Functional Safety · worked example, computed with First Out AI
A SIL 3 HIPPS where partial stroke testing closes the gap
Two valves and three transmitters look like plenty of redundancy, and the result lands in the SIL 3 band. Whether it delivers the risk reduction the LOPA asks for depends on the valves' common cause failures and on how often they are exercised.
Scenario
A pipeline rated below the source pressure is protected by a high-integrity pressure protection system (HIPPS) instead of full-flow relief. If the upstream control valve fails open, pressure rises towards the source pressure.
Three transmitters voted two out of three close two shutdown valves in series, either of which isolates the pipeline.
SIL determination by LOPA
| Step | Item | Value | Note |
|---|---|---|---|
| Initiating event | Upstream pressure control valve fails open into a lower-rated pipeline | 0.2 /yr | generic value for a control valve failing open; confirm with site history |
| Independent protection layer | Operator response to an independent high-pressure alarm | PFD 0.1 | |
| Conditional modifier | Probability a person is within the hazard zone | 0.1 | |
| Mitigated event frequency | without the SIF | 2.0 × 10⁻³ /yr | |
| Tolerable frequency | company criterion (illustrative) | 1.0 × 10⁻⁶ /yr | |
| Required risk reduction | PFDavg ≤ 5.0 × 10⁻⁴ | RRF 2,000 | SIL 3 |
Required risk reduction 2,000: SIL 3, PFDavg ≤ 5.0 × 10⁻⁴.
Architecture and input data
Each valve's coverage of 95 % assumes a full stroke with a tightness check, and a 10-year overhaul. A β of 10 % reflects two identical valves on the same line.
| Subsystem | Voting | λDU /h | λDD /h | λS /h | β | Proof test | Coverage | Renewal / overhaul | Partial stroke | Type | SC | SFF |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Pressure transmitters | 2oo3 | 1.5 × 10⁻⁷ | 6.0 × 10⁻⁷ | 3.0 × 10⁻⁷ | 5% | 1 yr | 98% | 20 yr | – | B | SC 3 | 85.7% |
| Logic solver | 1oo1, internal HFT 1 | 1.0 × 10⁻⁹ | 5.0 × 10⁻⁷ | 2.0 × 10⁻⁷ | – | 10 yr | 100% | 20 yr | – | B | SC 3 | 99.9% |
| HIPPS valves | 1oo2 | 8.0 × 10⁻⁷ | 0 | 5.0 × 10⁻⁷ | 10% | 1 yr | 95% | 10 yr | – | A | SC 3 | 38.5% |
Function mission time (averaging horizon): 20 yr. Renewal / overhaul is when failures that no test reveals are cleared for each subsystem.
Verification without partial stroke testing
The valve group dominates. Its common cause term alone is about 5.1 × 10⁻⁴, more than the whole budget allows.
| Subsystem | PFDavg | Share | PFDavg, perfect test (IEC 61508-6) | HFT achieved / required | Route 1H limit | Spurious trips /h |
|---|---|---|---|---|---|---|
| Pressure transmitters | 4.8 × 10⁻⁵ | 8% | 3.5 × 10⁻⁵ | 1 / 1 | SIL 2 | 4.5 × 10⁻⁸ |
| Logic solver | 4.8 × 10⁻⁵ | 8% | 4.8 × 10⁻⁵ | 1 / 1 | SIL 4 | 7.0 × 10⁻⁷ |
| HIPPS valves | 5.3 × 10⁻⁴ | 85% | 3.6 × 10⁻⁴ | 1 / 1 | SIL 2 | 9.5 × 10⁻⁷ |
| Requirement | Result | Supports | Verdict |
|---|---|---|---|
| Probability of failure on demand | PFDavg 6.3 × 10⁻⁴ | SIL 3 | Pass |
| Hardware fault tolerance (IEC 61511) | minimum HFT per subsystem | SIL 3 | Pass |
| Systematic capability | lowest element SC 3 | SIL 3 | Pass |
| Required PFDavg (from LOPA) | ≤ 5.0 × 10⁻⁴ | PFDavg 6.3 × 10⁻⁴ | Not met |
| Function | target SIL 3 | SIL 3 | SIL band met, required risk reduction not met |
| Spurious trip rate | 1.7 × 10⁻⁶ /h | MTTFS 67.3 yr | Reported |
- PFD(t) of the function
Hover or tap the chart, or focus it and use the arrow keys, to read the value at any time.
