Functional Safety · worked example, computed with First Out AI
A SIL 2 overpressure function that fails on proof test coverage
The calculation says SIL 2 when every proof test is assumed perfect. Model the test that is actually performed on the shutdown valve, and the same function falls to the SIL 1 band.
Scenario
A gas–liquid separator is fed from a higher-pressure upstream system. If the upstream pressure control fails, the separator can be pressured above its design pressure. The relief valve is sized for fire only, so it is not credited for this scenario.
The safety instrumented function closes the feed shutdown valve on high pressure, measured by two transmitters voted one out of two.
SIL determination by LOPA
| Step | Item | Value | Note |
|---|---|---|---|
| Initiating event | Upstream pressure control fails, separator pressure rises above design | 0.1 /yr | generic value for a control loop failure; confirm with site history |
| Independent protection layer | Operator response to an independent high-pressure alarm | PFD 0.1 | |
| Conditional modifier | Probability a person is in the affected area | 0.2 | |
| Mitigated event frequency | without the SIF | 2.0 × 10⁻³ /yr | |
| Tolerable frequency | company criterion (illustrative) | 1.0 × 10⁻⁵ /yr | |
| Required risk reduction | PFDavg ≤ 5.0 × 10⁻³ | RRF 200 | SIL 2 |
The function needs a risk reduction of 200, so the target is SIL 2 and the PFDavg must not exceed 5.0 × 10⁻³.
Architecture and input data
Valve coverage of 70 % reflects a full stroke test that checks movement but not tightness.
| Subsystem | Voting | λDU /h | λDD /h | λS /h | β | Proof test | Coverage | Renewal / overhaul | Partial stroke | Type | SC | SFF |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Pressure transmitters | 1oo2 | 1.5 × 10⁻⁷ | 6.0 × 10⁻⁷ | 3.0 × 10⁻⁷ | 5% | 1 yr | 95% | 20 yr | – | B | SC 3 | 85.7% |
| Logic solver | 1oo1, internal HFT 1 | 1.0 × 10⁻⁹ | 5.0 × 10⁻⁷ | 2.0 × 10⁻⁷ | – | 10 yr | 100% | 20 yr | – | B | SC 3 | 99.9% |
| Shutdown valve | 1oo1 | 6.0 × 10⁻⁷ | 0 | 5.0 × 10⁻⁷ | – | 1 yr | 70% | 20 yr | – | A | SC 3 | 45.5% |
Function mission time (averaging horizon): 20 yr. Renewal / overhaul is when failures that no test reveals are cleared for each subsystem.
Verification result
The valve carries 99% of the total PFDavg. Its untested failures build up over the 20-year mission time, which is what the sawtooth's rising floor shows.
| Subsystem | PFDavg | Share | PFDavg, perfect test (IEC 61508-6) | HFT achieved / required | Route 1H limit | Spurious trips /h |
|---|---|---|---|---|---|---|
| Pressure transmitters | 6.6 × 10⁻⁵ | 0% | 3.4 × 10⁻⁵ | 1 / 0 | SIL 2 | 1.8 × 10⁻⁶ |
| Logic solver | 4.8 × 10⁻⁵ | 0% | 4.8 × 10⁻⁵ | 1 / 0 | SIL 4 | 7.0 × 10⁻⁷ |
| Shutdown valve | 0.017 | 99% | 2.6 × 10⁻³ | 0 / 0 | SIL 1 | 5.0 × 10⁻⁷ |
| Requirement | Result | Supports | Verdict |
|---|---|---|---|
| Probability of failure on demand | PFDavg 0.018 | SIL 1 | Fail |
| Hardware fault tolerance (IEC 61511) | minimum HFT per subsystem | SIL 2 | Pass |
| Systematic capability | lowest element SC 3 | SIL 3 | Pass |
| Required PFDavg (from LOPA) | ≤ 5.0 × 10⁻³ | PFDavg 0.018 | Not met |
| Function | target SIL 2 | SIL 1 | Below target |
| Spurious trip rate | 3.0 × 10⁻⁶ /h | MTTFS 38.6 yr | Reported |
- PFD(t) of the function
Hover or tap the chart, or focus it and use the arrow keys, to read the value at any time.
