LOPA Worksheet
Template (Excel)

A LOPA (Layer of Protection Analysis) worksheet is the semi-quantitative risk analysis document used to evaluate whether the existing Independent Protection Layers (IPLs) reduce the consequence frequency of a hazard scenario to a tolerable level, and to determine the Safety Integrity Level (SIL) target for any additional Safety Instrumented Function (SIF) required. LOPA was developed by CCPS (Center for Chemical Process Safety) and is the standard SIL determination method referenced by IEC 61511. Each worksheet row captures one consequence-of-concern for one hazard scenario, with initiating event, IPL credits, mitigated frequency, and the resulting SIL target.

Required columns: LOPA reference, unit and node, P&ID reference, HAZOP action reference, hazard scenario description, consequence category and severity per the project risk matrix, initiating event description, initiating event frequency per year (per CCPS Table, e.g., BPCS loop failure 0.1/yr, pump failure 0.1/yr), enabling condition probability, conditional modifiers (occupancy, ignition probability for fire), IPL descriptions and Probability of Failure on Demand (typical BPCS PFD 0.1, operator with effective alarm 0.1, relief device 0.01), total IPL RRF, mitigated event frequency, tolerable risk frequency per project basis, required RRF, SIL target per IEC 61511, SIF identifier, recommended action. See the LOPA standard reference.

Pathnovo, an engineering document intelligence platform, builds the LOPA worksheet by extracting HAZOP findings from the HAZOP register and the HAZOP register extraction workflow, cross-referencing the P&IDs for IPL identification (BPCS loops, relief valves, restriction orifices, vents, blowdown), and applying the project basis of design for IPL PFD credits, tolerable risk frequency, and conditional modifiers. Draft LOPAs are generated per HAZOP action with consequence frequency calculation. The LOPA chair and team review and approve before SIL assignment. See the HAZOP safety intelligence workflow.

HAZOP (Hazard and Operability Study) is a qualitative team workshop that identifies hazard scenarios on a node-by-node walk through the P&IDs using guidewords (more, less, none, reverse, etc.). LOPA is a semi-quantitative follow-on analysis that evaluates the frequency of consequence for the scenarios HAZOP flagged and decides whether additional protection (typically a SIF with a SIL target) is required. HAZOP runs first. LOPA runs on selected high-severity HAZOP actions. The two are complementary: HAZOP defines the hazards, LOPA quantifies and assigns SIL. See the HAZOP register template.

Per CCPS LOPA guidelines, an IPL must satisfy three criteria: it is effective in preventing the consequence (a passive or active barrier that stops or mitigates the scenario), it is independent of the initiating event and of other IPLs (failure of one does not cause failure of another), and it is auditable (its performance can be verified during testing or inspection). Typical IPLs include the BPCS (PFD 0.1 if independent of the initiator), an operator response to an independent alarm (PFD 0.1 if effective response time exists), a relief valve (PFD 0.01 if properly sized and tested), and a SIF (PFD per its SIL classification). Common-mode failures void independence.

Each LOPA worksheet row that requires additional risk reduction (the unmitigated frequency exceeds the tolerable frequency after IPL credits) generates a SIF requirement with a calculated Required Risk Reduction Factor (RRF). The RRF is mapped to a SIL band per IEC 61511 (RRF 10 to 100 = SIL 1, 100 to 1000 = SIL 2, 1000 to 10000 = SIL 3). The SIL target then drives the SIL determination worksheet and downstream SIF design (sensor architecture, logic solver, final element selection per SIL standard reference). See the SIL determination template.

On a brownfield revamp, the existing LOPA register is the baseline. Each scenario is reviewed against the revamp scope: changes to feedstock, throughput, operating conditions, or IPL credits may change the initiating event frequency or invalidate an existing IPL credit (e.g., a relief valve resized for new conditions resets its qualifying PFD). New equipment introduces new scenarios requiring fresh LOPA. On Indian PSU refinery revamps and GCC petrochemical projects, the LOPA must reference the current IEC 61511 (2016 edition) even if the original was performed against the 2003 edition. The OISD-118 compliance checklist covers the related plant safety audit interface.