Functional Safety · worked example, computed with First Out AI
Extending the turnaround interval: which safety functions can wait
The unit proof tests its safety functions at an annual shutdown and plans to move to two- or three-yearly turnarounds, which stretches every proof test interval. Ten functions recomputed at each interval, against the risk reduction each one was designed for, show which can follow the longer cycle.
Question
A unit plans to extend its turnaround interval. Field devices in safety functions are proof tested at turnarounds, so their test interval grows with it. Logic solvers keep their 10-year interval and partial stroke tests continue during operation.
Each function is checked against the PFDavg its own LOPA requires, not just the upper limit of its SIL band. All ten pass today at an annual interval.
Results by function
Green: meets the required PFDavg. Red: does not.
| Function | Service | Target | Required PFDavg | PFDavg at 1 yr | PFDavg at 2 yr | PFDavg at 3 yr | Longest interval that passes |
|---|---|---|---|---|---|---|---|
| SIF-01 | Separator high pressure | SIL 2 | 5.00 × 10⁻³ | 3.92 × 10⁻³ | 6.43 × 10⁻³ | 8.69 × 10⁻³ | 1 yr |
| SIF-02 | Compressor high discharge temperature | SIL 1 | 0.05 | 0.0266 | 0.0331 | 0.0389 | 3 yr |
| SIF-03 | Column low level, pump protection | SIL 1 | 0.01 | 3.00 × 10⁻³ | 4.45 × 10⁻³ | 5.75 × 10⁻³ | 3 yr |
| SIF-04 | Reactor high temperature | SIL 2 | 3.33 × 10⁻³ | 2.40 × 10⁻³ | 3.30 × 10⁻³ | 4.17 × 10⁻³ | 2 yr |
| SIF-05 | Heater fuel trip | SIL 2 | 3.90 × 10⁻³ | 2.34 × 10⁻³ | 3.17 × 10⁻³ | 4.00 × 10⁻³ | 2 yr |
| SIF-06 | Tank high level | SIL 1 | 0.02 | 0.0174 | 0.0262 | 0.0341 | 1 yr |
| SIF-07 | HIPPS on export line | SIL 3 | 5.00 × 10⁻⁴ | 4.58 × 10⁻⁴ | 6.28 × 10⁻⁴ | 7.86 × 10⁻⁴ | 1 yr |
| SIF-08 | Fuel gas low pressure | SIL 1 | 0.04 | 0.0202 | 0.0266 | 0.0323 | 3 yr |
| SIF-09 | Absorber high level to flare | SIL 1 | 0.025 | 0.0169 | 0.0236 | 0.0296 | 2 yr |
| SIF-10 | Toxic gas release isolation | SIL 2 | 3.00 × 10⁻³ | 2.14 × 10⁻³ | 3.10 × 10⁻³ | 4.07 × 10⁻³ | 1 yr |
- SIF-06: PFDavg ÷ required
- SIF-01: PFDavg ÷ required
- SIF-07: PFDavg ÷ required
Values above 1 miss the required risk reduction. Hover, tap or use the arrow keys to read each point.
Chart data
| Proof test interval (years) | SIF-06: PFDavg ÷ required | SIF-01: PFDavg ÷ required | SIF-07: PFDavg ÷ required |
|---|---|---|---|
| 1 | 0.87 | 0.784 | 0.917 |
| 2 | 1.3 | 1.3 | 1.3 |
| 3 | 1.7 | 1.7 | 1.6 |
Findings
At two years, four functions lose their margin: SIF-01 (separator high pressure), SIF-06 (tank high level), SIF-07 (HIPPS on export line), SIF-10 (toxic gas release isolation). At three years only three of ten still pass.
The functions that tolerate a longer interval have a large margin to begin with, usually SIL 1 functions whose LOPA asked for little more than the band minimum. The ones that fail were designed close to their requirement, and their PFDavg grows steadily with the interval.
Partial stroke testing does not save the HIPPS on its own: the tightness check and the rest of the full proof test still move with the turnaround.
Recommendations
- Extend the interval only for the functions that pass at the new interval, and record the recalculation in each verification report.
- For the others, plan online proof tests with bypass procedures, so their test interval stays at one year while the turnaround moves.
- Where online testing is not possible, add redundancy or improve test coverage before the interval is extended.
Worked example with an illustrative design and data, chosen to show the method; it is not a client project. Failure rates are typical of published device certificates and are not taken from any reliability database. Computed with the First Out AI engine v0.3.0 on 28.10.2026. First Out AI supports engineering judgement and does not replace it: results must be checked by a competent functional safety engineer, and First Out AI is not certified software. This is not engineering advice for a specific plant.