Functional Safety · worked example, computed with First Out AI
Fired heater fuel trip: choosing scanner voting for safety and uptime
One flame scanner is cheap but not enough. Two scanners voted one out of two are safe but trip the heater on either scanner's fault. The calculation shows which voting meets the required risk reduction and keeps the heater running.
Scenario
If the flame in a fired heater goes out while fuel gas keeps flowing, gas accumulates in the hot firebox and can ignite explosively. Flame scanners detect loss of flame and the safety function closes two fuel gas block valves in series.
Scanners are a frequent source of spurious trips on fired heaters. Each unnecessary trip costs a restart, thermal cycling of the tubes and lost production.
SIL determination by LOPA
| Step | Item | Value | Note |
|---|---|---|---|
| Initiating event | Flame-out with fuel gas still flowing into a hot firebox | 0.5 /yr | generic value for flame instability events; confirm with heater history |
| Conditional modifier | Probability a person is near the heater | 0.05 | |
| Mitigated event frequency | without the SIF | 0.025 /yr | |
| Tolerable frequency | company criterion (illustrative) | 1.0 × 10⁻⁴ /yr | |
| Required risk reduction | PFDavg ≤ 4.0 × 10⁻³ | RRF 250 | SIL 2 |
Required risk reduction 250: SIL 2, PFDavg ≤ 4.0 × 10⁻³.
Architecture and input data
Scanner safe failure rate set high on purpose: it drives the spurious trip comparison.
| Subsystem | Voting | λDU /h | λDD /h | λS /h | β | Proof test | Coverage | Renewal / overhaul | Partial stroke | Type | SC | SFF |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Flame scanners | 2oo3 | 4.0 × 10⁻⁷ | 1.5 × 10⁻⁶ | 3.0 × 10⁻⁶ | 5% | 1 yr | 90% | 20 yr | – | B | SC 3 | 91.8% |
| Logic solver | 1oo1, internal HFT 1 | 1.0 × 10⁻⁹ | 5.0 × 10⁻⁷ | 2.0 × 10⁻⁷ | – | 10 yr | 100% | 20 yr | – | B | SC 3 | 99.9% |
| Fuel gas block valves | 1oo2 | 1.4 × 10⁻⁶ | 0 | 5.0 × 10⁻⁷ | 10% | 1 yr | 85% | 15 yr | – | A | SC 3 | 26.3% |
Function mission time (averaging horizon): 20 yr. Renewal / overhaul is when failures that no test reveals are cleared for each subsystem.
Four votings compared
Same valves and logic solver in every case; only the scanner voting changes.
| Scanner voting | Function PFDavg | Scanner HFT | Band | Scanner spurious trips /h | Scanner MTTFS | Against required PFD |
|---|---|---|---|---|---|---|
| Scanners 1oo1 | 7.1 × 10⁻³ | 0 | SIL 2 | 4.5 × 10⁻⁶ | 25.4 yr | Short |
| Scanners 1oo2 | 2.3 × 10⁻³ | 1 | SIL 2 | 8.8 × 10⁻⁶ | 13.0 yr | Meets |
| Scanners 2oo3 | 2.3 × 10⁻³ | 1 | SIL 2 | 2.3 × 10⁻⁷ | 505.4 yr | Meets |
| Scanners 2oo2 | 0.012 | 0 | SIL 1 | 2.3 × 10⁻⁷ | 506.7 yr | Short |
| Subsystem | PFDavg | Share | PFDavg, perfect test (IEC 61508-6) | HFT achieved / required | Route 1H limit | Spurious trips /h |
|---|---|---|---|---|---|---|
| Flame scanners | 3.4 × 10⁻⁴ | 14% | 1.0 × 10⁻⁴ | 1 / 0 | SIL 3 | 2.3 × 10⁻⁷ |
| Logic solver | 4.8 × 10⁻⁵ | 2% | 4.8 × 10⁻⁵ | 1 / 0 | SIL 4 | 7.0 × 10⁻⁷ |
| Fuel gas block valves | 2.0 × 10⁻³ | 84% | 6.6 × 10⁻⁴ | 1 / 0 | SIL 2 | 9.5 × 10⁻⁷ |
| Requirement | Result | Supports | Verdict |
|---|---|---|---|
| Probability of failure on demand | PFDavg 2.3 × 10⁻³ | SIL 2 | Pass |
| Hardware fault tolerance (IEC 61511) | minimum HFT per subsystem | SIL 3 | Pass |
| Systematic capability | lowest element SC 3 | SIL 3 | Pass |
| Required PFDavg (from LOPA) | ≤ 4.0 × 10⁻³ | PFDavg 2.3 × 10⁻³ | Met |
| Function | target SIL 2 | SIL 2 | Meets target |
| Spurious trip rate | 1.9 × 10⁻⁶ /h | MTTFS 60.9 yr | Reported |
- PFD(t) of the function
Hover or tap the chart, or focus it and use the arrow keys, to read the value at any time.
Chart data
| Years in service | PFD(t) of the function |
|---|---|
| 0 | 7.35 × 10⁻⁶ |
| 1 | 2.32 × 10⁻⁴ |
| 2 | 4.63 × 10⁻⁴ |
| 3 | 2.07 × 10⁻³ |
| 4 | 2.35 × 10⁻³ |
| 5 | 1.14 × 10⁻³ |
| 6 | 1.40 × 10⁻³ |
| 7 | 3.17 × 10⁻³ |
| 8 | 3.47 × 10⁻³ |
| 9 | 2.15 × 10⁻³ |
| 10 | 2.34 × 10⁻³ |
| 11 | 4.27 × 10⁻³ |
| 12 | 4.59 × 10⁻³ |
| 13 | 3.16 × 10⁻³ |
| 14 | 3.46 × 10⁻³ |
| 15 | 5.54 × 10⁻³ |
| 16 | 2.03 × 10⁻³ |
| 17 | 2.31 × 10⁻³ |
| 18 | 1.08 × 10⁻³ |
| 19 | 1.34 × 10⁻³ |
Findings
A single scanner (7.1 × 10⁻³) and 2oo2 (0.012) fall short of the required 4.0 × 10⁻³: their scanner failures add directly to the valves' share. 1oo2 and 2oo3 both meet it, because the fuel valves then dominate the PFDavg.
Between those two, the difference is uptime. 1oo2 trips the heater on any one scanner's safe failure, about every 13 years from the scanners alone; on a heater with several burners and scanners, that becomes a trip every year or two. 2oo3 keeps a fault tolerance of one and pushes the scanners' spurious trip interval to about 505 years.
Recommendation
Use three scanners voted 2oo3. With one scanner forced to the tripped state for maintenance, the voting becomes 1oo2 and stays safe; bypassed as healthy, it becomes 2oo2 with no fault tolerance. The procedure should require the tripped state, or limit the bypass time.
Worked example with an illustrative design and data, chosen to show the method; it is not a client project. Failure rates are typical of published device certificates and are not taken from any reliability database. Computed with the First Out AI engine v0.3.0 on 28.10.2026. First Out AI supports engineering judgement and does not replace it: results must be checked by a competent functional safety engineer, and First Out AI is not certified software. This is not engineering advice for a specific plant.