LOPA in Occupational Safety: 4 Decisions That Expose Weak Protection Layers

F1 critical diagnostic for process-safety and plant leaders

A LOPA study can produce a confident-looking worksheet while the real protection system remains dependent on one alarm, one technician, or one assumption that nobody has tested. The method becomes valuable only when it changes the risk decision and exposes which layers are truly available at the point of exposure.

LOPA, or Layer of Protection Analysis, is a semi-quantitative method for examining a defined hazardous scenario, its initiating event, and the independent protection layers that prevent or mitigate the consequence. This article focuses on four decisions that determine whether the analysis supports control or merely documents optimism.

1. Why does LOPA matter when the process already has a risk assessment?

A broad risk assessment can identify hazards across a process, while LOPA concentrates attention on a specific scenario and asks whether the credited safeguards are enough for the consequence under review. Those are different jobs. One maps the risk landscape, and the other tests a protection claim.

The distinction matters when a plant has several controls that appear to be separate but share a sensor, power supply, control logic, inspection routine, or human response. A risk register may record the hazard, and a procedure may describe the response, yet neither document proves that the layers will remain available when the initiating event occurs.

OSHA’s recommended safety-management practices connect leadership, worker participation, hazard identification, and hazard control. LOPA can support that system when the study is connected to decisions about design, operation, maintenance, and escalation rather than stored as an isolated engineering record.

2. Decision one: can the team define one credible scenario?

The first decision is the boundary of the scenario. A useful LOPA statement identifies the equipment, hazardous event, initiating event, consequence, operating state, and exposed people or assets. If the statement contains several pathways joined by “or,” the team may be trying to analyze a family of scenarios that require different layers.

Consider a hypothetical transfer system in which loss of containment could expose a worker to a flammable vapor. “Chemical release” is too broad for a disciplined analysis. The team needs to state where the release begins, what starts it, how the material reaches the exposure zone, and which consequence is being evaluated.

This precision prevents a common distortion. When the consequence is vague, every alarm, inspection, training session, and emergency plan can be counted as protection, even though some of those measures address a different pathway or act too late to change the outcome.

Before accepting the scenario, ask a person who operates or maintains the system to describe how the event would appear in the field. Their explanation should challenge the drawing, because the work sequence, access point, isolation condition, and recovery action may differ from the design narrative.

3. Decision two: are the initiating events being treated as real conditions?

LOPA does not begin with safeguards. It begins with what could initiate the scenario. The team should identify credible causes such as equipment failure, utility loss, incorrect lineup, control-system malfunction, human error, external impact, or an abnormal operating condition that the design does not handle well.

The initiating-event discussion is where production history often becomes misleading. A plant may have no recorded release from a particular line, but the absence of a report does not establish that the initiating event is impossible. It may show that the event is rare, that the control worked, or that the exposure was not recognized.

James Reason’s work on latent failures is useful here because it directs attention toward design choices, maintenance conditions, supervision, and organizational decisions that make an active failure more likely. The analysis should therefore examine how the system is actually prepared, operated, inspected, and restored.

If the team cannot explain why an initiating event is credible or why it is excluded, the LOPA record is not ready. An unsupported frequency estimate gives the worksheet mathematical appearance without giving leaders a defensible decision.

4. Decision three: are the credited layers genuinely independent?

Independence is the central test. Two safeguards do not become independent because they have different labels. If both depend on the same transmitter, the same controller, the same air supply, the same inspection, or the same person noticing the same indication, a single failure can defeat both.

Imagine a high-pressure alarm and an automatic shutdown that rely on the same pressure transmitter. They may perform different actions, but a transmitter failure can remove both protections. The layer count then overstates resilience and understates the consequence of a common-cause failure.

The NIOSH hierarchy of controls gives leaders a useful complementary lens because it distinguishes controls that reduce exposure through design from controls that depend heavily on human interaction. LOPA is not a substitute for that hierarchy. It is a way to test the protection architecture after the scenario and control choices are clear.

