The function
Stops a product transfer into the tank before it overfills, preventing a liquid spill and vapour cloud in the tank farm.
Safe state: Receipt valve closed and the transfer pump at the source stopped by telephone procedure.
Process safety time: 25 min from LAHH to overfill at maximum transfer rate. Required response: ≤ 2 min (valve closing time 60 s). Setpoint: LAHH at the level giving 25 min to overfill at the maximum transfer rate.
Where the target comes from (LOPA)
Operator error in transfer line-up or tank gauge failure → tank overfills → liquid spill, vapour cloud, ignition in the tank farm.
| Item | Value | Note |
|---|---|---|
| Initiating event frequency | 0.1 per year | 100 transfers per year × 1e-3 human error probability per transfer (illustrative) |
| Probability of ignition | 0.1 | |
| Probability of personnel in the tank farm | 0.5 | |
| Independent high level alarm (separate radar) and operator stops the transfer | 0.1 | Independent of the gauging system; 30 min available |
| Tolerable frequency | 1e-5 per year | Single fatality (illustrative) |
Mitigated event frequency without the SIF: 5.0 × 10⁻⁴ per year. Required risk reduction factor: 50. Required PFDavg: 0.02. Target: SIL 1.
Inputs (illustrative values)
| Group | Voting | λDU /h | λDD /h | λSU /h | β | T1 | PTC | Partial stroke | Type | SC |
|---|---|---|---|---|---|---|---|---|---|---|
| Independent radar LT-1501 | 1oo1 | 2e-7 | 8e-7 | 1e-7 | 0 % | 1 yr | 90 % | – | B | SC 3 |
| Safety PLC (shared) | 1oo1 | 5e-9 | 1e-6 | 0 | 0 % | 10 yr | 99 % | – | B | SC 3 |
| Receipt MOV XV-1501 | 1oo1 | 1e-6 | 0 | 1.6e-6 | 0 % | 1 yr | 90 % | – | B | SC 2 |
Mission time 20 years, low demand (PFDavg). Failure rates are illustrative values written for First Out AI, not taken from any certificate or database.
Result (First Out AI engine v0.3.0)
| Measure | Value |
|---|---|
| PFDavg | 0.015 |
| SIL by probability | 1 |
| SIL by IEC 61511 fault tolerance | 2 |
| Systematic capability | SC 2 |
| Achieved SIL | 1 (meets SIL 1) |
| Required PFDavg | 2e-2 (met) |
| Mean time to spurious trip | 17.6 years |
| Group | Voting | PFDavg | Share | HFT / required | SFF |
|---|---|---|---|---|---|
| Independent radar LT-1501 | 1oo1 | 2.5 × 10⁻³ | 17 % | 0 / 0 | 82 % |
| Safety PLC (shared) | 1oo1 | 2.3 × 10⁻⁴ | 1 % | 1 / 0 | 100 % |
| Receipt MOV XV-1501 | 1oo1 | 0.013 | 82 % | 0 / 0 | 62 % |
Engineer's reading
- Receipt MOV XV-1501 carries 82 % of the PFDavg, so improvements there matter most.
- With a perfect proof test (the Free plan assumption) the PFDavg would be 5.5 × 10⁻³; the difference to 0.015 is the effect of the realistic proof test coverage.
Open this example in First Out AI: SIL verification → Examples → "Storage tank overfill: close inlet valve (SIL 1)".
Written for First Out AI as engineering guidance. It supports engineering work and does not replace it; check every value against your standards, certificates and company rules with a competent functional safety engineer.