12.3 LOPA, Relief Systems, and Emergency Response

LOPA purpose: order-of-magnitude risk with independent layers

Layer of Protection Analysis (LOPA) is a simplified, semi-quantitative risk assessment method. Starting from a defined scenario (often from HAZOP)—initiating event, consequence, and unmitigated risk—LOPA asks: Do we have enough independent protection layers (IPLs) to reduce the frequency of the unwanted consequence to a tolerable level?

LOPA typically works in orders of magnitude (factors of ten), not in false-precision probabilities to six decimal places. That matches licensing-exam depth: understand the logic, not run a full corporate LOPA spreadsheet.

Independent protection layers (IPLs)

An IPL is a device, system, or action that is:

1. Effective — can prevent the consequence (or mitigate to a much less severe outcome) for that specific scenario.
2. Independent — not sharing common failure modes with the initiating event or with other claimed IPLs in a way that defeats the claim.
3. Auditable — design, testing, and performance can be verified (proof tests, inspections, procedures with evidence).

Typical LOPA storyline (conceptual)

1. Initiating event frequency (e.g., control valve fails open) estimated by order of magnitude.
2. Unmitigated consequence severity category assigned (e.g., multiple fatalities potential).
3. Each valid IPL multiplies risk reduction by ~10, ~100, etc., depending on credited PFD (probability of failure on demand) band.
4. Compare residual risk to corporate/tolerable risk criteria.
5. If insufficient, recommend additional IPL (often a SIS of appropriate SIL) or inherent changes.

Exam cue: LOPA is not a replacement for HAZOP scenario identification; it is a risk-order tool applied to defined scenarios.

SIL concept at high level; BPCS vs SIS

Safety Integrity Level (SIL)

SIL is a discrete level (commonly SIL 1–4 in IEC 61511/61508 practice) describing the average probability of failure on demand performance required of a safety instrumented function (SIF). Higher SIL means more risk reduction and stricter design, independence, testing, and lifecycle management.

For UPDA awareness:

• SIL applies to a function (sense–decide–act), not to a random transmitter alone.
• Higher SIL costs more and is harder to maintain; over-specifying SIL creates nuisance trips or neglected proof tests.
• Alarms in the basic control system are not automatically SIL-rated SIFs.

BPCS versus SIS

Common mode caution: If the same sensor is used for control and for the “safety” trip without proper independence, LOPA independence claims collapse. Exam answers should prefer independent safety measurements for high-risk scenarios.

Worked conceptual distinction

A reflux drum level is normally controlled by a BPCS level loop. If level rises toward overflow into a compressor suction, a SIS high-high level SIF may trip feed and/or compressor based on independent level measurement. Claiming both the normal controller and the trip as two full IPLs when they share one transmitter is incorrect.

Pressure safety valves / relief devices

Pressure relief devices are last-resort (or near last-resort) protection against overpressure that could rupture equipment. Common types:

Set pressure vs MAWP intuition

You do not need to memorize full ASME/API tables for UPDA, but you need correct relationships:

• MAWP (maximum allowable working pressure) is a fundamental equipment limit from design/code stamping practice.
• Set pressure of a relief device is the pressure at which the device is set to open, established so that overpressure during relief remains within code-allowed accumulation above MAWP/design limits for the governing case.
• Relief is sized for governing scenarios: blocked outlet, fire case, thermal expansion, control-valve fail open, chemical reaction, heat-exchanger tube rupture, etc.—identified partly through PHA/HAZOP and design standards.

Operational integrity of relief paths

Relief devices fail their mission when:

• Block valves under PSVs are closed without proper car-seal/LOTO control and administrative system
• Outlet lines are plugged, undersized, or routed unsafely
• Set pressure is wrong after MOC changes design conditions
• Devices are overdue for testing (mechanical integrity)
• Multiple devices interact incorrectly (instability)

Exam framing: Relief is an engineered IPL for overpressure, not a substitute for good control—and not permission to run routinely at the set point.

Emergency response and isolation basics

Even with strong prevention, plants plan for loss of control. Emergency response reduces harm after an initiating event progresses.

Isolation and shutdown concepts

Isolation strategy balances speed (stop the leak source) against process risks of sudden shutdown (water hammer, compressor liquid, thermal stress). Designers define sequences; operators train on them.

Emergency response layers

1. Detection — gas detectors, flame detectors, abnormal process alarms, CCTV, human observation.
2. Alarm and decision — control room protocols, muster criteria, emergency levels.
3. Mitigation systems — deluge, foam, monitors, water curtains (scenario-dependent).
4. Firefighting / rescue — plant brigade and mutual aid with industrial neighbors.
5. External notification — community and authority notification per site emergency plans.
6. Recovery — isolation confirmation, environmental monitoring, incident investigation before restart (PSSR mindset).

Drills and human factors

Procedures that exist only on shelves fail. Licensed engineers support realistic drills, clear roles, and learning from exercises. In toxic or flammable releases, wind direction, muster points, and refuge chambers (where provided) matter as much as pump curves.

Linking LOPA, relief, and emergency response

Think of a stacked response:

1. Inherent / prevention — smaller inventories, stable chemistry.
2. BPCS — normal control.
3. Alarms + operator — early intervention.
4. SIS — automated safe state.
5. Relief — protect equipment integrity on overpressure.
6. Passive mitigation — dikes, spacing, fireproofing.
7. Emergency response — people and active firefighting/evacuation.

LOPA credits some of these as IPLs with strict rules; emergency response is essential but often mitigative and human-dependent, so it may receive limited or no preventive IPL credit depending on corporate rules. Exam answers should not claim that a good fire brigade replaces proper relief and SIS design.

Section synthesis

LOPA judges whether independent layers cut scenario risk by orders of magnitude. SIL describes SIF integrity; BPCS ≠ SIS. Relief devices protect against overpressure relative to equipment limits. Emergency isolation and response manage residual events. Together they form the engineered backbone of process safety after hazards are identified.