LOPA initiating frequencies: exposure and enabling conditions

Define the initiating event without the final harm

Consider an invented liquid-transfer scenario in which a control fault allows continued inflow after the intended stopping point. The initiating event is that fault under the defined transfer conditions. A release, ignition or injury is a later endpoint with additional conditions. Starting from an already observed release frequency and then crediting the protection that prevented other releases would mix different positions in the causal chain.

The HSE LOPA course outline identifies initiating data, enabling events and conditional modifiers as separate analytical issues. Its public outline is not a database of acceptable frequencies. The numbers below are created solely to demonstrate denominator accounting and must not be transferred to a real ship or terminal.

Convert an operating-hour rate with its exposure

Suppose the initiating-event rate is λ=2×10⁻⁴ per transfer-operating hour, and the system performs 600 transfer hours per year. The annual expected initiating count is fI=λH=0.12 events/year. Units cancel as h⁻¹ × h/year. The remaining 8,160 hours in a 365-day year do not belong in this exposure because the stated event cannot occur outside the modeled transfer activity.

Multiplying 0.12 again by 600/8,760 would give approximately 0.00822 events/year and count the same operating exposure twice. The error is about a factor of 14.6. Conversely, multiplying λ by 8,760 would assume transfer continues all year. Both errors come from ignoring the qualifier attached to the original rate.

Check an alternative per-operation basis

Suppose instead there are 300 transfers per year, each represented by a probability 4×10⁻⁴ of the defined initiating event. The expected annual count is 300 × 4×10⁻⁴ = 0.12. This agrees with the hourly calculation if the assumed average transfer duration is two hours and the models describe compatible rare initiating events.

Agreement does not justify swapping datasets indiscriminately. A per-transfer error may occur during setup regardless of duration, while a wear-related running failure accumulates with time. Doubling each transfer's duration may double the second contribution without changing the first. Separate startup, running and shutdown mechanisms when their exposure denominators differ materially.

Make the enabling condition explicitly conditional

Let E mean that sufficient inventory and the relevant receiving configuration exist for the initiating fault to progress to the chosen consequence. Assume P(E|I)=0.25 for the modeled initiating events. The enabled frequency is 0.12 × 0.25 = 0.03/year. The condition is evaluated among initiators, not among arbitrary calendar-time observations.

If the 0.12/year dataset already counted only initiating faults with that inventory and configuration, E is already included and must not be multiplied again. If initiators are more common during high-inventory transfers, an unconditional inventory fraction is not interchangeable with P(E|I). The correct evidence links operating state to the event population.

Apply protection to the enabled demand

For arithmetic only, assume two qualifying independent layers with conditional failure-on-demand probabilities 0.10 and 0.02. Then the selected consequence frequency is 0.03 × 0.10 × 0.02 = 6×10⁻⁵/year. The dimensionless factors leave the frequency unit unchanged. Neither probability is a recommended credit; independence, effectiveness and maintenance would require separate evidence.

A layer that prevents the initiating fault belongs in the initiating-event model if its performance was already included there. Crediting it again downstream repeats the same protection. The HSE offshore inspection guide's indexed text explicitly addresses independence from the initiating cause and justification of layer values. Offshore guidance supplies methodological context, not vessel-specific approval.

Do not convert an expected count into certainty

A frequency of 0.12/year is an expected count rate, not a promise of one event every 8.33 years. If a homogeneous Poisson model were additionally justified, the probability of at least one initiator in a year would be 1−e^(−0.12)≈0.1131. That conversion needs a process assumption, not just a unit change.

Closely spaced transfers can share an unrepaired fault, weather condition or crew setup. Such clustering may violate the simple Poisson picture even if the long-run average count remains 0.12/year. Expected counts and probabilities answer different questions; report the quantity used by the decision criterion and preserve the assumptions needed to connect them.

Separate exposure, occupancy and ignition

Transfer exposure enables the initiating event in this example. Human occupancy may modify an injury endpoint after a release, while ignition may modify a fire endpoint. These factors refer to different conditional populations. Multiplying a generic occupancy fraction into a release-frequency calculation changes the endpoint and can obscure environmental consequences that do not require a person to be present.

An operator's presence may also affect fault detection, so occupancy and response failure may be dependent. Likewise, transfer conditions that cause a release may influence ignition sources. Draw the causal sequence and label every conditional factor before deciding which multiplications are defensible. A list of familiar modifiers is not a substitute for this reasoning.

Test the denominator with a change in operations

If transfer hours rise from 600 to 900 per year while the hourly initiating rate and other factors remain unchanged, the enabled consequence frequency rises from 6×10⁻⁵ to 9×10⁻⁵/year. A spreadsheet that leaves the result unchanged is probably using a fixed annual input or an exposure multiplier inconsistently. This is a useful invariance test of the accounting.

The proportional result is conditional. More hours may change fatigue, test opportunity, inventory patterns or equipment aging. A real expansion should revisit those effects rather than assume only H changes. The simple sensitivity identifies which assumptions are being held fixed and where operational evidence is needed.

Treat a zero-event dataset as limited exposure

Suppose an illustrative dataset records zero initiating events in 10,000 transfer-operating hours. Under a homogeneous Poisson model with complete detection and comparable exposure, a one-sided 95% upper confidence bound on the rate is −ln(0.05)/10,000≈3.00×10⁻⁴ h⁻¹. Zero divided by exposure is the maximum-likelihood point estimate, but it does not establish that the event is impossible.

The model assumptions are substantial. Missing records, changes in definitions, heterogeneous equipment or an event that persists across operations can invalidate the simple interpretation. More calendar years without a transfer do not add transfer-operating exposure. Keep the confidence statement separate from any engineering margin, and do not automatically replace a rate with this bound unless the assessment's treatment of uncertainty calls for it. The example shows why numerator and denominator must travel together.

Write the counterfactual behind the initiating frequency

A LOPA initiating event is evaluated within a defined scenario, often asking what would happen if the credited downstream protection did not act. Operational records may instead contain only events that escaped detection, events that produced a demand or events that produced harm. These are different observation thresholds. Reconstruct which point in the causal chain the source actually counts before selecting a multiplier.

For example, an alarm log can contain several messages from one control fault, while a maintenance log can contain one repair covering several failed starts. Neither log count automatically equals the initiating-event count. A reconciliation record should explain event grouping, duplicate removal and the treatment of incomplete incidents. That documentary work can change the result more than adding another decimal place to the final frequency.

Keep a one-line provenance for every multiplier

A defensible worksheet records the event definition, numerical value, unit, denominator, observation period, included conditions and excluded protections. Add whether the value is measured, estimated or assumed and which changes would invalidate it. Keep initiator, enabling condition, protective failure and consequence modifier in distinguishable fields even when their arithmetic is multiplied together.

The aim is not the smallest final number. It is a chain in which each reduction has one clear job and no condition is counted twice. The public example demonstrates that discipline without supplying an operational frequency, a SIL assignment or an acceptance threshold for any marine system.

Sources

• LOPA: Practical application and pitfalls · UK Health and Safety Executive · Source check date: 2026-10-06
• Functional safety inspection guide · UK Health and Safety Executive / Offshore Major Accident Regulator · Source check date: 2026-10-06