Worked example · SIF-Example-LSH
High-High Separator Level Shutdown: one SIF from risk to report
A complete, illustrative safety instrumented function taken through the SILProof workflow: LOPA sets the required SIL, the SRS states what the function must do, and SIL verification checks the design against all three IEC 61508 gates. Every number below is calculated by the same engine that runs in the workspace.
- Required
- SIL 2 · RRF 250
- PFDavg
- 9.509 × 10⁻⁵
- Claimed
- SIL 2 · target met
- Engine
- 2026.10.1
1 · Risk analysis
LOPA sets the required SIL
Scenario High-high separator level — L-101-HH: High-high separator level can cause liquid carryover into downstream equipment. Consequence: Potential mechanical damage and loss of containment downstream.
| Step | Value | Basis |
|---|---|---|
| Initiating cause | Inlet flow exceeds separation capacity · 0.025 /yr | Illustrative data for the worked example |
| Independent protection layer | Independent high-level alarm with operator response · PFD 0.1 | Credited: effective, independent, auditable |
| Independent protection layer | Second independent protection layer · PFD 0.1 | Credited: effective, independent, auditable |
| Mitigated frequency | 2.5 × 10⁻⁴ /yr | Cause × IPL PFDs |
| Tolerable frequency (TMEL) | 1 × 10⁻⁶ /yr | Illustrative company risk criterion |
| Required risk reduction | RRF 250 → SIL 2 | SIF PFDavg must be ≤ 4 × 10⁻³ |
2 · Safety requirements specification
What the SIF must do
Prevent liquid carryover to the downstream flare/compression system by initiating an independent shutdown on high-high separator level.
| Requirement | Value | Verified by |
|---|---|---|
| Detect high-high separator level | 2oo3 voting from LT-101A/B/C; setpoint defined by process design. | Test / Inspection |
| Initiate safety shutdown | Safety PLC shall initiate trip when voting logic is satisfied. | Functional Test |
| Safe state | XV-101A and XV-101B shall move to closed position and isolate separator inlet. | Full Stroke Test |
| Response time | Complete SIF response shall be less than the allocated process safety time. | Timing Test |
| Manual reset | Manual reset only after initiating condition has cleared and restart conditions are satisfied. | Functional Test |
- Safe state: Isolate the separator inlet by closing XV-101A and XV-101B.
- Process safety time: 10 s, allocated sensor 1.5 s, logic 0.5 s, final elements 4.0 s.
- Proof test: 12 months. Full loop proof test including sensor simulation, voting verification, logic trip test and final-element stroke test.
3 · Design
Sensor, logic solver and final elements
Failure rates in FIT (λDU / λDD). Final elements: two isolation paths voted 1oo2, each a solenoid in series with an ESD valve.
| Subsystem | Tag | Model | Voting | λDU / λDD | Type, SC |
|---|---|---|---|---|---|
| Sensor | LT-101A/B/C | SP-REF-LT-300 | 2oo3 | 60 / 160 | Type B, SC 3 |
| Logic solver | SPLC-101 | SP-REF-SPLC-1oo2D | 1oo2D | 25 / 120 | Type B, SC 3 |
| Final element · Isolation Path A | SOV-101A | SP-REF-SOV-24 | 1oo2 paths | 35 / 100 | Type A, SC 3 |
| Final element · Isolation Path A | XV-101A | SP-REF-ESD-150 | 1oo2 paths | 60 / 180 | Type A, SC 3 |
| Final element · Isolation Path B | SOV-101B | SP-REF-SOV-24 | 1oo2 paths | 35 / 100 | Type A, SC 3 |
| Final element · Isolation Path B | XV-101B | SP-REF-ESD-150 | 1oo2 paths | 60 / 180 | Type A, SC 3 |
4 · SIL verification
Three gates, the lowest governs
| Gate | Result | Meaning |
|---|---|---|
| Quantitative (PFDavg) | 9.509 × 10⁻⁵ · RRF 10,516 | Sensor 2.653 × 10⁻⁵, logic 6.563 × 10⁻⁶, final elements 6.200 × 10⁻⁵. Quantitatively in the SIL 4 band. |
| Hardware architecture | SIL 2 | Route 1H: the sensor and logic solver limit the claim to SIL 2. |
| Systematic capability | SC 3 | Lowest device SC 3. |
| Claimed SIL | SIL 2 | Lowest of the three gates. Target SIL 2 is met. |
A PFDavg in the SIL 4 band does not make that claim on its own: here the architecture gate governs. This is why SILProof reports all three gates rather than the PFDavg alone.
5 · Report
The issued verification report
The report sets out the requirement, the device data with sources, the reliability model and assumptions, the per-subsystem results, sensitivity checks and the three-gate conclusion. It is produced by the same renderer as every member's report.
About this example
Plant, devices and failure rates are illustrative and not for design use. SILProof is engineering support, not certification: real projects need competent, independent review against the applicable editions of IEC 61508 and IEC 61511.