Ask four questions for every credited layer. What detects the condition? What action follows? What failure can defeat it? Which evidence proves that it will work when needed? A layer that cannot answer those questions should be downgraded, redesigned, or removed from the credit calculation.

5. Decision four: who owns the layer after the workshop ends?

A LOPA workshop can identify a strong safeguard and still leave the organization exposed if nobody owns its continued performance. Ownership includes the authority to maintain the layer, the resources to test it, the duty to respond to impairment, and the power to escalate when the layer cannot be restored.

This is where many analyses lose contact with operations. The report says that a shutdown system exists, but the plant has no visible rule for overdue proof testing, bypass approval, degraded instrumentation, or conflicting production priorities. The layer is present in the document and absent in the decision path.

Write the owner next to the layer, not in a separate action list. Then define the evidence that the owner must produce, such as a test result, inspection record, calibration status, field observation, or verified restoration. A control-owner interview can help reveal whether the named owner has the authority and practical capacity to keep the barrier effective.

Andreza Araujo’s safety leadership perspective makes this a cultural test as well as a technical one. A company demonstrates that it values prevention when it makes control ownership visible before an impairment becomes an emergency.

6. What assumptions should appear in the LOPA record?

Every LOPA depends on assumptions about demand, response time, equipment condition, human action, maintenance quality, occupancy, and operating mode. The record should make those assumptions readable to someone who was not in the workshop.

Document the conditions under which the layer is credited and the conditions that invalidate the credit. An operator response may require a recognizable alarm, enough time, a clear procedure, a trained person, a workable access route, and authority to act. If one of those conditions changes during a night shift or abnormal operation, the protection claim may no longer hold.

ISO 45001:2018 frames occupational health and safety management as a system for managing risks and improving performance, with leadership, worker participation, operational control, emergency preparedness, and review connected. The ISO 45001 overview supports the same governance lesson. A LOPA assumption should enter the management system where it can be maintained, reviewed, and challenged.

7. How should LOPA connect to field verification?

The workshop is an analytical event. The field is where the protection claim meets equipment, people, time pressure, weather, access, and maintenance reality. The two must be linked before a leader treats the study as evidence that risk is controlled.

Walk the scenario with operations, maintenance, engineering, and the people who would respond to the initiating event. Check whether the isolation point can be reached, whether the alarm can be recognized, whether the shutdown produces the expected state, and whether a worker can complete the required response without entering a new exposure.

Use the same discipline applied in a critical-control verification. The question is not whether someone remembers the procedure. The question is whether the control is available, understood, and effective in the conditions in which the work actually occurs.

8. What should leaders do when a layer is weak or unavailable?

A weak layer should trigger a decision, not a more attractive chart. The available choices may include redesigning the control, reducing the operating envelope, adding a genuinely independent safeguard, changing the sequence, stopping the task, or accepting a temporary condition through a defined authority process.

Use a decision table that distinguishes the evidence from the response.

The risk-ownership decision should be explicit when the remaining exposure cannot be removed immediately. A vague statement that “operations will manage it” is not an owner, a control, or a time boundary.

9. What should a plant leader do this month?

Select one high-consequence scenario that leaders already believe is protected. Ask the study team to restate the scenario, list the initiating events, show the dependencies between layers, and identify the evidence that proves each layer is available.

Then take the analysis to the field. Include the people who operate, maintain, inspect, and respond to the system, because their practical knowledge often reveals assumptions that a design review leaves invisible. If the analysis changes no decision, no owner, and no verification activity, it has not yet done its job.

• Choose one scenario with a consequence that matters to the operation.
• Test every credited layer for independence and common-cause failure.
• Name the owner and the impairment response for each layer.
• Verify the critical controls in the work area.
• Escalate any remaining exposure with a clear authority and time boundary.

LOPA earns its place in occupational safety when it makes protection claims harder to exaggerate. The method does not create safety by counting layers. It creates better decisions by showing which layers are independent, which assumptions are fragile, and which owner must act before the scenario reaches the field.