Chapter 1

Context

The Guidelines in this book characterize when and how to apply enabling conditions and conditional modifiers to Layer of Protection Analyses (LOPAs). A LOPA may have consequences and risk criteria expressed in final endpoint (impact) terms such as fatalities or environmental damage, and include conditional modifiers such as probability of fatality associated with a material or energy release. It may also take into account probabilities called enabling conditions that sometimes apply to scenario initiating events. One way to differentiate these two factors is that enabling conditions are associated with the part of an incident sequence leading up to a release of hazardous material or energy, whereas conditional modifiers are probabilities generally associated with the post-release part of an incident sequence.

As discussed in Chapter 4, these enabling conditions and conditional modifiers may be used with other scenario risk analysis methods such as Quantitative Risk Analyses and HAZOP/LOPA Studies. However, the main focus in this text will be their use in the context of LOPAs.

An overview of Layer of Protection Analysis is given in Section 1.1, followed by some pertinent variations in Section 1.2. Section 1.3 discusses the appropriate application of enabling conditions and conditional modifiers. These decisions on use of conditional modifiers are closely related to a company’s risk criteria endpoints used when determining loss event impacts, as discussed in Section 1.4.

1.1 LOPA Overview

This section, taken in large part from Center for Chemical Process Safety’s Guidelines for Hazard Evaluation Procedures, Third Edition (CCPS 2008)1, provides a brief summary of the methodology for conducting Layer of Protection Analyses as described in the CCPS Concept Book Layer of Protection Analysis: Simplified Process Risk Assessment (CCPS 2001), with minor updates. Experienced LOPA practitioners and users may want to advance to Section 1.2, Pertinent LOPA Variations.

Layer of Protection Analysis is a simplified form of quantitative risk analysis that uses order-of-magnitude categories for initiating event frequency, consequence severity and probability of failure of independent protection layers (IPLs) to analyze and assess the risk of one or more incident scenarios. LOPA can be useful in the process development, process design, operational, maintenance, modification and decommissioning life cycle phases.

Purpose of LOPA

LOPA was developed to help answer questions such as:

• What layers of protection are needed to meet our risk goals?
• How much risk reduction does each layer provide or need to provide?

LOPA can help answer these questions with less time and effort than a full quantitative risk analysis (QRA), although there are instances when use of a complete QRA may be warranted.

LOPA is an order-of-magnitude type of quantitative method (sometimes termed “semi-quantitative”) that builds on qualitative hazard evaluations such as HAZOP Studies. By analyzing selected scenarios in detail, effective application of LOPA can determine whether the risk posed by each analyzed scenario has been reduced to meet a specified risk goal. However, if the analyst or team can make a reasonable risk decision using only qualitative methods, then LOPA may not be warranted. Qualitative hazard evaluation methods such as HAZOP Studies are intended to identify a comprehensive set of incident scenarios and qualitatively analyze those scenarios for the adequacy of safeguards. LOPA is generally used to analyze a subset of incident scenarios.

At times, simple order-of-magnitude LOPAs can be expanded with greater rigor by implementing aspects of a more complete QRA. The use of enabling conditions and conditional modifiers falls into this realm.

Description

LOPA is typically applied after, and builds upon, the information gathered in a qualitative hazard evaluation, but can be applied to scenarios gathered from any source, such as an audit or incident investigation. LOPA, in turn, can be used as a screening tool for scenarios prior to application of a full quantitative risk analysis. If desired, LOPA can also be implemented in conjunction with a qualitative scenario-based hazard evaluation method such as a HAZOP Study (see Section 4.2).

After the scope of the study is defined, LOPA consists of the six steps summarized below. The LOPA results can then be used to make risk-based decisions.

Step 1: Identify the scenario screening criteria. Since LOPA typically evaluates scenarios that have been developed in a prior study, a first step by the LOPA analyst or team is to screen these scenarios, and the most common screening method is based on consequence. Other screening criteria may also be employed, such as based on “unmitigated risk” (consequence severity combined with initiating cause frequency estimates) or based on the judgment of the hazard review team as to which scenarios warrant closer examination.

LOPA consequence severity estimates and consequence screening thresholds may be defined in a number of ways, each having strengths and weaknesses and varying in the degree of conservatism incorporated into the analysis, with simpler methods generally being more conservative:

• Method 1 – Category approach without direct reference to human harm. Consequences are categorized in terms of the type and magnitude of a release or other consequence characteristic, rather than explicitly defining the final consequence in terms of the number and severity of injuries that may result from a particular release.
• Method 2 – Qualitative estimates of human harm. Human impacts are considered, usually allowing direct comparison with organizational guidelines, but estimates of impact magnitudes are arrived at using qualitative judgment. This method does not explicitly use conditional modifiers such as probability of personnel presence.
• Method 3 – Qualitative or order-of-magnitude estimates of human harm, with adjustments for post-release probabilities (conditional modifiers). This method extends the qualitative judgment in Method 2 using additional probabilities, giving a more quantitative (order-of-magnitude) estimate of the severity of human harm.
• Method 4 – Quantitative estimates of human harm. This method is similar to Method 3 but uses detailed analyses in determining the effects of a release and its effects upon individuals and equipment. Tools associated with full Chemical Process Quantitative Risk Analyses (CPQRAs) may be used here, including dispersion and blast effects analysis. The use of these tools adds complexity and time as well as a need for expertise and other resources such as computational tools. The level of sophistication required for these consequence analyses may be disproportionate to the order-of-magnitude frequency estimates employed within LOPA.

Step 2: Select an incident scenario. LOPA is applied to one scenario at a time. The scenario can come from other analyses, such as qualitative hazard evaluations and/or management-of-change reviews, but each scenario must describe a single initiating event – loss event (“cause-consequence”) pair, except for an uncommon situation where a scenario requires two concurrent initiating events. (This situation, which may warrant using quantitative risk analysis, is discussed in Appendix A.)

When scenarios are selected from a qualitative hazard evaluation, such as from a HAZOP Study, they may need to be separated into multiple scenarios for evaluation. For example, where a scenario involves an emergency relief system, the LOPA could be applied both to the case in which the emergency relief device does not function properly (usually involving a greater severity but lesser likelihood) and to the case in which it does function properly (usually involving a lesser severity but greater likelihood).

Step 3: Identify the initiating event of the scenario and determine its frequency. The scenario initiating event must lead to the loss event, given failure of all of the preventive safeguards. (An initiating event is comprised of one or more aggregated initiating causes, such as from a HAZOP Study. Initiating causes can only be aggregated if they are protected by the same IPLs and lead to the same loss event.) Most companies provide guidance on estimating the frequency to achieve consistency in LOPA results; suggested frequencies are also given by CCPS (2001). The team should determine whether the suggested value is appropriate, based on plant historical performance and/or experience with the initiating event occurring under similar plant conditions. Other factors may also enter into the determination of the initiating event frequency, such as extraordinary design or maintenance or a keylock system to make a human error less likely.

Background aspects, such as the probability that the process is in a certain mode of operation at the time another failure occurs, are not initiating events but enabling conditions. In LOPA, their probabilities modify the initiating event frequency. These aspects are the subject of Chapter 2 of these Guidelines.

Step 4: Identify the IPLs and estimate the PFD of each IPL. The heart of the LOPA methodology is recognizing the existing preventive safeguards that meet the requirements of independent protection layers (IPLs) for a given scenario. (All IPLs are safeguards, but not every safeguard meets the requirements of being an IPL.)

An IPL is a...