The calculation
Mitigated frequency = initiating event frequency × (probability of failure on demand of each independent protection layer) × (conditional modifiers)
The result is how often the scenario is expected per year. That figure is compared with the organisation's tolerable risk criterion.
Five conditions for counting as a layer
- Effective — able to reduce the scenario by at least a factor of ten.
- Specific — it acts against that scenario.
- Independent — of the initiating event and of the other layers.
- Dependable — its performance on demand can be shown.
- Auditable — it can be tested and recorded.
One critical rule: within the same basic process control system only one layer may be credited. Counting two functions of the same system as two independent layers makes the calculation look safer than it is.
From the result to a safety integrity level
Where the mitigated frequency exceeds the criterion, the gap gives the required risk reduction factor, and that factor sets the integrity level of the safety instrumented function. The lower the required probability of failure, the higher the level.
The method's limit
LOPA is semi-quantitative: its inputs come from typical values. So the source of every value must be recorded; a probability without a source is a number that makes the calculation look scientific and cannot be checked. The scenarios usually come from HAZOP — LOPA is not a hazard identification method, it evaluates an identified scenario.
Where it is used
In process safety, particularly in chemical, petrochemical and energy plants, to justify how many independent layers a scenario needs and to set the integrity level of safety functions.