LOPA – Going Down the Wrong Path

Layer of Protection Analysis (LOPA) has quickly gained acceptance in the Chemical Processing Industries (CPI), and has risen to be one of the leading risk assessment techniques used for process safety studies. LOPA generally employs more rigor and science than what is encountered with qualitative risk assessments, while still not becoming overly onerous when compared to detailed Quantitative Risk Assessments (QRA). In the interest of balancing time and resources against science and accuracy, certain tradeoffs and assumptions are made within the LOPA assessment. In turn, these tradeoffs and assumptions can lead to inaccurate conclusions.

One of these tradeoffs is that a LOPA assessment is based on only a single outcome, rather than an evaluation of the full spectrum of possible outcomes which would be assessed in a QRA. Generally within LOPA the approach is based on selecting what is perceived to be the most significant event sequence, with respect to the overall risk contribution. Failure to correctly identify the most significant event sequence can, however, result in the risk being understated.

For example, this selection issue arises in the treatment of protection layers associated with mitigation of consequences. LOPA teams have a choice to account for mitigation layers in the consequence assignment, or alternatively treat these layers as Independent Protection Layers (IPL). While this may appear to be an inconsequential decision, it can in fact result in very different conclusions. Recognizing this dichotomy in treatment, one can show that these mitigation layers should be designed so as to achieve a balance between consequence reduction and desired reliability.

This paper will discuss the various selection alternatives that are commonly encountered by LOPA teams, and demonstrate their impacts through case studies.