Functional Safety · worked example, computed with First Out AI
Tank overfill: when the environmental case sets the SIL
Two consequences from one cause. The fire case needs a risk reduction of only 5, below the SIL 1 range; the spill to drains needs SIL 1. And meeting the SIL 1 band is not the same as meeting the required risk reduction.
Scenario
A storage tank is filled from a transfer line. If the level control fails during filling, the tank overflows. Two consequences are assessed separately: a fire if vapour reaches an ignition source, and an environmental release if product reaches the drainage system.
LOPA: fire and safety consequence
| Step | Item | Value | Note |
|---|---|---|---|
| Initiating event | Level control fails during filling; tank overflows and vapour reaches an ignition source | 0.1 /yr | generic value for a level control loop failure |
| Enabling condition | Fraction of time the tank is being filled | 0.5 | |
| Independent protection layer | Operator response to an independent high-level alarm | PFD 0.1 | |
| Conditional modifier | Probability of ignition | 0.1 | |
| Conditional modifier | Probability a person is present | 0.1 | |
| Mitigated event frequency | without the SIF | 5.0 × 10⁻⁵ /yr | |
| Tolerable frequency | company criterion (illustrative) | 1.0 × 10⁻⁵ /yr | |
| Required risk reduction | PFDavg ≤ 0.2 | RRF 5 | No SIL required |
Risk reduction needed: 5.0. That does not call for a SIL rated function.
LOPA: environmental consequence
| Step | Item | Value | Note |
|---|---|---|---|
| Initiating event | Same overflow; product reaches the site drainage system | 0.1 /yr | generic value for a level control loop failure |
| Enabling condition | Fraction of time the tank is being filled | 0.5 | |
| Independent protection layer | Operator response to an independent high-level alarm | PFD 0.1 | |
| Mitigated event frequency | without the SIF | 5.0 × 10⁻³ /yr | |
| Tolerable frequency | company criterion (illustrative) | 1.0 × 10⁻⁴ /yr | |
| Required risk reduction | PFDavg ≤ 0.02 | RRF 50 | SIL 1 |
Risk reduction needed: 50. This case sets the target: SIL 1, PFDavg ≤ 0.02.
Architecture and input data
A 15-year mission time reflects the planned valve replacement.
| Subsystem | Voting | λDU /h | λDD /h | λS /h | β | Proof test | Coverage | Renewal / overhaul | Partial stroke | Type | SC | SFF |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Independent level sensor | 1oo1 | 4.0 × 10⁻⁷ | 8.0 × 10⁻⁷ | 4.0 × 10⁻⁷ | – | 1 yr | 90% | 20 yr | – | B | SC 2 | 75.0% |
| Logic solver | 1oo1, internal HFT 1 | 1.0 × 10⁻⁹ | 5.0 × 10⁻⁷ | 2.0 × 10⁻⁷ | – | 10 yr | 100% | 20 yr | – | B | SC 3 | 99.9% |
| Inlet shutdown valve | 1oo1 | 1.8 × 10⁻⁶ | 0 | 5.0 × 10⁻⁷ | – | 1 yr | 80% | 15 yr | – | A | SC 2 | 21.7% |
Function mission time (averaging horizon): 15 yr. Renewal / overhaul is when failures that no test reveals are cleared for each subsystem.
Verification result
PFDavg 0.034 sits inside the SIL 1 band, but the environmental case needs a risk reduction of 50, which means a PFDavg of 0.02 or less.
| Subsystem | PFDavg | Share | PFDavg, perfect test (IEC 61508-6) | HFT achieved / required | Route 1H limit | Spurious trips /h |
|---|---|---|---|---|---|---|
| Independent level sensor | 4.2 × 10⁻³ | 12% | 1.8 × 10⁻³ | 0 / 0 | SIL 1 | 1.2 × 10⁻⁶ |
| Logic solver | 4.1 × 10⁻⁵ | 0% | 4.8 × 10⁻⁵ | 1 / 0 | SIL 4 | 7.0 × 10⁻⁷ |
| Inlet shutdown valve | 0.029 | 87% | 7.9 × 10⁻³ | 0 / 0 | SIL 1 | 5.0 × 10⁻⁷ |
| Requirement | Result | Supports | Verdict |
|---|---|---|---|
| Probability of failure on demand | PFDavg 0.034 | SIL 1 | Pass |
| Hardware fault tolerance (IEC 61511) | minimum HFT per subsystem | SIL 2 | Pass |
| Systematic capability | lowest element SC 2 | SIL 2 | Pass |
| Required PFDavg (from LOPA) | ≤ 0.02 | PFDavg 0.034 | Not met |
| Function | target SIL 1 | SIL 1 | SIL band met, required risk reduction not met |
| Spurious trip rate | 2.4 × 10⁻⁶ /h | MTTFS 47.6 yr | Reported |
- PFD(t) of the function
Hover or tap the chart, or focus it and use the arrow keys, to read the value at any time.
Chart data
| Years in service | PFD(t) of the function |
|---|---|
| 0 | 5.21 × 10⁻⁵ |
| 1 | 3.56 × 10⁻³ |
| 2 | 7.05 × 10⁻³ |
| 3 | 0.0105 |
| 4 | 0.014 |
| 5 | 0.0175 |
| 6 | 0.0209 |
| 7 | 0.0243 |
| 8 | 0.0278 |
| 9 | 0.0312 |
| 10 | 0.0345 |
| 11 | 0.0379 |
| 12 | 0.0412 |
| 13 | 0.0446 |
| 14 | 0.048 |
Options compared
| Option | PFDavg | Band | Risk reduction achieved | Against required RRF |
|---|---|---|---|---|
| As designed: annual test, valve coverage 80 % | 0.034 | SIL 1 | 30 | Short of RRF |
| Test every 6 months | 0.03 | SIL 1 | 34 | Short of RRF |
| Annual test with seat leak check, coverage 95 % | 0.017 | SIL 1 | 57 | Meets RRF |
| 6-month test with seat leak check | 0.013 | SIL 1 | 77 | Meets RRF |
Findings
Claiming SIL 1 because the PFDavg lands in the SIL 1 band would leave the environmental risk above the company criterion. The verification has to be checked against the required risk reduction from the LOPA, not only the band.
The valve dominates again, and its untested failures accumulate between replacements.
Recommendations
- Add a seat leak check to the valve proof test. Testing every six months without it is not enough (0.03); the leak check is what closes the gap.
- Keep the high-level alarm independent of the level control loop, or the LOPA credit for operator response is lost.
- Record as-found results so the coverage assumed here can be confirmed.
Worked example with an illustrative design and data, chosen to show the method; it is not a client project. Failure rates are typical of published device certificates and are not taken from any reliability database. Computed with the First Out AI engine v0.3.0 on 28.10.2026. First Out AI supports engineering judgement and does not replace it: results must be checked by a competent functional safety engineer, and First Out AI is not certified software. This is not engineering advice for a specific plant.