Knowledge library
Functional safety, worked through
70 articles written for First Out AI: methods with worked numbers, LOPA and HAZOP guidance, specification and proof testing, typical SIF designs, lessons from public investigation reports, and six complete worked cases. First Out AI uses this library when it answers your questions.
Calculation methods
PFDavg, redundancy, proof test coverage, partial stroke, PFH, fault tolerance, failure data: each with worked numbers.
- PFDavg of a single channel (1oo1), step by stepWhere the familiar λDU·T1/2 comes from, what it leaves out, and a worked example that shows why the proof test interval matters as much as the failure rate.
- Redundancy, MooN voting and the common cause factor βWhy two channels are not a hundred times better than one, with worked 1oo2 and 2oo3 examples showing the common cause term taking over.
- Proof test coverage and why it dominates the resultA worked example where 80 % coverage turns a SIL 2 valve into a SIL 1 valve, and what to do about it.
- Partial stroke testing: what it buys and how to model itHow a partial stroke test every few months reduces PFDavg, a worked example, and the conditions for taking credit.
- High demand and continuous mode: PFH instead of PFDavgWhen a function must be judged by its dangerous failure frequency per hour, how to decide the mode, and a worked example.
- Hardware fault tolerance, SFF and the architectural constraintsThe difference between the IEC 61511 fault tolerance requirement and the IEC 61508 Route 1H check, how to calculate SFF, and a worked example.
- Systematic capability: the limit that no calculation removesWhat SC means, how it limits the achieved SIL, and how prior use evidence fits in.
- Spurious trip rate and MTTFSHow voting changes the spurious trip rate, a worked comparison of 1oo1, 1oo2 and 2oo3, and why it belongs in the SRS.
- Failure rate data: where it comes from and how to read itHow to use certificates, FMEDA reports and your own field data, the unit mistakes that appear in reviews, and a plausibility checklist.
- Diagnostics, λDD and what to do on a detected failureHow detected dangerous failures enter PFDavg, the choice between trip and alarm, and the repair time that the calculation assumes.
- Choosing the proof test intervalA worked example of finding the longest interval that still meets the requirement, and the practical constraints that decide the final choice.
- Mission time, renewal and the useful life of devicesWhat mission time means in a PFDavg calculation, how renewal clears hidden failures, and why constant failure rates only hold during useful life.
- Estimating β: what a common cause checklist looks atThe factors that drive the common cause fraction and how they translate into design and maintenance choices.
SIL determination
LOPA step by step, IPL criteria, frequencies, tolerable risk, risk graphs and matrices.
- LOPA step by step, with a worked separator exampleThe full LOPA sequence from scenario to target SIL, worked on an overpressure scenario, with the arithmetic shown line by line.
- What qualifies as an independent protection layerThe four tests an IPL must pass, typical layers that pass or fail them, and how to document the claim.
- Enabling conditions and conditional modifiers without double countingWhen probabilities other than IPLs may enter LOPA, examples, and the double-counting traps.
- Estimating initiating event frequencies from your own dataHow to build IEFs from equipment failure records and task frequency × error probability, with worked examples.
- Tolerable risk criteria and how a TMEL is setIndividual risk, ALARP, the published UK framework, and how companies turn it into tolerable frequencies per consequence category.
- Calibrating a risk graphHow the C, F, P and W parameters work, how to calibrate them against your tolerable risk, and where risk graphs mislead.
- Using a risk matrix for SIL determinationHow a risk matrix is turned into SIL targets, how to keep it consistent with LOPA, and its limits.
- When the target is SIL 3 or beyondWhat to do when LOPA asks for more than one SIF can deliver, and why SIL 3 is a design challenge, not a calculation one.
- Allocating safety functions: SIS, control system, alarms and mechanical protectionHow risk reduction is shared between layers, when a function belongs in the SIS, and what may stay in the control system.
Worked cases
Six complete functions with their LOPA, inputs, engine results and reading, generated from the First Out AI examples.
