What This Course Covers and Who It Is For

A process plant holds energy and hazardous material inside equipment. Engineers add protection around each way that energy or material could escape. The hard question is not whether protection exists. It is whether the protection is enough, and whether the protection that is claimed will really work when it is needed. Layer of protection analysis (LOPA) is a structured way to answer that question for one scenario at a time. You will also see it written as "layers of protection analysis"; both names mean the same method.

This course is written at an advanced level. It assumes you have taken part in hazard studies and know the basic idea of a risk matrix. You will be asked to design scenarios, defend or reject protection claims, set and challenge risk targets, and judge when the method itself is the wrong tool.

Who uses LOPA

Process safety engineers lead most studies. Control and instrument engineers use the output to specify safety instrumented functions. Operations representatives provide the reality check on operator response and on how the plant is really run. Managers approve the risk criteria and accept the residual risk. Auditors and regulators read the results to judge whether a facility is adequately protected.

Worked example: a design-stage decision

During design of a gas compression unit, a hazard study finds that a blocked discharge could overpressure a cooler. The design already has a high-pressure alarm and a relief valve. The project must decide whether to add a high-pressure trip. Without LOPA, the decision is an argument between "two safeguards is plenty" and "we always add a trip". With LOPA, the team estimates the frequency of the overpressure, tests whether the alarm and the relief valve qualify as independent layers, and compares the result with the company's tolerable frequency. The answer may be that the trip is needed, or that it is not, but either way the reasons are written down and can be challenged.

Worked example: an operating plant

An existing refinery unit has run for twenty years. A new company standard sets a lower tolerable frequency for scenarios that could cause multiple fatalities. The site uses LOPA to re-screen its highest-consequence scenarios against the new target. Several scenarios now show a gap of one order of magnitude. The site plans the closure of each gap over the next two turnarounds and records interim measures, such as extra operator rounds, until the work is done.