Offshore Platform Fire & Gas System SIL Verification

Case Study 1: Offshore Platform Fire & Gas System SIL Verification

Scenario

A major North Sea operator upgraded its legacy fire and gas (F&G) detection system on a manned production platform. The new system comprises redundant transmitters, a safety PLC with dual-channel voting logic, and HART-enabled diagnostics. Regulatory requirements mandated SIL 2 compliance per IEC 61511 for the shutdown function triggered by hydrocarbon gas detection. Key constraints included: limited access for maintenance (only quarterly during weather windows), harsh marine environment (salt-laden air, vibration), and no opportunity for online diagnostics beyond built-in self-tests.

Given Data

• lambda_du = 8.2 × 10⁻⁶ failures/hour (based on FMEDA of SIL-rated pressure transmitters and solenoid valves)
• lambda_dd = 4.1 × 10⁻⁶ failures/hour (diagnosable faults from self-test routines)
• lambda_su = 1.5 × 10⁻⁵ failures/hour (safe undetected — e.g., transmitter drift below alarm threshold)
• lambda_sd = 3.0 × 10⁻⁶ failures/hour (safe detected — e.g., open-circuit fault flagged in HART diagnostics)
• t1 = 8760 h (1 year — first proof test after commissioning)
• t2 = 17520 h (2 years — second proof test)
• t3 = 26280 h (3 years — third proof test)
• t4 = 35040 h (4 years — fourth proof test; aligns with planned platform turnaround schedule)

Calculation

The SIL Verification Calculator computes PFDavg using the time-dependent average probability of failure on demand over the full test interval sequence (up to t₄ = 4 years). For a multi-interval proof test schedule, the tool applies the standard IEC 61508-6 formula adapted for staggered intervals:

PFDavg ≈ (1 / T) × Σᵢ₌₁⁴ [∫tᵢ₋₁tᵢ λDU × t + (λDD × t² / 2τ) ] dt, where τ is the effective diagnostic interval (here assumed 8760 h, as diagnostics run continuously but only validated at proof test). However, the calculator internally uses the industry-standard approximation for non-uniform test intervals:

PFDavg = (λDU × T / 2) + (λDD × T / 2) × (1 − DC),

where Diagnostic Coverage (DC) = λDD / (λDU + λDD) = 4.1e−6 / (8.2e−6 + 4.1e−6) = 0.333 → 33.33%.

Using the tool’s validated numerical integration across t₁–t₄ (accounting for increasing unrevealed DU accumulation between tests), the output is:

• pfd_avg = 0.003214 (i.e., 3.214 × 10⁻³)
• diagnostic_coverage = 33.33%

Result and Decision

PFDavg = 0.003214 falls within the SIL 2 range (0.01 to 0.001). The system meets SIL 2 requirements only because the proof test interval was shortened to annual (t₁ = 8760 h) — sensitivity analysis showed that extending t₁ to 2 years increased PFDavg to 0.0061 (>0.005 upper bound for SIL 2). Consequently, the operator mandated annual proof testing (including loop checks, sensor calibration, and valve stroke tests) and upgraded diagnostics firmware to increase λDD by 40%, raising DC to 45% in the next revision.

Lesson

Proof test frequency dominates PFDavg more than component failure rates in low-DC systems — always validate test logistics early in design, not just component specs.