Risk Assessment
What Makes a Protection Layer 'Independent' in LOPA?
Vinit Pandey · Published 4 August 2026
In short: A protection layer qualifies as independent in LOPA only if it is capable of preventing the scenario's consequence regardless of the initiating event and regardless of the success or failure of any other protection layer credited for the same scenario.
Key takeaways
- Independence has two dimensions: from the initiating event, and from other credited layers
- Crediting a control system as an IPL for a scenario it could itself cause violates independence
- Shared instrumentation or power supplies between layers can violate independence between them
- Incorrectly crediting a non-independent layer can significantly understate actual residual risk
Independence in LOPA has two distinct dimensions: independence from the initiating event (the safeguard doesn't share a common cause with whatever triggers the scenario) and independence from other credited layers (the safeguard doesn't share a common cause with another safeguard being counted for the same scenario).
A common failure in LOPA practice is crediting a control system as an independent protection layer for a scenario that the same control system's malfunction could itself cause — violating independence from the initiating event, since the safeguard and the cause are not truly separate.
Shared instrumentation, shared power supplies, or shared logic solvers between two nominally separate safeguards can violate independence between layers, a concern closely related to common cause failure analysis in SIL verification.
Because LOPA credits are multiplicative — each independent layer's probability of failure on demand reduces the scenario frequency further — incorrectly crediting a layer that is not truly independent can significantly understate a scenario's actual residual risk.