Functional Safety · worked example, computed with First Out AI
Exothermic reactor: when common cause failures erase redundancy
Three temperature sensors and two quench valves. Treated as independent, the function reaches the SIL 3 band. With a realistic common cause factor it is a SIL 2 function, and the β factor becomes the parameter to design for.
Scenario
An exothermic batch reaction can run away if cooling is lost. The safety function measures reactor temperature with three transmitters voted 2oo3 and opens either of two quench valves, voted 1oo2, to stop the reaction.
The target, SIL 2 with a required risk reduction of 300, comes from the plant's LOPA and is taken as given here.
Architecture and input data
Identical sensors in closely spaced thermowells and identical valves on one header: β = 10 % for both groups.
| Subsystem | Voting | λDU /h | λDD /h | λS /h | β | Proof test | Coverage | Renewal / overhaul | Partial stroke | Type | SC | SFF |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Temperature transmitters | 2oo3 | 3.0 × 10⁻⁷ | 1.0 × 10⁻⁶ | 4.0 × 10⁻⁷ | 10% | 1 yr | 95% | 20 yr | – | B | SC 3 | 82.4% |
| Logic solver | 1oo1, internal HFT 1 | 1.0 × 10⁻⁹ | 5.0 × 10⁻⁷ | 2.0 × 10⁻⁷ | – | 10 yr | 100% | 20 yr | – | B | SC 3 | 99.9% |
| Quench valves | 1oo2 | 1.4 × 10⁻⁶ | 0 | 5.0 × 10⁻⁷ | 10% | 1 yr | 90% | 20 yr | – | A | SC 3 | 26.3% |
Function mission time (averaging horizon): 20 yr. Renewal / overhaul is when failures that no test reveals are cleared for each subsystem.
Verification and β sensitivity
With β = 0 the function would reach 4.4 × 10⁻⁴. At β = 10 % it is 2.4 × 10⁻³, a factor of 5 higher.
| Subsystem | PFDavg | Share | PFDavg, perfect test (IEC 61508-6) | HFT achieved / required | Route 1H limit | Spurious trips /h |
|---|---|---|---|---|---|---|
| Temperature transmitters | 2.8 × 10⁻⁴ | 11% | 1.4 × 10⁻⁴ | 1 / 0 | SIL 2 | 1.4 × 10⁻⁷ |
| Logic solver | 4.8 × 10⁻⁵ | 2% | 4.8 × 10⁻⁵ | 1 / 0 | SIL 4 | 7.0 × 10⁻⁷ |
| Quench valves | 2.1 × 10⁻³ | 87% | 6.6 × 10⁻⁴ | 1 / 0 | SIL 2 | 9.5 × 10⁻⁷ |
| Requirement | Result | Supports | Verdict |
|---|---|---|---|
| Probability of failure on demand | PFDavg 2.4 × 10⁻³ | SIL 2 | Pass |
| Hardware fault tolerance (IEC 61511) | minimum HFT per subsystem | SIL 3 | Pass |
| Systematic capability | lowest element SC 3 | SIL 3 | Pass |
| Required PFDavg (from LOPA) | ≤ 3.3 × 10⁻³ | PFDavg 2.4 × 10⁻³ | Met |
| Function | target SIL 2 | SIL 2 | Meets target |
| Spurious trip rate | 1.8 × 10⁻⁶ /h | MTTFS 63.8 yr | Reported |
- β applied to sensors and valves
- Sensor group alone (valve β fixed at 10 %)
Hover or tap the chart, or focus it and use the arrow keys, to read each point.
Chart data
| Common cause factor β (%) | β applied to sensors and valves | Sensor group alone (valve β fixed at 10 %) |
|---|---|---|
| 0 | 4.41 × 10⁻⁴ | 2.32 × 10⁻⁵ |
| 2 | 8.33 × 10⁻⁴ | 7.36 × 10⁻⁵ |
| 5 | 1.42 × 10⁻³ | 1.49 × 10⁻⁴ |
| 8 | 2.01 × 10⁻³ | 2.25 × 10⁻⁴ |
| 10 | 2.40 × 10⁻³ | 2.76 × 10⁻⁴ |
| 15 | 3.38 × 10⁻³ | 4.02 × 10⁻⁴ |
| 20 | 4.36 × 10⁻³ | 5.28 × 10⁻⁴ |
Findings
For redundant groups, the independent failure terms are tiny and the common cause term is almost the whole result. That makes β the most important input in the calculation and the least often justified.
Using diverse sensor technology (β about 2 %) and separating the valves' air supplies and solenoid power (β about 5 %) gives 1.3 × 10⁻³, with margin to the target.
Recommendations
- Score β with the IEC 61508-6 Annex D checklist for each group instead of using a default.
- Install the three temperature elements in separate thermowells, and consider one of a different measuring principle.
- Give each quench valve its own solenoid supply and air supply.
Worked example with an illustrative design and data, chosen to show the method; it is not a client project. Failure rates are typical of published device certificates and are not taken from any reliability database. Computed with the First Out AI engine v0.3.0 on 28.10.2026. First Out AI supports engineering judgement and does not replace it: results must be checked by a competent functional safety engineer, and First Out AI is not certified software. This is not engineering advice for a specific plant.