HiltonC
Most industrial facilities conduct a HAZOP. Fewer follow that HAZOP with a Layer of Protection Analysis. And almost none have explicitly mapped their fire and gas detection and suppression systems into their LOPA model with the rigor that IEC 61511 and modern Saudi Aramco engineering practice now expect. That gap — between identifying a fire or gas release scenario in a HAZOP and actually quantifying whether the protection layers covering it are sufficient — is where facilities get into serious trouble during audits, insurance reviews, and, most critically, real emergencies.
This article explains what Layer of Protection Analysis is, how it connects to fire and gas system engineering, what Saudi industrial operators are expected to demonstrate, and why closing this gap is a business-critical priority, not just an engineering formality.
What LOPA Is and Why It Follows HAZOP
A HAZOP (Hazard and Operability Study) is a structured, qualitative review of a process that identifies what can go wrong, what causes it, and what consequences result. It is an essential first step. But HAZOP is inherently qualitative — it identifies hazard scenarios and lists safeguards, but it does not tell you whether those safeguards are sufficient to reduce risk to a tolerable level.
That is what LOPA does. Layer of Protection Analysis takes individual HAZOP scenarios and evaluates them semi-quantitatively. For each scenario, LOPA identifies:
- The initiating cause and its frequency of occurrence
- Each independent protection layer (IPL) that can prevent the consequence
- The probability of failure on demand (PFD) for each IPL
- The resulting mitigated event frequency, compared against a tolerable risk target
If the mitigated frequency does not meet the target, the analysis reveals a gap — and that gap must be closed by adding or strengthening a protection layer. This is the engineering logic that drives Safety Integrity Level (SIL) determination for Safety Instrumented Systems (SIS), and it is also the framework that should be used to evaluate whether fire and gas detection, suppression, and shutdown systems are providing the credited risk reduction they are assumed to deliver.
Where Fire and Gas Systems Fit in the LOPA Model
Fire and gas systems occupy a specific and often misunderstood position in a LOPA model. They are not always Independent Protection Layers in the IEC 61511 sense — an IPL must be independent, auditable, and capable of preventing the consequence without relying on other systems that have already failed. Whether a fire and gas system qualifies depends on the scenario being analyzed.
For a hydrocarbon release and flash-fire scenario, a gas detection system that triggers Emergency Shutdown (ESD) before ignition occurs may legitimately be credited as an IPL, provided it is properly engineered, tested, and independent of the initiating cause. A fixed suppression system activated after ignition, on the other hand, is typically a consequence-mitigation layer — it reduces the severity of a fire event rather than preventing it. These are different roles, and confusing them leads to double-counting risk reduction credits that do not exist in practice.
The discipline that LOPA imposes is valuable precisely because it forces this clarity. When a facility lists “fire and gas system” as a safeguard in a HAZOP without specifying whether it functions as an IPL, a mitigation layer, or simply a response-enabling system, it creates a false sense of coverage. LOPA requires the engineering team to define exactly what each system does, when it acts, at what PFD it is credited, and how that credit is verified through inspection and testing.
This is where NFPA 25 inspection and testing requirements become directly relevant to a process safety argument. If a suppression system is credited in a LOPA at a given PFD, that credit must be defensible — and defensibility comes from documented, traceable inspection and testing records that demonstrate the system performs as designed.
IEC 61511 and SAES Expectations for Saudi Operators
IEC 61511 is the international standard for Safety Instrumented Systems in the process industry. It establishes the lifecycle requirements for SIS — from hazard identification through LOPA, SIL determination, design, installation, commissioning, and ongoing verification. Saudi Aramco engineering standards align with and in several areas expand upon IEC 61511 requirements, and the expectation for major projects and operating facilities is that LOPA be conducted as part of a structured process safety management program.
For operators in Saudi Arabia, this has practical implications that go beyond engineering preference. Saudi Aramco project execution requirements expect a demonstrable risk reduction argument for any scenario where a SIS function is used — and that argument is built on LOPA. Third-party auditors, insurers, and Saudi Civil Defense authority reviews are increasingly looking for this documentation. Facilities that cannot produce a traceable LOPA supporting their fire and gas system design are exposed during audits in ways that their HAZOP alone cannot resolve.
Several elements are critical to a LOPA that satisfies this level of scrutiny:
- Scenario boundary definition. Each LOPA scenario must have a clearly defined initiating event, consequence endpoint, and risk target. Vague scenario definitions undermine the entire analysis.
- IPL independence verification. Every credited IPL must be demonstrably independent of both the initiating cause and other credited layers. Fire and gas systems must be reviewed against this criterion, not assumed to pass it.
- PFD data sourcing. Failure probability values must come from recognized databases (such as OREDA or ISA TR84.00.02) or facility-specific validated data. Invented or uncited PFD values are a direct audit finding.
- SIL assignment for SIS functions. Where the LOPA reveals a residual risk gap, the required SIL for the SIS function must be formally assigned and documented, driving the design, testing frequency, and proof-test interval for that function.
- Linkage to testing and maintenance. The PFD credited in the LOPA must be achievable in practice, which means the inspection and test frequencies mandated by the SIL assignment must be actively maintained and recorded.
The Business Case for Getting LOPA Right
It is tempting to treat LOPA as a compliance exercise — something done to satisfy an auditor and then filed. That framing misses the actual business value. When LOPA is done correctly and kept current, it does several things that directly affect operational and financial outcomes.
First, it tells you where your real risk concentrations are. A facility with hundreds of process lines and dozens of fire and gas zones cannot devote equal engineering attention to every area. LOPA reveals which scenarios carry the highest residual risk after existing safeguards are credited — those are the areas that justify additional capital investment in protection systems, structural fireproofing, or detector density. Without that analysis, capital gets distributed based on engineering intuition or regulatory minimum compliance, not risk priority.
Second, it provides the auditor-defensible documentation that insurance underwriters are increasingly requiring for major industrial facilities. A LOPA-backed safety case — showing that each credible fire and gas release scenario has been evaluated, that protection layers are independent and tested, and that SIS functions are SIL-rated and verified — materially reduces insurance risk assessment scores. For large industrial operators, the premium implications are not trivial.
Third, it protects the organization when something does go wrong. A facility that can demonstrate it conducted rigorous LOPA, implemented the engineering recommendations, and maintained the required testing program is in a fundamentally different position — legally, regulatorily, and reputationally — than one that relied on a HAZOP and a list of safeguards that were never quantitatively evaluated.
Process safety management programs that integrate LOPA as a living document — updated when process changes occur, when Management of Change events are triggered, or when inspection findings reveal degraded protection layer performance — create a compounding risk-reduction effect over time. The facilities that do this consistently are the ones that stay out of incident investigations.
The Bottom Line
LOPA is the bridge between identifying a fire and gas hazard in a HAZOP and being able to demonstrate — quantitatively, traceably, and defensibly — that the protection layers covering that hazard are sufficient. For Saudi industrial operators working under IEC 61511 expectations and Saudi Aramco engineering requirements, this is not optional engineering rigor. It is the foundation of a credible process safety case.
The practical starting point for most facilities is a gap assessment: map your existing HAZOP scenarios against a LOPA framework, identify where fire and gas systems have been assumed as safeguards without formal IPL credit evaluation, and determine where SIL assignments are missing or unsupported. That assessment alone will surface the highest-priority engineering work. From there, the path to a defensible safety case is structured, executable, and measurable — which is exactly how fire protection engineering should be.
Work With Ignis Sentinel Engineering
Need a fire risk assessment, a third-party plan review, or an NFPA/SAES
compliance check for your facility? Our engineers help Saudi and international
industrial operators design safer operations.
