Layer of Protection Analysis (LOPA): From Concept to Worksheet

In process safety engineering, qualitative hazard identification tools like HAZOP are excellent at listing potential failure scenarios. However, HAZOP struggles to answer a critical quantitative question: Is the current design safe enough, or do we need to add more safety systems?

Layer of Protection Analysis (LOPA) is a semi-quantitative risk assessment method that fills this gap. It evaluates the frequency of an initiating event, reviews the reliability of independent safety layers, and calculates whether the mitigated event frequency meets the facility's tolerable risk target.

1. The Concentric Onion Model of Safety

LOPA represents process safety as concentric rings of defense surrounding the core process hazard. Each ring acts as an Independent Protection Layer (IPL) that must function independently of other layers and the initiating event.

• Core Hazard: The flammable/reactive solvent or pressurized gas system (e.g., hydrogen gas feed).
• Layer 1: Inherently Safer Design (ISD): Minimizing inventory, choosing low-toxicity solvents, or utilizing gravity-drain layouts.
• Layer 2: Basic Process Control (BPCS): Everyday control loops (PID valves, temperature sensors) that keep the process within normal operating envelopes.
• Layer 3: Critical Operator Alarms: DCS alarms that notify operators to intervene manually (such as closing a manual block valve).
• Layer 4: Safety Instrumented System (SIS): Independent safety PLCs that execute automated trips (interlocks) when process variables cross safety thresholds.
• Layer 5: Active Relief Devices: Rupture disks and Pressure Safety Valves (PSVs) designed to discharge excess vapors to safe areas.
• Layer 6: Passive Relief Barriers: Dikes, containment bunds, blast walls, or double-containment piping.
• Layer 7: Plant Emergency Response: Fire suppression systems, evacuation sirens, and community emergency response plans.

2. LOPA Safety Mathematics

LOPA calculates risk using the following semi-quantitative terms:

1. Initiating Event Frequency (f_i): The expected frequency of the initiating failure (failures/year). For example, a control valve failing open typically has a frequency of 0.1 per year.
2. Probability of Failure on Demand (PFD): The probability that a safety barrier will fail to act when called upon. PFD is a dimensionless value between 0 and 1.0 (lower is safer).
3. Mitigated Consequence Frequency (f_mitigated): The calculated frequency of the hazardous event after accounting for all active IPLs: f_mitigated = f_i * PFD_1 * PFD_2 * ... * PFD_n
4. Tolerable Risk Target (f_target): The maximum acceptable frequency for a specific consequence class. For severe injuries or community fatalities, typical targets range between 1 x 10^-6 and 1 x 10^-5 per year.
5. Safety Gap: If f_mitigated is greater than f_target, an engineering gap exists, requiring the installation of additional safety instrumented functions (SIFs) rated for a specific Safety Integrity Level (SIL).

3. Case Study: Hydrogenation Loop Reactor Overpressure

Process Description:

A jacketed loop reactor is used to conduct catalytic hydrogenation of an API intermediate. The reactor operates with a continuous feed of flammable hydrogen gas (H2) at 15 bar g in a methanol solvent. The reactor is rated for a Maximum Allowable Working Pressure (MAWP) of 22 bar g. If the reactor pressure exceeds 22 bar g, it risks catastrophic shell rupture, releasing toxic vapors and initiating a hydrogen gas explosion.

The Scenario:

The main hydrogen pressure regulator valve fails fully open, bypassing control and dumping high-pressure gas into the reactor. The cooling water jacket pump also trips, leading to temperature and pressure spikes.

LOPA Sizing Parameters & Data:

• Initiating Event: Pressure regulator control valve fails open (f_i = 0.1 per year).
• Tolerable Risk Target (f_target): 1 x 10^-6 per year (Catastrophic Rupture/Fatality).
• Active Independent Protection Layers (IPLs):
  1. IPL 1 (BPCS Loop): Reactor pressure transmitter PT-101 detects high pressure and sends a signal to close the H2 flow control valve FCV-101 (PFD = 0.1).
  2. IPL 2 (Operator Intervention): Independent high pressure alarm (PAH-102) sounds in the control room. The operator has 10 minutes to manually actuate the safety block valve (PFD = 0.1).
  3. IPL 3 (Safety Instrumented System - SIS): An independent pressure switch (PSH-103) wired to a safety PLC trips close a fast-acting isolation valve (XV-101) on the H2 inlet line. This loop is designed and validated as a SIL-2 function (PFD = 0.01).
  4. IPL 4 (Active Relief Device): A dual Rupture Disk and PSV set at 20 bar g discharges vapors to a catch tank (PFD = 0.01).

LOPA Worksheet Segment:

Calculation Analysis:

f_mitigated = (1.0 x 10^-1) * (1.0 x 10^-1) * (1.0 x 10^-1) * (1.0 x 10^-2) * (1.0 x 10^-2) = 1.0 x 10^-7 per year

Since the mitigated frequency (1.0 x 10^-7/year) is lower than the tolerable risk target (1.0 x 10^-6/year), the current design is considered safe and compliant under CCPS guidelines. No further safeguards are required.

4. Reference Standards Used

• IEC 61511: Functional safety - Safety instrumented systems for the process industry sector.
• CCPS Guidelines for Layer of Protection Analysis: (Center for Chemical Process Safety).
• ISA-84.00.01: Application of Safety Instrumented Systems for the Process Industries.