LOPA method: principle and example of application

In France, since 2003, the influence of the Bachelot law and the introduction of Technological Risk Prevention Plans (PPRT) have led to a significant change in the way risks are assessed. Indeed, regulatory changes have led to a plebiscite for so-called probabilistic analyses. As a result, hazard studies (EDD) are no longer limited to a purely deterministic approach, and manufacturers are required to explain the link between the results of their EDD and their choices in terms of risk control measures (MMR).

In a much broader sense, when carrying out risk analyses, safety barriers are valued in order to justify that risks are prevented and controlled. Several questions spring to mind:

• Do I have enough safety barriers?

• How do you precisely define the need for risk reduction?

• Are the barriers in place sufficient to justify an acceptable residual risk?

In order to justify a low residual risk, a natural tendency might be to try and make the most of as many barriers as possible. Unfortunately, such an approach can prove counter-productive, as stacking barriers is no guarantee of good risk control. What's more, this bias in reasoning can create a false sense of over-safety, and ultimately lead to an accident.

The emergence of the IEC 61511 standard on the integrity level of safety instrumented functions (SIF) has highlighted the need for methodologies to determine the level of integrity or SIL (Safety Integrity Level) required for SIF. Accordingly, IEC 61511 describes a number of methods for achieving this objective. One of these is the LOPA (Layer Of Protection Analysis) method. Although the above-mentioned standards are specific to RIS, the principle of the methods proposed in the standards can be applied to all types of barrier.

Experience shows that many of the safety barriers installed on industrial sites are the result of :

• a response to regulatory requirements;

• common sense;

• taking into account feedback and accident data.

Generally speaking, it is not uncommon in ESDs to come to the conclusion that the safety barriers implemented by manufacturers justify an acceptable level of residual risk. As a result, a pragmatic approach based on one or more of the above three criteria may prove effective.

The idea of matching safety barriers to a need (a risk reduction factor) is, after all, a relatively recent one. While the concept may seem obvious in hindsight, it is much more difficult to implement, and requires methods to...