- Worked case: Separator high pressure: close inlet shutdown valveClassic overpressure trip on a production separator: 2oo3 pressure transmitters, safety PLC, one inlet shutdown valve. With a perfect proof test it meets SIL 2; with the realistic 80 % valve test coverage it does not. That gap is why coverage matters.
- Worked case: Compressor suction scrubber high-high level: trip compressorLiquid carry-over protection for a gas compressor. Four subsystems in series: level transmitters, PLC, motor trip and suction valve. The suction valve carries most of the PFDavg: a typical picture for process SIFs.
- Worked case: Fired heater flame failure: close fuel gas double blockBurner management trip on loss of flame. Two flame scanners and two shutdown valves in series (double block). Typical SIL 2 heater protection.
- Worked case: Reactor high temperature: stop feed (SIL 3, partial stroke)Runaway protection on an exothermic reactor. SIL 3 needs redundancy everywhere and frequent partial stroke testing. This example deliberately misses the target: use the what-if and the AI to find the fix.
- Worked case: Storage tank overfill: close inlet valve (SIL 1)Overfill protection on an atmospheric tank with an independent radar and a motor-operated inlet valve. A small SIL 1 function where the energise-to-trip valve dominates.
- Worked case: Batch reactor charging interlock (high demand, PFH)An interlock that acts on every batch is a high demand function, so it is verified with PFH instead of PFDavg. Two position switches, safety PLC, two charging valves.
Specification and lifecycle
SRS contents, timing, bypasses, proof test procedures, C&E conventions and the lifecycle.
- What a safety requirements specification must containThe content of a good SRS section by section, with the questions each section must answer and the usual gaps.
- Process safety time and SIF response timeHow to establish the process safety time, how the response time budget is split, and a worked example.
- Managing bypasses, overrides and start-up inhibitsWhy bypasses are the most common way a well-designed SIF fails, and the rules that keep them under control.
- Writing a proof test procedure that achieves its coverageThe structure of a good procedure, device-specific steps that matter for coverage, and how records feed back into the next verification.
- Cause and effect matrix conventionsHow to lay out a C&E matrix so programmers and testers read it the same way, with the details that are usually missing.
- Application program requirements for safety PLCsThe rules that keep systematic failures out of the trip logic: language, structure, review, testing and change control.
- The safety lifecycle in practiceThe lifecycle phases from hazard analysis to decommissioning, what each produces, and where calculations fit.
- Periodic review and management of change for SIFsWhat to compare at each review, what triggers re-verification, and a simple checklist.
- What each proof test reveals: coverage by device typeA qualitative guide to which test methods reveal which dangerous failures, to support the coverage you enter in the calculation.
HAZOP
Method and deviation libraries for vessels, pumps, compressors, exchangers, columns, reactors, heaters and tanks.
- Running a HAZOP: nodes, guide words and good recordsHow a HAZOP is organised, how to choose nodes, how guide words create deviations, and what makes the record useful for LOPA.
- HAZOP deviation library: vessels and separatorsTypical deviations, causes, consequences and safeguards for pressure vessels and separators.
- HAZOP deviation library: pumps and compressorsTypical deviations for centrifugal pumps and gas compressors.
- HAZOP deviation library: heat exchangers and distillation columnsTypical deviations for shell-and-tube exchangers and distillation columns.
- HAZOP deviation library: reactors and fired heatersTypical deviations for exothermic reactors and fired heaters.
- HAZOP deviation library: atmospheric storage tanksTypical deviations for atmospheric storage tanks, with overfill as the dominant scenario.
- Risk ranking in HAZOP and when to go to LOPAHow to rank HAZOP rows consistently and pick the ones that need LOPA or a SIL assessment.
SIF design
Typical functions by equipment, final elements, sensors, logic solvers, HIPPS and alarms.