Chart data
| Years in service | PFD(t) of the function |
|---|---|
| 0 | 1.57 × 10⁻⁵ |
| 1 | 1.64 × 10⁻³ |
| 2 | 3.27 × 10⁻³ |
| 3 | 8.44 × 10⁻³ |
| 4 | 0.0101 |
| 5 | 7.95 × 10⁻³ |
| 6 | 9.57 × 10⁻³ |
| 7 | 0.0147 |
| 8 | 0.0163 |
| 9 | 0.0142 |
| 10 | 0.0157 |
| 11 | 0.0209 |
| 12 | 0.0224 |
| 13 | 0.0204 |
| 14 | 0.022 |
| 15 | 0.027 |
| 16 | 0.0286 |
| 17 | 0.0302 |
| 18 | 0.0282 |
| 19 | 0.0297 |
Options compared
Each option recomputed with the same data; only the valve changes.
| Option | PFDavg | Band | Margin to required | Against required PFD |
|---|---|---|---|---|
| As designed: stroke test only, coverage 70 %, no overhaul | 0.018 | SIL 1 | 0.29 | Short |
| Add a seat leak test only: coverage 95 % | 5.2 × 10⁻³ | SIL 2 | 0.96 | Short |
| Overhaul the valve every 10 years | 9.8 × 10⁻³ | SIL 2 | 0.51 | Short |
| Seat leak test and 10-year overhaul | 3.9 × 10⁻³ | SIL 2 | 1.28 | Meets |
| Second valve in series, 1oo2, stroke test only | 2.2 × 10⁻³ | SIL 2 | 2.29 | Meets |
- No overhaul (20-year mission time)
- Overhaul every 10 years
Hover or tap the chart, or focus it and use the arrow keys, to read each point.
Chart data
| Valve proof test coverage (%) | No overhaul (20-year mission time) | Overhaul every 10 years |
|---|---|---|
| 60 | 0.0224 | 0.0121 |
| 65 | 0.02 | – |
| 70 | 0.0175 | 9.78 × 10⁻³ |
| 75 | 0.0151 | – |
| 80 | 0.0126 | 7.44 × 10⁻³ |
| 85 | 0.0102 | – |
| 90 | 7.70 × 10⁻³ | 5.10 × 10⁻³ |
| 95 | 5.23 × 10⁻³ | 3.92 × 10⁻³ |
| 98 | 3.74 × 10⁻³ | – |
| 100 | 2.74 × 10⁻³ | 2.74 × 10⁻³ |
Findings
With a perfect proof test the function would reach 2.7 × 10⁻³ and pass. The shortfall comes entirely from the valve failures the stroke test cannot reveal.
Testing more often does not fix it: the hidden 30 % only clears at overhaul. Neither a seat leak test alone (5.2 × 10⁻³) nor a 10-year overhaul alone (9.8 × 10⁻³) is enough. Together they bring the function to 3.9 × 10⁻³, inside the target. A second valve also meets it, at a higher cost.
The transmitters and logic solver need no change. Both hardware fault tolerance and systematic capability already meet SIL 2.
Recommendations
- Add a seat leak test to the valve proof test procedure and record the as-found leakage.
- Put a 10-year overhaul of the valve and actuator in the maintenance plan, and enter it in the verification as the mission time.
- Re-verify after the first two tests using the recorded results.
Worked example with an illustrative design and data, chosen to show the method; it is not a client project. Failure rates are typical of published device certificates and are not taken from any reliability database. Computed with the First Out AI engine v0.3.0 on 28.10.2026. First Out AI supports engineering judgement and does not replace it: results must be checked by a competent functional safety engineer, and First Out AI is not certified software. This is not engineering advice for a specific plant.