Layer of Protection Analysis

Chapter 1

Introduction

Layer of protection analysis (LOPA) is a semiquantitative tool for analyzing and assessing risk. This book

• describes the LOPA process,
• discusses the strengths and limitations of LOPA,
• describes the requirements for implementing LOPA in an organization, and
• provides worked examples that show how several different companies have applied LOPA.

This chapter

• identifies the audience for this book,
• provides the history of LOPA,
• shows the use of LOPA in the process life cycle,
• discusses the linkage to other publications, and
• provides an annotated outline for the book.

1.1. Audience

This book is intended for:

• Executives who are considering expanding their corporate strategy for managing risk by adding LOPA to their existing risk analysis process. For the executive audience, the following chapters are recommended. Chapter 2 summarizes the LOPA method and its benefits. Chapter 9 discusses the questions that an organization must answer when deciding whether to use LOPA and the required steps to implement the process effectively. Chapter 10 describes other processes (such as management of change, identification of safety critical equipment, etc.) which can be enhanced by LOPA. The appendices contain summary forms and worked examples that demonstrate the LOPA product.
• Safety specialists who are familiar with existing methods (such as HAZOP, fault tree analysis, event tree analysis, etc.) or who may already have some experience with LOPA (analysts, participants, reviewers, auditors, etc.). For this audience, Chapters 3 through 8 discuss the steps of the LOPA process in detail, with several continuing examples used to demonstrate the method. The appendices contain additional worked examples and other supporting documentation.
• Process and process control engineers, chemists, operations and maintenance personnel, and others who may participate in LOPA reviews or who may be affected by LOPA recommendations. This includes those who implement the recommendations and those who receive the outcomes from LOPA. Chapters 1, 2, and 6 may be helpful for this audience.
• Persons around the world who are responsible for compliance with process safety regulations - including the US Process Safety Management rule (OSHA, 1992), Seveso II Regulations in EU member countries-and related standards - including ISA S84.01 (ISA, 1996), IEC 61508 (IEC, 1998) and IEC 61511 (IEC, 2001).

1.2. History of LOPA

In a typical chemical process, various protection layers are in place to lower the frequency of undesired consequences: the process design (including inherently safer concepts); the basic process control system; safety instrumented systems; passive devices (such as dikes and blast walls); active devices (such as relief valves); human intervention; etc. There has been much discussion among project teams, hazard analysts, and management about the number of and strength of protection layers (see text box below). Decisions were sometimes made using subjective arguments, emotional appeals, and occasionally simply by the loudness or persistence of an individual.

LOPA has its origins in the desire to answer these key questions using a rational, objective, risk-based approach. In LOPA, the individual protection layers proposed or provided are analyzed for their effectiveness. The combined effects of the protection layers are then compared against risk tolerance criteria. Characteristics of the answers provided by LOPA are listed in the text box above.

KEY QUESTIONS FOR PROTECTION LAYERS

• How safe is safe enough?
• How many protection layers are needed?
• How much risk reduction should each layer provide?

LOPA answers the key questions about the number and strength of protection layers by

• providing rational, semiquantitative, risk-based answers,
• reducing emotionalism.
• providing clarity and consistency,
• documenting the basis of the decision,
• facilitating understanding among plant personnel.

The genesis of this method was suggested in two publications:

1. In the late 1980s, the then Chemical Manufacturers Association published the Responsible Care® Process Safety Code of Management Practices which included "sufficient layers of protection" as one of the recommended components of an effective process safety management system (American Chemistry Council, 2000). The Chemical Manufacturers Association is now the American Chemistry Council.

2. In 1993, CCPS published its Guidelines for Safe Automation of Chemical Processes (CCPS, 1993b). Although it was called the risk-based SIS integrity level method, LOPA was suggested as one method to determine the integrity level for safety instrumented functions (SIFs). (See Table 7.4 in Safe Automation; CCPS, 1993b.) "Interlock" is an older, imprecise term for SIF. The method used was not as fully developed as the LOPA technique described in this book. However, it did indicate a path forward, which was pursued by several companies independently. The reasons for this effort included the desire to

• classify SIF to determine the appropriate safety integrity level (SIL) (this was the starting point for some companies),
• develop a screening tool to reduce the number of scenarios requiring a full (chemical process) quantitative risk assessment (CPQRA),
• develop a tool that would identify "safety critical" equipment and systems to focus limited resources,
• develop a semiquantitative tool to make consistent risk based judgments within an organization,
• harmonize terminology and methodology with recently developed and developing international process sector standards, and
• facilitate communication (e.g., SIS, SIF, SIL, IPL) between the hazard and risk analysis community and the process control community (e.g., integrators, manufacturers, instrument and electrical engineers, plant personnel).

The initial development of LOPA was done internally within individual companies, in some cases focusing on existing processes, e.g., converting a control system to DCS. However, once a method had been developed and refined, several companies published papers describing the driving forces behind their efforts to develop the method, their experience with LOPA, and examples of its use (Dowell, 1997; 1998; 1999a; 1999b; Bridges and Williams, 1997; Fuller and Marszal, 1999; Lorenzo and Bridges, 1997; Ewbank and York, 1997; Huff and Montgomery, 1997). In particular, the papers and discussion among the attendees at the CCPS International Conference and Workshop on Risk Analysis in Process Safety in Atlanta in October 1997 brought agreement that a book describing the LOPA method should be developed.

In parallel with these efforts, discussions took place on the requirements for the design of safety instrumented functions (SIF) to provide the required PFDs (probability of failure on demand). United States (ISA S84.01, (ISA, 1996)) and international standards (IEC 61508, (IEC, 1998) and IEC 61511, (IEC, 2001)) described the architecture and design features of SIFs. Informative sections of the ISA and IEC standards suggested methods to determine the required SIL (safety integrity level), but LOPA was not mentioned until the draft of IEC 61511, Part 3 appeared in late 1999. These issues were summarized in the CCPS workshop on the application of ISA S84.01 (CCPS, 2000c).

In response to all this activity, CCPS assembled in 1998 a team from A. D. Little, ARCO Chemical, Dow Chemical, DuPont, Factory Mutual, ABS Consulting (includes former JBF Associates), International Specialty Products, Proctor and Gamble (P&G), Rhodia, Rohm and Haas, Shell (Equilon), and Union Carbide to tabulate and present industry practice for LOPA in this book.

This book extends the method outlined in Safe Automation of Chemical Processes (CCPS, 1993b) by

• developing concepts and definitions for use throughout industry,
• showing how numerical risk tolerance criteria have been developed by different companies,
• defining the requirements for a safeguard to be considered an independent protection layer (IPL),
• demonstrating how LOPA can be used for purposes other than the classification of SIF systems, and
• recommending documentation procedures to ensure consistency of application within an organization.

While the LOPA methods used by various companies differ, they share the following common features:

• a consequence classification method that can be applied throughout the organization;
• numerical risk tolerance criteria. Individual companies use different criteria which include:

frequency of fatalities,

frequency of fires,

required number of independent protection layers (IPLs), and

maximum frequency for specified categories of consequence based on release size and characteristics or lost production;

• a method for developing scenarios;
• specific rules for considering safeguards as IPLs;
• specified default data for initiating event frequencies and values for IPLs;
• a specified procedure for performing the required calculations; and
• a specified procedure for determining whether the risk associated with a scenario meets the risk tolerance criteria for an organization and, if it does not, how this is resolved and documented.

1.3. Use of...