- Typical safety instrumented functions by equipmentA reference table of common process SIFs with typical initiators, actions, architectures and the points reviewers check.
- Final elements: valves, actuators, solenoids and motor tripsThe part of a SIF that usually dominates PFDavg, the design choices that matter and the failure modes to cover in tests.
- Sensors: transmitters, switches, analysers and their pitfallsHow to choose initiators for a SIF, why transmitters replaced switches, and the installation details that create common cause.
- Logic solvers for SIFsWhat a SIF logic solver must provide, how it is separated from the control system and what to check in its safety manual.
- High integrity pressure protection systems (HIPPS)What a HIPPS is, when it replaces relief capacity, and the design and testing demands that follow.
- Safety alarms and operator response as a protection layerWhen an alarm with operator action can be credited, the time budget that decides it, and how to specify it.
- Choosing the voting: 1oo1, 1oo2, 2oo2, 2oo3 and 1oo3 comparedOne table comparing the common architectures for safety, spurious trips, fault tolerance and testing, with guidance on when each is used.
- Burner management systems: key functions and SIL considerationsThe functions a burner management system performs, which of them are SIFs, and the design points that matter.
- Designing overfill protection for atmospheric tanksWhy overfill needs layers independent of gauging, how to size the response time, and what an overfill SIF looks like.
- Prior use: selecting devices without a certificateWhat prior use evidence must show, how to collect it, and its limits.
Incident lessons
What public investigation reports teach about instruments, overfill, bypasses and start-up.
- Lessons from Texas City (2005): instruments out of service at start-upA distillation tower overfilled during start-up with a misleading level indicator and a failed high level alarm; what it teaches about instrument checks and independent protection.
- Lessons from Buncefield (2005): a stuck gauge and an inoperable high level switchA petrol tank overfilled because the tank gauge stuck and the independent high level switch had been left inoperable; the lessons for overfill protection and device management.
- Lessons from the Caribbean Petroleum terminal (2009): one layer against overfillA gasoline tank overfilled at a terminal that relied on a single, poorly maintained level system; why the CSB called for automatic overfill protection.
- Lessons from Formosa Plastics, Illiopolis (2004): an interlock overriddenAn operator opened the drain of the wrong, pressurised reactor and overrode the interlock that blocked it; lessons on designing for human error and controlling overrides.
- Lessons from Bayer CropScience, Institute (2008): premature start-up and a bypassed interlockA residue treater exploded during a rushed restart after an interlock that enforced the safe sequence was overridden; lessons on permissives and start-up readiness.
Using First Out AI
Workflows and checklists for doing the work in the app.
- First Out AI guide: a SIL verification from your documentsThe order of work from P&ID and certificates to a verified function, with a data checklist you can send to vendors and colleagues.
- First Out AI guide: from HAZOP row to LOPA to SIF targetHow the HAZOP, LOPA, SIL verification and SRS tabs connect, step by step.
- First Out AI guide: the worked examples and the demo projectWhat each worked example demonstrates and how the demo project links them.
- Checklist: data to request from vendors and site teamsA ready list of documents and values to request when preparing a SIL verification or reviewing a vendor package.
- The most common findings in SIL verification reviewsA reviewer's checklist built from the errors that appear again and again in verification reports.
- How to read a SIL verification reportFor reviewers and managers: what to look at first in a verification report and which questions to ask.
- FAQ: SIL verificationShort answers to the questions engineers ask most often during SIL verification.
- FAQ: LOPAShort answers to the most common LOPA questions.
Reference
Glossary and quick reference numbers.
- Functional safety glossaryShort definitions of the terms used in First Out AI and in functional safety work.
- SIL bands and quick reference numbersThe SIL ranges for PFDavg, PFH and RRF in one table, with the hand formulas used in First Out AI articles.
- Failure rate conversions: FIT, per year, MTBF and MTTFWorked conversions between the units in which failure data arrives, and the traps in MTBF.
No article matches. Try another word, or ask First Out AI.