LOPA Scenarios: Expected Vs. Worst Case

Before performing a Layer of Protection Analysis on a scenario, the scenario must be adequately defined. Since LOPA is not a hazard identification tool, but rather a risk analysis tool, the initiating event and the consequences of interest in the analysis are inputs. LOPA is a means of critically evaluating the controls present to prevent or mitigate the scenario of interest and determining the predicted frequency of the event. After the LOPA is concluded, the predicted frequency for the scenario can be compared against a standard value for the consequence being evaluated to determine if the scenario has adequate controls or if additional controls are recommended. When additional controls are recommended (i.e. the predicted frequency is greater than the target frequency), the LOPA will indicate the appropriate reliability of the controls added that will reduce the predicted frequency to the target value.

The first issue that must be addressed when performing a LOPA is the scenario to be evaluated. The choice of scenario impacts the remainder of the LOPA analysis. There are at least two schools of thought prevalent in the process industry for the scenarios that should be used when performing a LOPA. One school of thought focuses on worst case scenarios. Worst case scenarios are defined by the most severe initiating event, the failure of all active controls, and the worst possible outcome for the evaluation of consequences. This is contrasted with the school of thought that focuses on expected scenarios. The scenarios focused on by practitioners of this school may use a more likely initiating failure mode, embed certain conditional modifiers or even independent protection layers in the analysis, and may focus on consequences which are not necessarily the worst case.

These two approaches are compared with guidance provided on which scenarios should be considered when conducting a LOPA analysis. Examples are provided which show that assuming either of these extreme approaches can result in the under prediction of the risk to the facility being analyzed, the recommendation of less rigorous controls, and therefore, the implicit acceptance of higher risk for a scenario than a company’s risk criteria would indicate.