Overspeed Trip: SIL 2 With a Monthly Bypass Habit
A gas turbine package has a 1-out-of-1 overspeed trip: one speed sensor, one logic solver, one fuel shutoff valve. The SIL 2 target requires PFDavg between 10^-3 and 10^-2. Vendor data give a dangerous undetected failure rate of 3.5x10^-6/h for the whole loop. The proof test interval is 12 months, and the proof test is credited with detecting 90% of dangerous undetected failures. Operations bypasses the trip for 4 h each month to test the governor, using a key switch and a paper log. A sister plant had an incident in which the trip was left bypassed for 11 days. The site performs 12 bypasses a year, the estimated human error probability for failing to restore is 0.05 per bypass, and restoration is verified only at the next monthly walkdown.
1. Compute PFDavg for the loop, first with perfect proof testing, then with 90% proof-test coverage, then including the bypass periods. What SIL is actually achieved?
Read the worked answer
Ideal 1oo1, perfect proof test: PFDavg = lambda_DU x TI / 2 = 3.5x10^-6 x 8,760 / 2 = 0.0153
SIL 2 requires 10^-3 <= PFDavg < 10^-2, so 0.015 is SIL 1. The loop fails the target before any human factors are considered.
With 90% proof-test coverage: the 10% of dangerous undetected failures the proof test cannot reveal stay undetected for the whole interval rather than half of it: PFDavg = lambda_DU x [PTC x TI/2 + (1 - PTC) x TI] = 3.5x10^-6 x [(0.9)(4,380) + (0.1)(8,760)] = 3.5x10^-6 x 4,818 = 0.0169
Including bypass: 4 h/month = 48 h/year during which the function is unavailable (PFD = 1). Time-weighted: PFDavg = (8,712/8,760)(0.0169) + (48/8,760)(1.0) = 0.0168 + 0.0055 = 0.0223
Conclusion: the achieved performance is SIL 1, roughly twice the SIL 2 upper limit. Two separate causes: an architecture and proof-test interval that are inadequate even on paper, and a bypass regime that adds a third of the total risk on its own. Both must be dealt with; fixing only one leaves the loop outside SIL 2. Note also that the 90% coverage credit should be scrutinized: unless the shutoff valve receives a partial stroke test, the valve's dangerous failures are largely uncovered no matter what the sensor and logic solver do.
2. Quantify the human-error contribution from the monthly bypass and evaluate the adequacy of the current controls.
Read the worked answer
Per bypass, P(fail to restore) = 0.05. With 12 bypasses per year and independent events: P(at least one un-restored bypass in a year) = 1 - 0.95^12 = 0.46
So there is roughly a 46% chance per year that the trip is left bypassed at least once. Once left, it stays bypassed until the next monthly walkdown, up to about 30 days, i.e. up to 720 h of unprotected operation. The sister plant's 11-day bypass is not an outlier; it is the expected outcome of this design.
The 0.05 figure is itself optimistic. Human error probabilities of this kind depend on feedback quality, task duration, interruption, and shift handover. A 4 h bypass at the end of a shift, with no independent verification and only a paper log, sits in the range where 0.1 to 0.3 is more defensible. Even at 0.05, the exposure dominates the loop's equipment reliability.
The controls are inadequate because they rely on memory and documentation rather than on a forcing function:
- A key switch with a paper log provides no independent check and no active reminder.
- Verification only at the monthly walkdown means the failure has up to 30 days to persist.
- No alarm, no time limit, no automatic restoration, no cross-check between the bypass log and the trip health status.
This is a design deficiency, not an operator discipline problem. Do not respond with retraining and a stronger warning in the procedure.
3. Recommend a risk-reduction package that would credibly achieve SIL 2, and explain how the bypass and the human factors should be treated in the safety case.
Read the worked answer
Equipment and architecture. Move to 2-out-of-3 speed sensing with online test and repair, which removes most of the need to bypass for sensor testing. For the remaining loop, shorten the proof test to 6 months: PFDavg = 3.5x10^-6 x [(0.9)(2,190) + (0.1)(4,380)] = 3.5x10^-6 x 2,409 = 0.0084, inside SIL 2 but with only about 16% margin below 10^-2. Add automated partial stroke testing of the shutoff valve, which raises proof-test coverage to 95-99% and is the highest-leverage single change for the valve, easily the weakest element in a 1oo1 loop.
Bypass. Eliminate it where possible by design. Where a bypass is still needed, impose a hard time limit with automatic restoration (for example 2 h), a control-room alarm that persists until restoration is confirmed, bypass status wired into the trip health monitoring rather than only written in a log, two-person sign-off with key retention until restoration, and a periodic audit comparing bypass records against system status.
Safety case treatment. The bypass is a defined operating mode of the safety function, not an exclusion to be subtracted from the calculation. Include it as a time-weighted term, credit only controls you can demonstrate, and show the sensitivity to the human error probability across 0.05 to 0.3. Recompute with 6-month proof test plus automated valve test plus a managed bypass, and verify the result is inside 10^-3 to 10^-2 with margin rather than at the boundary.
ALARP and change control. A bypass timer and alarm cost on the order of $10-20k against a credible risk of an overspeed event; the disproportion argument for not implementing it is very hard to sustain. Treat the new bypass procedure and any trip architecture change as a safety-function modification requiring re-verification under management of change, not as a procedural update, and record the human factors assessment alongside the SIL calculation.