LPG high-pressure shutdown - can a proof-test interval be extended and the SIL 2 claim sustained?

Use the simplified 1oo1 approximation PFDavg = lambda-DU x TI / 2, with 1 FIT = 1e-9 per hour.

At TI = 5 years = 43 800 h:

• Transmitter: 800e-9 x 43 800 / 2 = 0.0175
• Shutdown valve: 3000e-9 x 43 800 / 2 = 0.0657
• Solenoid: 500e-9 x 43 800 / 2 = 0.0110
• Total PFDavg = 0.094

IEC 61508 bands: SIL 1 is 0.1 to 0.01, SIL 2 is 0.01 to 0.001. So the function as designed achieves SIL 1 only, one full band below the requirement. The valve is the dominant contributor, about 70 % of the total.

At TI = 8 years = 70 080 h: the PFDavg scales linearly with the interval, a factor of 1.6.

• Total = 0.094 x 1.6 = 0.151

That is above 0.1, so the function would not even meet SIL 1 - it would be unclassified against the LOPA target. The intervals actually achieved (6.5 and 7.0 years) already give about 0.122 to 0.132, i.e. the function has been operating below SIL 1 for at least two test cycles.

Conclusion to put to management: the request is not a scheduling convenience, it is a reduction in the integrity of a safety function that is already under-performing. The extension cannot be granted, and signing the functional safety assessment as requested would be certifying something the numbers contradict. Note also that the SIL 2 target cannot be reached by shortening the test interval alone without also changing the architecture: at a 1-year interval the same 1oo1 arrangement gives 0.019, still SIL 1.

Target a design PFDavg of about 5e-3 or better, giving a factor of two against the 0.01 SIL 2 limit.

• Transmitters: 1oo2, TI = 1 year, beta = 10 %. PFD = (lambda-DU x TI)^2 / 3 + beta x lambda-DU x TI / 2 = (7.0e-3)^2/3 + 0.1 x 7.0e-3/2 = 1.6e-5 + 3.50e-4 = 3.7e-4.
• Final element (valve plus solenoid, 3500 FIT) with an annual full stroke proof test plus quarterly partial stroke testing credited with 80 % diagnostic coverage. Untested 20 % (700 FIT, TI 1 year) gives 3.07e-3; the tested 80 % (2800 FIT, PST interval 0.25 year = 2190 h) gives 3.07e-3; total 6.1e-3.
• Combined: about 6.5e-3, meeting SIL 2 with roughly 35 % margin.

Flag clearly that the credit claimed for partial stroke testing is an engineering judgement that must be justified against the vendor's diagnostics and preferably confirmed by an independent assessment; if only 60 % coverage can be defended, a single valve will not get there and a 1oo2 valve arrangement is needed. The same applies to the IEC 61511 architectural constraints: a valve with no automatic diagnostics (DC below 60 %) cannot be used in a 1oo1 configuration for SIL 2 regardless of the PFD number.

Common-cause and systematic issues not visible in the arithmetic:

• One solenoid serves both bullets, so a single failure defeats both safety functions. Provide a dedicated SIS solenoid per valve, separate from the DCS.
• The same solenoid is pulsed by the DCS for routine isolation. This causes spurious trips, means the valve is being exercised outside the proof-test regime, and destroys as-found data. Separate the operational isolation function from the SIS function.
• A shared instrument air header with no dedicated SIS receiver means a plant air failure or an isolatable air line defeats both. Provide a dedicated SIS air receiver with a non-return valve and a low-pressure alarm.
• Common impulse line or a shared root valve on the two new transmitters defeats the 1oo2. Use separate taps and separate manifolds.
• Missing as-found records mean the proof tests cannot be credited at all - a test with no recorded result is not evidence. Rewrite the procedure with as-found and as-left values, acceptance criteria, and a named competent person.
• Bypass and override management, the trip amplifier as a single point of failure for both bullets, and the competence of the test team are all systematic items the FSA must address.

Refuse to sign the extension as requested, and say why in writing. An extension is a change to the safety requirements specification, not a maintenance adjustment. It needs a formal management-of-change, a re-verification of the PFDavg and the architectural constraints, a functional safety assessment, and an update to the SIS safety manual and the operating procedures.

Offer workable alternatives rather than a flat refusal:

• Keep the full stroke test at 1 year and use the tank inspection outage for it only if the two cycles genuinely coincide; implement quarterly partial stroke testing online in between.
• Separate the proof tests of the transmitter loop and the final element so the plant does not need a full shutdown for each.
• Re-plan the tank inspection interval itself if operations wants alignment - but the direction of influence must be safety-to-schedule, never schedule-to-safety.

What senior management needs to hear, in one page: the current function is SIL 1 against a SIL 2 requirement; extending to 8 years takes it below SIL 1; the dominant contributor is the valve with no diagnostics; the cheapest high-value actions are separating the solenoid and adding partial stroke testing. Quantify the residual risk they would be accepting, and record that the escalation was made. If management decides to proceed regardless, the decision must be documented as a management decision with a named accountable owner, and the engineer's dissent recorded - signing a false assessment is a personal professional exposure, not a company decision you can shelter behind.

Also flag the historical non-conformance: the proof tests at 6.5 and 7.0 years should be raised as an incident or deviation through the site's safety reporting system, with a corrective action, not quietly absorbed into a new schedule.