Expanding from LOPA to quantitative bow tie analysis.

The layer of protection analysis (LOPA) is a ubiquitous part of the workflow for process hazards analysis and engineered safeguard design. LOPA became popular as an extension of process hazards analysis (PHA) techniques like hazard and operability (HAZOP) studies, where a little more formality and quantification were required to help better understand the risk or to provide order‐of‐magnitude design criteria for safeguards. Even so, from its inception LOPA has suffered from limitations that are rooted in the "one‐cause, one‐consequence" paradigm to the analysis that limits the scope. This limitation can result in design errors where engineered safeguards that protect against a consequence with multiple causes can be under‐designed by looking at one cause at a time. Also, safeguards that reduce the magnitude of consequences (i.e., mitigate) instead of preventing loss of containment cannot be addressed at all without ignoring the residual consequence that exists even if the safeguard activates successfully. While some extensions of LOPA that address the issue of multiple causes are commonly used, mitigative safeguards are rarely appropriately addressed and designed using LOPA. Finally, the textual nature of the process also makes results hard to communicate to nonpractitioners. Recent research into unified hazard assessment that combines HAZOP, LOPA, and bow tie analysis has yielded techniques that elegantly address all the limitations of LOPA while also providing a graphical presentation that facilitates result communication. This paper will provide background on how unified hazard assessment yielded the techniques of quantitative bow tie analysis. The paper will also describe in detail how to implement quantitative bow tie analysis along with the mathematical concepts used for quantification of risk for multiple causes and multiple consequences inside a single bow tie diagram. The concepts will be presented using example studies that include mitigative safeguards and multiple cause scenarios. [ABSTRACT FROM AUTHOR]