Chart data
| Years in service | PFD(t) of the function |
|---|---|
| 0 | 5.80 × 10⁻⁶ |
| 1 | 5.69 × 10⁻⁵ |
| 2 | 1.08 × 10⁻⁴ |
| 3 | 9.15 × 10⁻⁴ |
| 4 | 9.71 × 10⁻⁴ |
| 5 | 2.38 × 10⁻⁴ |
| 6 | 2.90 × 10⁻⁴ |
| 7 | 1.11 × 10⁻³ |
| 8 | 1.17 × 10⁻³ |
| 9 | 4.22 × 10⁻⁴ |
| 10 | 2.69 × 10⁻⁵ |
| 11 | 8.27 × 10⁻⁴ |
| 12 | 8.83 × 10⁻⁴ |
| 13 | 1.56 × 10⁻⁴ |
| 14 | 2.07 × 10⁻⁴ |
| 15 | 1.02 × 10⁻³ |
| 16 | 1.08 × 10⁻³ |
| 17 | 1.14 × 10⁻³ |
| 18 | 3.91 × 10⁻⁴ |
| 19 | 4.44 × 10⁻⁴ |
Effect of partial stroke testing
Partial stroke assumed to reveal 60 % of the valves' dangerous undetected failures.
| Option | Function PFDavg | Valve group PFDavg | Band | Against required PFD |
|---|---|---|---|---|
| No partial stroke test | 6.3 × 10⁻⁴ | 5.3 × 10⁻⁴ | SIL 3 | Short |
| Partial stroke every 6 months | 5.1 × 10⁻⁴ | 4.2 × 10⁻⁴ | SIL 3 | Short |
| Partial stroke every 3 months | 4.6 × 10⁻⁴ | 3.6 × 10⁻⁴ | SIL 3 | Meets |
| Partial stroke every month | 4.2 × 10⁻⁴ | 3.3 × 10⁻⁴ | SIL 3 | Meets |
- PFD(t) of the function
Hover or tap the chart, or focus it and use the arrow keys, to read the value at any time.
Chart data
| Years in service | PFD(t) of the function |
|---|---|
| 0 | 5.07 × 10⁻⁶ |
| 1 | 4.76 × 10⁻⁴ |
| 2 | 5.19 × 10⁻⁴ |
| 3 | 1.53 × 10⁻⁴ |
| 4 | 1.94 × 10⁻⁴ |
| 5 | 2.35 × 10⁻⁴ |
| 6 | 7.18 × 10⁻⁴ |
| 7 | 7.61 × 10⁻⁴ |
| 8 | 3.86 × 10⁻⁴ |
| 9 | 4.27 × 10⁻⁴ |
| 10 | 2.13 × 10⁻⁵ |
| 11 | 4.95 × 10⁻⁴ |
| 12 | 5.37 × 10⁻⁴ |
| 13 | 5.80 × 10⁻⁴ |
| 14 | 2.10 × 10⁻⁴ |
| 15 | 2.51 × 10⁻⁴ |
| 16 | 7.36 × 10⁻⁴ |
| 17 | 7.79 × 10⁻⁴ |
| 18 | 8.23 × 10⁻⁴ |
| 19 | 4.44 × 10⁻⁴ |
Findings
Redundancy does not help against failures that hit both valves at once. With identical valves, the common cause term sets a floor that no amount of testing of the independent failures removes.
Partial stroke testing every three months reveals most of those failures between proof tests and brings the function to 4.6 × 10⁻⁴. Monthly testing adds little more.
The transmitters and logic solver are not the issue: together they take a small share of the budget, and the 2oo3 voting keeps the spurious trip rate low.
Architecture: under IEC 61508-2 Route 1H, the pressure transmitters would support only SIL 2 and the HIPPS valves would support only SIL 2, because their safe failure fraction is low. The SIL 3 claim therefore rests on the IEC 61511-1 fault tolerance requirement (HFT 1 for SIL 3, met by the redundant groups) together with SC 3 certification or prior-use evidence for each device. That evidence has to be in the safety case.
Recommendations
- Install partial stroke testing on both valves at a three-month interval and record each result.
- Reduce the valve β: different actuator suppliers, separate solenoid power and separate instrument air supplies.
- Keep the tightness check in the annual proof test; partial stroke tests cannot replace it.
Worked example with an illustrative design and data, chosen to show the method; it is not a client project. Failure rates are typical of published device certificates and are not taken from any reliability database. Computed with the First Out AI engine v0.3.0 on 28.10.2026. First Out AI supports engineering judgement and does not replace it: results must be checked by a competent functional safety engineer, and First Out AI is not certified software. This is not engineering advice for a specific plant.