🎓 Lesson 20
D5
Case Review: Offshore LNG Fault Tree & SIS Optimization
A fault tree is a diagram that shows how different equipment failures or human errors can combine to cause a major safety incident—like an LNG leak offshore—and helps engineers design better safety systems to stop it before it happens.
🎯 Learning Objectives
- ✓ Construct a qualitative fault tree for an offshore LNG vapor detection failure scenario
- ✓ Calculate the unavailability of a Safety Instrumented Function (SIF) using component failure data and architecture metrics
- ✓ Analyze SIL compliance by comparing calculated PFDavg against target values per IEC 61511 Table 3
- ✓ Explain trade-offs between redundancy (1oo2 vs. 2oo3) and proof-test coverage in offshore SIS design
- ✓ Apply Layer of Protection Analysis (LOPA) to justify SIL assignment for an LNG overpressure scenario
📖 Why This Matters
Offshore LNG facilities operate under extreme environmental constraints—corrosion, limited access, high consequence of failure—and face stringent regulatory scrutiny. A single undetected fault in gas detection or emergency shutdown logic can cascade into fire, explosion, or environmental catastrophe. This case review bridges theory (FTA/SIL) with real-world constraints: how engineers *actually* simplify complex trees, select realistic failure data, and balance cost, reliability, and maintainability in harsh marine environments—making it foundational for any process safety professional working in energy infrastructure.
📘 Core Principles
Fault Tree Analysis begins with a clearly defined Top Event (e.g., 'Failure to Isolate LNG Feed on High Pressure Alarm') and decomposes it using logic gates into Basic Events (component failures, human errors, external events). Quantitative FTA assigns failure rates (λ) and proof-test intervals (T) to each basic event, then computes Probability of Failure on Demand (PFD) for Safety Instrumented Functions (SIFs). SIS optimization requires evaluating architecture (e.g., 1oo2, 2oo3), diagnostic coverage (DC), common cause failure (β-factor), and test effectiveness—all governed by IEC 61511’s lifecycle approach. Offshore context adds critical modifiers: higher λ due to salt corrosion, lower DC due to infrequent testing, and stricter SIL targets (often SIL 2 or 3) for hydrocarbon release scenarios.
📐 PFDavg for a 1oo2 Voting Architecture
This formula estimates the average probability of failure on demand for a redundant SIF where one out of two channels must work. It accounts for dangerous undetected failures (λDU), proof-test interval (T), and diagnostic coverage (DC). Used during SIL verification to confirm compliance with target PFD ranges.
PFDavg (1oo2)
PFDavg ≈ (1/2) × λDU × (1 − DC) × T + β × λDU × TAverage probability of failure on demand for a one-out-of-two voting SIF, incorporating diagnostic coverage and common cause failure.
Variables:
| Symbol | Name | Unit | Description |
|---|---|---|---|
| λDU | Dangerous Undetected Failure Rate | /year | Rate at which a component fails dangerously and remains undetected until proof test |
| DC | Diagnostic Coverage | dimensionless | Fraction of dangerous failures detected automatically by self-diagnostics |
| T | Proof-Test Interval | years | Time between manual or automated comprehensive tests |
| β | Beta Factor (CCF) | dimensionless | Proportion of λDU attributable to common cause failure modes |
Typical Ranges:
Offshore pressure transmitter (corroded environment): 2.0 × 10⁻⁴ – 8.0 × 10⁻⁴ /yr
Offshore SIS logic solver (IEC 61508 certified): 0.5 × 10⁻⁴ – 2.0 × 10⁻⁴ /yr
💡 Worked Example
Problem: A pressure transmitter SIF in an offshore LNG facility uses a 1oo2 architecture. Each transmitter has λDU = 4.2 × 10⁻⁴ /yr, T = 1 yr, DC = 0.75, and β = 0.05 (common cause factor). Calculate PFDavg.
1.
Step 1: Compute effective λDU per channel after diagnostics: λDU_eff = λDU × (1 − DC) = 4.2e−4 × (1 − 0.75) = 1.05e−4 /yr
2.
Step 2: Apply 1oo2 formula: PFDavg ≈ (1/2) × λDU_eff × T + β × λDU × T = (0.5 × 1.05e−4 × 1) + (0.05 × 4.2e−4 × 1)
3.
Step 3: Calculate: = 5.25e−5 + 2.1e−5 = 7.35e−5
Answer:
The result is 7.35 × 10⁻⁵, which falls within the safe range for SIL 3 (PFDavg = 10⁻⁵ to 10⁻⁴).
🏗️ Real-World Application
In the 2021 Chevron Gorgon LNG SIS upgrade (Barrow Island, Australia), engineers revised the flare header overpressure protection SIF after LOPA identified a gap in existing SIL 2 design. Original 1oo2 pressure transmitters showed PFDavg = 1.8 × 10⁻⁴ — exceeding SIL 2 upper limit (10⁻³) but insufficient for SIL 3 (target ≤ 10⁻⁴). Optimization included: (1) upgrading to 2oo3 architecture, (2) adding partial stroke testing (PST) to raise DC from 0.65 to 0.92, and (3) shortening proof-test interval from 24 to 12 months. Recalculation yielded PFDavg = 6.1 × 10⁻⁵ — verified SIL 3 compliant and approved by NOPSEMA.
📋 Case Connection
📋 Offshore LNG Transfer System Fault Tree Analysis and SIS Architecture Optimization
High consequence of LNG spill + ignition in congested maritime corridor; existing SIS used single-channel logic