High-Demand Burner Management SIL Claim

With 20 demands per year, the function is in high-demand mode under IEC 61511: more than 1 demand/year and not more than 100 demands/year. In high-demand mode the relevant measure is the average frequency of dangerous failure per hour (PFH), not PFDavg alone. The vendor's PFDavg of 2E-3 is a low-demand measure and cannot by itself substantiate a high-demand SIL 2 claim. SIL 2 in high-demand mode requires PFH in the range 1E-7 to 1E-6 per hour.

The quoted dangerous undetected failure rate of 5E-7/h gives a first estimate of PFH of about 5E-7/h for a 1oo1 function, which is inside the SIL 2 band. That is not sufficient evidence: I would require confirmation that all dangerous failures are included, that diagnostic coverage and proof-test coverage are known, that the architecture meets the architectural constraints for the component type and safe failure fraction, and that systematic capability is SIL 2. I would also challenge whether each start actually demands the flame-failure function; if it does not, the demand rate and mode may be wrong. The SIL 2 claim can stand only on a verified PFH and architecture, not on the PFDavg quotation alone.

The maintenance team's argument uses the wrong metric. In high-demand mode, a proof-test extension must be justified by the effect on PFH and on the probability that a dangerous undetected failure survives until a demand, not simply by showing that PFDavg remains below 1E-2. Because the function is demanded frequently, many dangerous failures may be revealed at the next demand, so PFH may be dominated by the failure rate rather than by the proof-test interval. However, that depends on proof-test coverage and on whether every demand actually exercises the full flame-failure path.

I would require a quantitative assessment using the vendor's failure data, diagnostic coverage, proof-test coverage and common-cause beta, plus a review of the spurious trip rate. Three spurious trips per month is already high and may create pressure to bypass, which is a separate risk. The extension should not be approved merely to reduce downtime. It can be approved only if the calculated PFH remains within the SIL 2 band, the safety manual permits the interval, the proof test still covers the full function, and the change is managed under MOC. If the proof test is the only means of detecting failures not revealed by demand, a 12-month interval increases exposure and needs strong justification.

Disabling the flame-failure trip during warm-up is not acceptable as a normal operating practice. Warm-up is a foreseeable mode with a known risk of flame loss, and a bypass would remove the protection exactly when the burner is least stable. If a short, controlled bypass is unavoidable, it needs a formal risk assessment, a defined maximum duration, independent authorization, compensating measures such as continuous flame monitoring and manual shutdown capability, and a clear abort criterion. It cannot be justified only by spurious trips.

Connecting the spare scanner is technically attractive but must be engineered, not improvised. If the second scanner creates a 1oo2 or 2oo3 architecture, it may improve both availability and safety, but the voting logic, common-cause susceptibility, proof-test procedure, diagnostic coverage and architectural constraints must be verified. A spare scanner that is simply connected without validation may create new failure modes, such as a blocked-view fault that is masked by voting. I would require an MOC, revised SIL verification, validation of the modified BMS, and operator training before changing the configuration.