LOPA

LOPA (layer of protection analysis, from the CCPS literature) takes a scenario — one initiating event leading to one consequence — and counts the independent protection layers (IPLs) in the path: the BPCS loop, the alarm with operator response, the safety instrumented function, the relief valve. Each qualifying layer is credited with a probability of failure on demand, typically an order of magnitude, and the arithmetic shows whether the scenario meets the target frequency or needs another layer.

The discipline in LOPA is the word independent. A layer only counts if it is independent of the initiating event and of every other credited layer — the same operator cannot be two layers, and a safeguard defeated by the same power failure as the initiating event earns no credit. This is the quantitative cousin of the qualitative question a bowtie asks through degradation factors: what defeats this barrier, and does it defeat its neighbours too?

LOPA and bowties are complements, not rivals. LOPA proves a specific scenario has enough layers; the bowtie shows the whole top event — every threat, every consequence, every barrier — in a form operations can own and auditors can read. A common pattern: LOPA sets the required layers; the bowtie carries them forward as controls with performance standards.

The process safety template is written so a LOPA reviewer can trace the IPL thinking inside the barrier set.