Analysis methods
LOPA
A semi-quantitative method to decide whether protection layers are enough — and what SIL a new SIF must achieve.
Layer of Protection Analysis
- Category
- Analysis methods
- Scope
- Industry practice
- Edition / refs
- CCPS guidance · IEC 61511-3
MSA output
- LOPA calculations
- SIF register
- SIL verification
What is LOPA?
Layer of Protection Analysis is a semi-quantitative risk assessment method that evaluates whether the independent protection layers (IPLs) for a hazard scenario reduce its frequency to a tolerable level. It was formalised by the Center for Chemical Process Safety (CCPS) and is described as a SIL determination method in IEC 61511-3.
Each scenario — usually taken from a HAZOP — starts with an initiating event frequency. This is multiplied by the probability of failure on demand of each IPL, and by any enabling conditions or conditional modifiers, to give a mitigated event frequency. If that exceeds the tolerable frequency, the gap defines the risk reduction a SIF must deliver, and therefore its SIL.
Who it applies to
- Process safety engineers
- Operators of COMAH and other major-hazard sites
- SIS designers setting SIL targets
- HAZOP and LOPA facilitators
Key requirements
- 01
One scenario, one cause–consequence pair
Define each scenario precisely so that frequencies and IPLs can be applied correctly.
- 02
Justified initiating event frequency
Use recognised data sources or site experience, and record the basis.
- 03
Qualified IPLs
Each IPL must be independent of the initiating event and other IPLs, effective for the scenario and auditable. IEC 61511 limits the credit for a BPCS protection layer to a risk reduction factor of 10.
- 04
Conditional modifiers
Probability of ignition, occupancy and enabling conditions — applied consistently and justified.
- 05
Tolerable risk criteria
Compare the mitigated frequency against defined corporate or regulatory criteria.
- 06
SIL target
Required risk reduction factor of 10–100 maps to SIL 1, 100–1,000 to SIL 2 and 1,000–10,000 to SIL 3.
Summary for orientation only. Always refer to the current official text of LOPA and any applicable legislation.
MSA for LOPA
What MSA generates
Evidence produced from your engineering inputs, traceable end to end and exported to Word, PDF or Excel.
LOPA calculations
Worksheets per scenario, with every frequency, credit and modifier recorded.
SIF register
Each required SIF created with its SIL target and linked to the scenarios it protects.
SIL verification
Verification against the target, kept attached to the same SIF.
Frequently asked questions
LOPA or risk graph?
Both are described in IEC 61511-3. Risk graphs are quick and qualitative, suited to screening. LOPA is more rigorous and transparent, and is widely used in process industries for final SIL determination.
Can an alarm with operator response count as an IPL?
It can, if it meets IPL criteria: independence from the initiating event and other IPLs, sufficient time for the operator to detect and respond, and documented procedures and training.
What if the gap would need more than SIL 3?
Treat it as a design issue. Look for inherently safer design or additional independent layers rather than relying on a single very high-integrity SIF.
Generate LOPA evidence from your own data
See how MSA turns your requirements, drawings and process data into certification-ready documents — fully offline.