Layer of Protection analysis (LOPA) is a simplified quantitative tool for analyzing and assessing risk. LOPA was developed by user organizations during the 1990s as a streamlined risk assessment tool, using conservative rules and order of magnitude estimates of frequency probability and consequence severity. When the method was shown to be an efficient means to access risk, several company published papers describing the driving forces behind their efforts to develop the method, their experience of LOPA, and examples of their use.  In particular, the papers and discussions amount the attendees at the Center for Chemical Process Safety (CCPS) international conference and workshop on risk analysis in Process safety in 1997 brought agreement that a book describing the LOPA method should be developed. This led to the publication of the concept book: Layer of Protection Analysis: Simplified Process Risk Assessment (CCPS, LOPA) in 2001.  

LOPA has grown greatly in popularity and usefulness since the publication of CCPS LOPA (2001) on the subject. Guidelines for Initiating Events and Independent Layers of Protection build on LOPA by:

  • Providing additional examples of initiating events (IE) and independent protection layers (IPLs)
  • Provides more guidance for determining the value of each prospective initiating event frequency (IEF and IPL probability of failure on demand (PFD)
  • Proving more information on the overall management systems as well as other considerations specific to a particular IE or IPL, which are needed to support the use of the values provided in this database.

Basic LOPA Steps

  • Identify the consequence to screen the scenario
  • Select an accident scenario
  • Identify the initiating event & determine the initiating event frequency
  • Identify the IPLs & estimate Probability of Failure on Demand (PFD)
  • Estimate the risk, determine the frequency of the mitigated consequence by mathematically combining the initiating event frequency and IPL PFDs
  • Evaluate the risk and see if additional IPL is needed


Initiating Events (IEs) and Independent Protection Layers (IPLs) in LOPA are included in this section.

Core Attributes

  • Independence
  • Functionality
  • Integrity
  • Reliability
  • Auditability
  • Access security
  • Management of Change

LOPA Components

The Evergreen LOPA Database is a benefit for employees of CCPS Member Companies. In order to access the LOPA components below, login here.

Initiating Events

The minimum combination of failures or errors necessary to start the propagation of an incident sequence. 

See Initiating Events

Independent Layer of Protection

An independent protection layer (IPL) is a device, system, or action that is capable of preventing a scenario from proceeding to its undesired consequence independent of the initiating event or the action of any other layer of protection associated with the scenario. 

See Independent Protection Layers 

Conditional Modifier

  • Probabilistic condition that is not intertwined with the scenario itself
  • Probabilities generally associated with the post-release part of an incident sequence.

Learn about Conditional Modifiers

Enabling Conditions

  • Enabling conditions are situations which must occur simultaneous with a given initiating event to allow the specific cause for a scenario to propagate to a consequence of interest. 
  • Consists of an operation or condition that does not directly cause the scenario, but that must be present or active in order for the scenario to proceed to a loss event
  • Not all LOPA have enabling conditions

Learn about Enabling Conditions

Note: Not every LOPA have enabling condition and conditional Modifiers