One company's observations on the implementation of LOPA

Layer of Protection Analysis (LOPA) has gained popularity as a semi‐quantitative risk assessment tool, but often unexpected difficulties are encountered when rolling out LOPA. This article discusses the practical aspects of LOPA implementation in Marathon Petroleum Company LP's Refining Organization (MPC Refining). Specifically, it shows how scenarios are selected from a Hazard and Operability Study (HAZOP) and how they are organized for conducting LOPA efficiently, and it discusses whether to conduct LOPA concurrently or after the HAZOP. The article also compares the [cause → consequence] or [consequence → cause] methodology and addresses the implications of combining multiple causes in a single scenario. Another key aspect of LOPA implementation is the set of numerical values used for frequencies, modifiers and risk‐reduction factors. The article shows how numerical values should be tied to the risk matrix and how internal consistency is achieved through the use of standardized values and restrictions on the use of frequency modifiers. It discusses potential solutions for cases where the LOPA outcome does not meet the risk target. Finally, the article shows how the use of application standards can supplement LOPA by defining minimum protections and providing standard LOPA scenarios. © 2017 American Institute of Chemical Engineers Process Saf Prog 36: 284–291, 2017