LOPA - Most Common Mistakes
LOPA - Most Common Mistakes
What are the most common mistakes which can happen during SIL determination using LOPA?
Re: LOPA - Most Common Mistakes
I will make sure that I don't leave any common mistakes which we do during LOPA for SIL determination.
1. Treating Basic Process Control System (BPCS) as Independent When It Is Not
2. Giving Credit to Operator Response Without Verifying Reality
3. Double Counting IPLs
4. Using Unrealistic Initiating Event Frequencies
5. Confusing Safeguards With IPLs
6. Ignoring Common Cause Failure
7. Wrong Consequence Severity Selection
8. Applying Generic PFD Values Blindly
9. Not Defining the Scenario Properly
10. Assuming a PSV Always Eliminates Risk
11. Ignoring Enabling Conditions
12. No Validation of Time Available for SIS Action
13. Treating HAZOP Recommendations as IPLs
14. Poor Documentation of Assumptions
15. SIL Inflation Due to Weak LOPA Discipline
1. Treating Basic Process Control System (BPCS) as Independent When It Is Not
2. Giving Credit to Operator Response Without Verifying Reality
3. Double Counting IPLs
4. Using Unrealistic Initiating Event Frequencies
5. Confusing Safeguards With IPLs
6. Ignoring Common Cause Failure
7. Wrong Consequence Severity Selection
8. Applying Generic PFD Values Blindly
9. Not Defining the Scenario Properly
10. Assuming a PSV Always Eliminates Risk
11. Ignoring Enabling Conditions
12. No Validation of Time Available for SIS Action
13. Treating HAZOP Recommendations as IPLs
14. Poor Documentation of Assumptions
15. SIL Inflation Due to Weak LOPA Discipline
Re: LOPA - Most Common Mistakes
Quite an extensive list!
Double counting IPLs mean considering alarm high & high-high twice or how this mistake can be done?
Double counting IPLs mean considering alarm high & high-high twice or how this mistake can be done?
Re: LOPA - Most Common Mistakes
Not necessarily. High alarm and high-high alarm are not automatically double counting. The issue is whether they are independent IPLs and whether they truly provide separate risk reduction.
Some practical examples:
Example: High Alarm + Operator Action + SIS Trip
You have:
High Pressure Alarm (PAH)
Operator reduces feed
High-High Pressure Trip (PAHH) initiating SIS shutdown
This is usually NOT double counting if:
PAH + operator response is one IPL
PAHH SIS trip is another IPL
They use separate sensors or independence requirements are met
Operator action occurs before SIS activation
In this case, two distinct protection layers exist.
------
Example 2: High Alarm and High-High Alarm Both Requiring Operator Action
You have:
PAH -> operator intervenes
PAHH -> operator intervenes
Some teams assign:
IPL #1 = High alarm response
IPL #2 = High-high alarm response
This is generally double counting because:
Same operator
Same control room
Same final action
Same failure modes
If the operator misses the first alarm, there is a significant chance they will miss the second as well.
Therefore, operator response is normally credited only once.
Some practical examples:
Example: High Alarm + Operator Action + SIS Trip
You have:
High Pressure Alarm (PAH)
Operator reduces feed
High-High Pressure Trip (PAHH) initiating SIS shutdown
This is usually NOT double counting if:
PAH + operator response is one IPL
PAHH SIS trip is another IPL
They use separate sensors or independence requirements are met
Operator action occurs before SIS activation
In this case, two distinct protection layers exist.
------
Example 2: High Alarm and High-High Alarm Both Requiring Operator Action
You have:
PAH -> operator intervenes
PAHH -> operator intervenes
Some teams assign:
IPL #1 = High alarm response
IPL #2 = High-high alarm response
This is generally double counting because:
Same operator
Same control room
Same final action
Same failure modes
If the operator misses the first alarm, there is a significant chance they will miss the second as well.
Therefore, operator response is normally credited only once.