Simple Layer of Protection Exercise

The CCPS book “Layer of Protection Analysis: Simplified Process Risk Assessment” has been the definitive reference for performing Layer of Protection Analysis (LOPA) since it was published in 2001.

LOPA is a simplified form of risk assessment which typically uses order of magnitude categories for Initiating Event Frequency (IEF), Consequence severity, and the likelihood (probability) of failure of Independent Protection Layers (IPLs) or Conditional Modifiers (CMs) to approximate the risk of a scenario.

Click for details

To help explain the principles to stakeholders (Operational and/or Management for example) who are less familiar with the concept, we’ve developed a simple card game or training exercise which can be played digitally (as shown in the video below) or physically with customised playing cards.

Click Watch on YouTube for Captions

The basic rules are relatively simple – the aim is to reduce the likelihood of a randomly selected hazardous event or scenario by assembling a collection of appropriate protection layers using order of magnitude frequencies & probabilities.

  • Up to 4 players can construct a Scenario (each are assigned a row).
  • Start by drawing (click to flip) from the Cause deck and place on the left-hand holder – this has a value according to the initiating event frequency (1 = Most frequent to 6 = Least frequent).
  • Draw a card from the Consequence deck and place on the 2nd from left holder – this has a value according to the tolerable/target event frequency (1 = Most tolerable to 6 = Least tolerable).
  • The aim is to create a Mitigated Event score to be equal to or less than the Target score. Subtract the Cause value from the Consequence value to get the gap which has to be closed by one or more Control cards
    • e.g. a Cause (card) with a value of 1 which could lead to a Consequence (card) with a value of 4 requires a risk reduction of 3. This could be a single Control with a value of 3 or several controls whose values add up to 3 or more.
  • Draw a card from the Controls deck and place on the 3rd from left holder – this has a value according to the risk reduction it provides (1 = Least effective to 3 = Most effective).
  • Players take it in turn to draw from the Controls deck to create their scenario. Once you’ve drawn a Controls card, play moves on.
  • The winner is the first to close the gap (or better i.e. if they reduce the risk more than required).


  • If a Controls card has a zero value e.g. inadequate human response or ignition control, then they have to put the card in the bin (they can’t develop their scenario until their next turn) and play passes to the next person.
  • If a Controls card is similar to the Cause e.g. both BPCS or both Human, then they have to put the card in the bin and play passes to the next person.
  • If a Controls card is similar to another Controls card in their scenario e.g. both pressure relief or ignition control or SIF, then they have to put the card in the bin and play passes to the next person.
  • If a Controls card is not an appropriate mitigation measure e.g. reduced occupancy for an Environmental or Financial consequence, then they have to put the card in the bin and play passes to the next person.


Tables can be configured in a number of different ways (click on images to enlarge):


  • Threats (Causes) on the Left
  • Consequences on the Right
  • Barriers (Controls) in between


  • Causes on the Left
  • Consequences next right
  • Safeguards (Controls) to the right


  • Consequences on the Left
  • Causes next right
  • Protection Layers (Controls) to the right


  • Players have to describe the cards they’ve deal e.g. give an example from their experience. If they cannot give an appropriate explanation, they cannot play that card and it goes into the bin stack.
  • Cards can be customised to suit corporate or industry types & values e.g.

In this prototype, examples from the CCPS LOPA book have been used to illustrate the principles. .


Causes are taken from Table 5.1 (Initiating Events):

Note that the following Causes are not frequencies:

  • Crane Load Drop (per lift)
  • LOTO Failure (per opportunity)
  • Trained, Unstressed, Not Fatigued Operator Failure (per opportunity)

For simplicity, the game should assume that these occur at 1 lift or opportunity per year.


Consequences are illustrative only.


Controls are taken from Table 6.3 (Passive IPL), Table 6.4 (Active IPL), Table 6.5 (Human IPL) & Figure 7.1 (Ignition Controls).


Cards and games are not intended to replace proper analysis conducted by competent & experienced personnel. For more guidance on the principles of Layer of Protection Analysis, please click on the images below:

Click for details
Click for details

Cards (and digital game boards) can be branded to suit and physical cards can be created in magnetic format to play in a workshop environment.

For more information on all our cards & initiatives – please contact us. All materials (physical cards/boxes and digital cards/platforms) can be customised to match your technical & local languages – please visit our Options page for more details.

If you’d like to subscribe to future updates, please submit your email address below – many thanks for your interest.

One thought on “SLOPE