899 Howto LOPA
899 Howto LOPA
899 Howto LOPA
typical workflow
and convenient method for simplified risk assessment and as an important part of the life cycle of safety
START
CONCEPTUAL
PROCESS
DESIGN
DEVELOP
SAFETY
REQUIREMENT
SPECIFICATION
PERFORM
PROCESS
HAZARD
ANALYSIS
& RISK
ASSESSMENT
PERFORM SIS
CONCEPTUAL
DESIGN &
VERIFY IT
MEETS
THE SRS
APPLY NON-SIS
PROTECTION
LAYERS TO
PREVENT
IDENTIFIED
HAZARDS OR
REDUCE RISK
PERFORM SIS
DETAIL DESIGN
is met? And if not: what is the scale of the deficiency and how
ESTABLISH
OPERATION &
MAINTENANCE
PROCEDURES
might it be rectified?
The layer of protection concept is often described using
the LOPA onion (see over). It shows that an operating facility
is controlled for its designed purpose and is surrounded by
layers which are intended to prevent harm to persons or the
environment. The Center for Chemical Process Safety produced
PRE-STARTUP
SAFETY REVIEW
(ASSESSMENT)
NO
IS SIS
REQUIRED?
tank which overflowed at Buncefield in 2005. The two immediately obvious scenarios would be for fire and explosion. This
would mean that a LOPA study would be done for each. In
YES
DEFINE
TARGET SIL
SIS
INSTALLATION,
COMMISSIONING &
PRE-STARTUP
ACCEPTANCE
TEST
SIS STARTUP,
OPERATION,
MAINTENANCE,
PERIODIC
FUNCTIONAL
TESTING
MODIFY
OR DECOMMISSION
SIS?
MODIFY
SIS
DECOMMISSIONING
an overflow.
Figure 1: iec 61511 life cycle. LOPA fits well from the process
hazard analysis step through to the question Is SIS required?
How to LOPA
COMM
IP
SE
ERGENCY RESPON
PL A N T E M
SE
P R OT E C T I O N E G R E L I E F D
E VIC
S I CA L
ES
PH Y
MENTED SYSTEM PRE V
EN T
ST RU
N
I
ATI
Y
T
E
VE
F
R ATOR INTERVE
AC
SA
NTI
S /O P E
TIO
ON
ARM
L
A
(
/
N
via
S
PC
S
B
)
(
O
P
M
ER A
E
IP
B
T
S
R
P
Y
TIN
T
CS
LS
G
O
D
?
R
)
IS
NT
C
O
/S U
PERVISION
B A S I C PR O C
NE
ES
LI
PLANT
DESIGN
INTEGRITY
the LOPA ONION: Depicting the layers of protection normally arranged to control the hazards on an operational facility
fied. The consequences at this stage may or may not have been
very helpful.
initiating events
Having established a target frequency, the first (of perhaps
several) initiating events needs to be considered. This will
likely come from the cause section of the HAZOP/HAZID. The
most convenient first initiating event will probably be a failure
in a process control or indication such as a level, pressure,
the Health and Safety Executive of Great Britain, and the UKs
How to LOPA
SEE
SECTIONS
3&4
SEE
SECTION 5
FOR EACH INITIATING EVENT LIST THOSE RISKREDUCING MEASURES (PREVENTION AND
MITIGATION PROTECTION LAYERS,
CONDITIONAL MODIFIERS ETC) THAT RELATE
TO THAT INITIATING EVENT, INCLUDING ANY
EXISITING OR PROPOSED HIGH LEVEL SAFETY
INSTRUMENTED FUNCTION
SEE
SECTIONS
6&7
enabling events
The next step will be to consider the enabling events and
conditional modifiers which might be relevant.
A typical enabling event can be for example, the proportion
SEE
SECTION 4
decisions require knowledge of factors such as physical properties of the substance released and the environment and
IS THE
RISK ALARP?
NO
REASSESS
THE TOTAL
FREQUENCY
OF HARM
NO
HAS
HARM
BOTH TO
PEOPLE AND TO THE
ENVIRONMENT BEEN
EVALUATED?
IDENTIFY
FURTHER
RISK REDUCTION
MEASURES AND
THE REQUIRED
PERFORMANCE
OF ANY MEASURE
INCLUDING THE
SIL IF THE
ADDITIONAL
MEASURE IS A SIS
systems
and
non-instrumented
FINISH
protection
How to LOPA
loop pass the independence test, the BPCS logic solver may
are allowed lower limits which are described in IEC 61511 9.4.2.
stand the needed response and have sufficient time to take the
added emphasis on other IPLs such as SIS, and add cost. It may
lead to a result with a higher SIL for a SIS. Quite apart from
the all eggs in one basket concerns, this may lead to extreme
very low PFD. If the alert for this is coming from a BPCS-driven
response.
demand, eg an SIL 3 SIS, the failure to ensure this PFD via the
loop) failure and then allow an alarm or trip driven from the
life cycle approach in IEC 61511 means that the top event could
How to LOPA
top event happens, and then bring in all the factors which affect
cost benefit analysis can be quite simple to do, but the diffi-
its outcome and frequency. A top event with severity lower than
you started, although the figures quoted for values are from
The practicalitieS
trained leader/facilitator;
or minimised.
Conclusion
maintenance;
instrumentation design engineer; and
LOPA is a simple method but requires you to know and obey the
process description;
operating instructions;
outcomes)