Sizing a High-Temperature Trip Against a LOPA Target
A chemical reactor's high-temperature trip is being designed to protect against a runaway reaction with a catastrophic consequence. The plant's LOPA sets a tolerable frequency of 0.0001 per year for the consequence. Loss of cooling, the initiating event, occurs at 0.5 per year. One independent protection layer is credited: a high-temperature alarm with a verified operator response, PFD 0.1. The safety instrumented function being designed uses a single temperature transmitter with a dangerous undetected failure rate of 5E-6 per hour and a one-year proof-test interval, and it trips a single shutdown valve. A vendor proposes a 1oo2 transmitter arrangement with the same device in both channels, quoting a beta factor of 10% for common cause, and offers a two-year proof-test interval as a maintenance-cost saving. Operations supports the two-year interval because each proof test requires a full plant shutdown. The project manager asks whether the SIF as designed satisfies the LOPA, and whether the vendor's proposal is acceptable.
1. Determine the PFD the SIF must achieve and calculate the PFD of the 1oo1 design. Does it satisfy the LOPA?
Read the worked answer
Set up the LOPA arithmetic first. Required SIF PFDavg = tolerable frequency / (initiating frequency x credited IPL PFDs) = 0.0001 / (0.5 x 0.1) = 0.0001/0.05 = 0.002. That is a SIL 2 target (PFDavg 0.001 to 0.01), but the requirement is 0.002 specifically - landing anywhere inside the SIL 2 band is not sufficient.
Check the 1oo1 design. For a single channel with proof-test interval TI, PFDavg is approximately lambda_DU x TI/2, assuming the proof test detects all dangerous undetected failures and repair restores the unit.
- lambda_DU = 5E-6/h x 8,760 h/yr = 0.0438 per year.
- With TI = 1 year: PFDavg = 0.0438 x 1/2 = 0.0219.
That is SIL 1 territory, roughly 11 times the required 0.002. The SIF as designed does not satisfy the LOPA. To reach 0.002 from a single channel you would need TI of about 0.09 year, roughly one month, which is not credible for a reactor shutdown test on an operating plant.
The design must change - redundancy, diagnostics with automatic trip, a much shorter proof test, or a reduction in demand - and if any credited IPL changes, the LOPA must be re-run. Also confirm that the high-temperature alarm and operator response are genuinely independent of this SIF and of the control system. If the operator responds using the same transmitter, the 0.1 credit is double-counted and the required PFD becomes even smaller.
2. Evaluate the vendor's 1oo2 proposal with beta = 10% and a one-year proof-test interval. Does redundancy close the gap?
Read the worked answer
Redundancy helps, but check whether it helps enough. The standard approximation for a 1oo2 channel pair is:
PFDavg = (lambda_DU x TI)^2 / 3 + beta x lambda_DU x TI / 2
With lambda_DU x TI = 0.0438 and beta = 0.10:
- Independent term: 0.0438^2 / 3 = 0.00064
- Common-cause term: 0.10 x 0.0438 / 2 = 0.00219
- PFDavg = about 0.0028
That is still above the 0.002 the LOPA requires. The vendor's arrangement does not close the gap. The common-cause term is about 77% of the total, so the second channel buys very little against the dominant failure mode. The 1oo1-to-1oo2 step reduced PFD by a factor of roughly eight, not the factor of a hundred a naive reading of redundancy would suggest.
It is close, so the fix is available. Shortening the proof-test interval to six months with the same 1oo2 hardware gives lambda_DU x TI = 0.0219, and PFDavg = 0.00016 + 0.00110 = about 0.0013, which meets 0.002 with margin. Alternatively, reduce beta by using a diverse measurement principle or a physically separated device - but only if a documented common-cause analysis and the vendor's beta data support the lower figure. Do not assume beta = 5% because the two devices have different model numbers.
Finally, confirm that the proof test actually detects the dangerous failures (proof-test coverage), and include the shutdown valve in the calculation, not just the transmitter. The valve is often the weakest element and is easy to leave out of the arithmetic.
3. Operations wants the two-year proof-test interval to avoid plant shutdowns. Evaluate that proposal quantitatively and state what alternatives you would offer.
Read the worked answer
Reject the two-year interval. For the same 1oo2 structure with TI = 2 years, lambda_DU x TI = 0.0438 x 2 = 0.0876:
- (0.0876)^2 / 3 = 0.00256
- 0.10 x 0.0876 / 2 = 0.00438
- PFDavg = about 0.0069, roughly 3.5 times the 0.002 target.
Although 0.0069 sits technically inside the SIL 2 band, the LOPA did not ask for SIL 2 generically - it asked for 0.002 against this consequence. Doubling the interval triples the PFD and consumes all the margin; a small increase in demand rate, or a beta worse than 10%, would push the function out of SIL 2 entirely.
Two things the average hides. PFDavg is an average over the interval, and the instantaneous PFD rises toward lambda_DU x TI just before the proof test - the risk is concentrated in exactly the period operations is trying to extend. And bypass and override time, during maintenance or when the trip is defeated to keep running, adds directly to the average and often dominates it in practice. A two-year interval creates more opportunities for informal bypasses, not fewer.
Alternatives that address the real cost driver:
- Partial proof testing - exercise the sensor loop and the logic without a full plant shutdown, and reserve the full test, including the valve stroke, for turnarounds.
- Automatic diagnostics that increase effective coverage and shorten the detected-failure repair time.
- A diverse second channel to lower beta, which attacks the term that dominates the calculation.
Extending the interval without one of these is a safety-effectiveness trade that the data do not support, and it should not be approved on the strength of a shutdown schedule.