ErgoPlanner

Appearance

LOPA — Layer of Protection Analysis ​

Combine an initiating event with independent protection layers to compute mitigated risk, the gap to tolerable, and the required PFD / SIL for a new safeguard — CCPS LOPA.

Overview ​

A LOPA (Layer of Protection Analysis) is a semi-quantitative method that takes a single hazard scenario, multiplies the initiating-event frequency by the failure probabilities (PFDs) of the independent protection layers that stand between the initiating event and the consequence, and compares the resulting mitigated frequency with a tolerable target. If a gap remains, LOPA tells you the required PFD of an additional safeguard and the required SIL that implies.

ErgoPlanner enforces the defining rule of LOPA — that only independent protection layers may be credited — and computes the gap and required integrity automatically.

In this guide you'll learn

  • How to create a LOPA study and define a scenario
  • How to enter the initiating event and credit independent protection layers
  • How the mitigated frequency, gap, required PFD and required SIL are computed
  • How LOPA feeds the SIL verification

Estimated Time: 25 minutes Difficulty: Advanced

Prerequisites ​

  • A signed-in account
  • An engineering calculations entitlement to run the calculation
  • A tolerable-frequency target for the consequence (from your corporate risk matrix)
  • Familiarity with LOPA and IPL independence rules

Where to find it ​

The study list is at /lopa/studies; an individual study opens at /lopa/studies/{id}.

How the calculation works ​

For a scenario, ErgoPlanner computes the mitigated frequency as the initiating-event frequency reduced by every valid, independent protection layer (and any enabling-condition/modifier factors):

f_mitigated = f_IE × Π(modifiers) × Π(PFD of each independent IPL)

It then compares f_mitigated with the tolerable target frequency to find the gap (how many times more risk reduction is still needed). The required PFD of an additional safeguard follows the CCPS rule:

required PFD = 1 / gap

and that required PFD maps to a required SIL band per IEC 61511 (e.g. a required PFD of 0.1 → SIL 1, 0.01 → SIL 2, 0.001 → SIL 3).

Workflow ​

Step 1 — Create the study ​

  1. Go to /lopa/studies and click Create Study.
  2. Enter a study name and optional description, and nominate a lead engineer.
  3. The study opens in Draft and progresses through In Progress → Verified → Approved → Closed.

Step 2 — Define a scenario ​

Add a scenario with:

  • A scenario name / consequence description (e.g. "Reactor overpressure → rupture").
  • The initiating event and its frequency (events per year).
  • The tolerable target frequency for the consequence (per year).

Step 3 — Credit independent protection layers ​

Add the protection layers that act on this scenario. For each IPL choose a type and enter its data:

  • Type — BPCS, Alarm, Relief Device, Operator Response, SIF, Modifier or Other.
  • PFD — its probability of failure on demand.
  • Independence — mark whether the layer is genuinely independent of the initiating event and of the other layers. Only independent layers are credited in the mitigated-frequency product; a layer flagged non-independent is excluded by the calculation. This independence gate is the heart of LOPA — it stops you double-counting a BPCS loop as both the initiating cause and a protection layer.

Enabling conditions and frequency modifiers can be added to adjust the initiating-event frequency (for example, fraction of time the hazardous condition exists).

Step 4 — Calculate ​

Click Calculate for the scenario. ErgoPlanner reports:

  • Mitigated frequency — f_IE × Π(modifiers) × Π(independent IPL PFDs).
  • Gap — how far the mitigated frequency still is from the tolerable target.
  • Required PFD — 1 / gap, the PFD a new safeguard must achieve.
  • Required SIL — the IEC 61511 band that required PFD implies.
  • Verdict — whether the scenario is already tolerable or needs an additional layer.

Step 5 — Close the loop into SIL ​

If the verdict calls for a new Safety Instrumented Function, carry the required SIL into a SIL assessment, build the SIF to that target, and verify that its achieved SIL meets the requirement.

Step 6 — Report ​

Click Report (PDF) in the study header to download the study report as lopa-<study name>.pdf. If it cannot be generated, an error message appears at the bottom right of the screen.

Worked example ​

Initiating event at 0.1 /yr, two independent IPLs (a BPCS alarm at PFD 0.1 and a relief valve at PFD 0.01), tolerable target 10⁻⁵ /yr:

f_mitigated = 0.1 × 0.1 × 0.01 = 1×10⁻⁴ /yr
gap         = f_mitigated / target = 1×10⁻⁴ / 1×10⁻⁵ = 10
required PFD = 1 / gap = 0.1   → required SIL 1

The scenario needs one more independent layer achieving PFD ≤ 0.1 — i.e. a SIL 1 SIF.

Use cases ​

  • Sizing a new SIF — Establish, defensibly, the SIL target a new trip must meet before spending on instrumentation, then verify it in SIL.
  • Crediting existing safeguards — Demonstrate that existing independent layers already make a scenario tolerable, avoiding unnecessary new hardware.
  • Independence audit — Use the independence gate to expose layers that cannot legitimately be credited (e.g. sharing the BPCS with the initiating cause).

References ​

  1. CCPS — Layer of Protection Analysis: Simplified Process Risk Assessment (AIChE)
  2. IEC 61511-3 — Guidance for the determination of the required safety integrity levels