the hazard taking place and what impacts it has on people, equipment, environment and business.

3. Identify the initiating event:

• Determine the initiating event in the sequence which could lead to the hazard i.e. failure of equipment, human errors or external factors.

4. Calculate the Frequency of the Initiating Event:

• The likelihood of the initiating event occurring is calculated based on historical data, experience, or industry standards. This is expressed in terms of events per year or other time-based units. For example, you may estimate that a pump failure occurs once every 10 years.

5. Identify Layers of Protection:

• In LOPA, multiple independent layers of protection are identified, each serving as a barrier to prevent the hazard from escalating. These layers must be independent of one another so that the failure of one layer does not affect the effectiveness of the others. Some common layers of protection in process engineering include BPCS, alarms and trips, SIS, containment, emergency response.

6. Assess the Risk Reduction for Each Layer:

• Each layer of protection is assigned a Probability of Failure on Demand (PFD), which represents the likelihood that the layer will fail when needed i.e. from standards a BPCS trip may have a PFD of 0.1 (fail 1 in 10 times) or a SIL 2 SIS may have a PFD of 0.01 (fail 1 in 100 times).
• The risk reduction for each layer is calculated by considering how effectively the layer reduces the probability of the hazardous event.

7. Determine if the Risk is Acceptable:

• Once the initiating event frequency and the risk reduction from all protection layers are combined, the residual risk (the remaining risk after all protections are considered) is compared to the tolerable risk level. The tolerable risk is determined by the company’s or industry’s risk tolerance criteria.
• For example:
  • The initiating event frequency is 1 in 10 years (0.1 per year).
  • The layers of protection reduce the risk by a factor of 1000.
  • The residual risk is now 0.0001 per year (1 in 10,000 years).
  • If the company’s tolerable risk is 1 in 10,000 years, the risk is considered acceptable.

8. Add or Improve Protections (If Necessary):

• If the calculated risk exceeds the tolerable level, additional layers of protection must be added, or the effectiveness of existing protections must be improved.
• This could involve:
• • Installing a more reliable Safety Instrumented System with a higher SIL rating
  • Improving operator training to reduce human error
  • Adding physical barriers, like additional containment systems or backup equipment

9. Determine the Safety Integrity Level (SIL) of the Safety Instrumented Functions (SIFs):

• Once the information is determined above this will allow the SIL of the SIF to be determined. SIL is defined as a relative level of risk-reduction provided by a safety function, or to specify a target level of risk reduction. There are four Safety Integrity Levels (SIL) – SIL1, 2, 3 & 4 where the higher the SIL level, the higher the associated safety level, and the lower probability that a system will fail to perform properly. Safety Instrumented Function (SIF) is a set of equipment intended to reduce the risk due to a specific hazard (a safety loop).