Cyber-LOPA
A cyber-angle reworking of the LOPA study, according to ISA TR84.00.09. It lives in the Cyber-LOPA tab of the ZCR 2 page of the IEC 62443 module.
Two prerequisites
The "SIS analysis" profile must be enabled (Configuration tab of the IEC context), and a LOPA study must exist in the Industrial Risks module — this is a mixed-project use case.
Principle
The Import / refresh from LOPA button creates a working copy of the LOPA scenarios. Here you qualify what the attacker can neutralise, and the residual probability is recalculated.
The original LOPA study is never modified
Cyber-LOPA is a parallel reading. Refreshing re-imports the scenarios without overwriting cyber qualifications already entered.
What is qualified
| Column | Question |
|---|---|
| EI cyber-attackable | Can the initiating event be triggered by a cyberattack? |
| Barriers (IPLs) — vulnerable? | Can each barrier be neutralised by the attacker? |
| CIPL | Number of barriers independent from a cyber standpoint |
Calculation rules
| Situation | Effect |
|---|---|
| EI cyber-attackable | Frequency = 1/year (worst case) |
| EI not attackable | Frequency = 0 |
| Cyber-vulnerable IPL | PFD = 1 — no credit |
| Sound IPL | Original PFD retained |
| ≥ 2 independent CIPLs | PFD 0.2 each (CRRF 5) |
Row priority is set by decreasing severity, then probability.
Worst-case logic
An initiating event flagged as attackable is brought down to 1/year, regardless of its original accidental frequency: against an attacker, a natural occurrence frequency no longer means anything. This is the same logic as the "unmitigated worst case" of ZCR 2.1.
The result
The calculated residual probability feeds the Vp column of ZCR 2, in decomposed rating mode.
Consistency check
The "barrier double-counting" check on the Safety ↔ Security page detects rows that credit the same barrier twice — in Vp and in Cyber-LOPA.