A Practical Checklist for SIF Mission Time and Useful Life

Mission time and useful life show up on the same PFD calculation sheet, and it’s easy to treat them as interchangeable. They’re also two of the most commonly confused parameters in SIF design. They sound similar. They sometimes even land on the same number. But they answer two completely different questions:

Mix them up, or let either one default to a number nobody revisited, and your PFD can look fine on paper while quietly drifting from how the equipment actually behaves. Use this cheat sheet as a working checklist the next time you’re building or reviewing a SIF design, or scoping what needs to happen before your next turnaround.

1. Have you found the equipment inside the bathtub curve, not just anywhere on it? Useful life is the flat middle section of the bathtub curve; the window where a constant failure rate is actually a fair assumption. Before it: the early failure period, too unpredictable to trust. After it: the wear-out phase, where failure rates start climbing, and your PFD calculation quietly stops matching reality.

2. Did you pull the number from the manufacturer’s functional safety manual for this manufacturer, this model? Useful life isn’t a category-wide constant. Two manufacturers making the same type of pressure transmitter can publish very different numbers, sometimes 10 years, sometimes 20, depending entirely on the internal components and build quality they used. Don’t reuse a number from memory or from a different vendor’s datasheet.

3. Does the manufacturer’s number match your actual operating conditions? Functional safety manuals state useful life within specified operating conditions, not universally. A real example from a valve’s functional safety manual: 15 years or 10,000 cycles, whichever comes first, for clean, well-lubricated service. Run that same valve in a fouling, corrosive, or high-differential-pressure environment, and that number no longer applies.

4. If conditions don’t match, have you gone back to the manufacturer? If your service is more severe than what’s specified, ask the manufacturer directly what useful life applies to your actual conditions. Don’t assume the published number still holds.

5. If the answer comes back too short, have you weighed your two real options? Sometimes the honest answer is a useful life of one or two years, which is rarely practical for an operating site. At that point, you have two paths:

This is fundamentally a CAPEX vs. OPEX decision: pay more upfront for more robust equipment, or pay less upfront and replace more often. Every project should deliberately find that tipping point, rather than defaulting to whichever number was easiest to find.

6. Have you checked whether the equipment is actually made of several components with different lifetimes? Valve assemblies are the classic case: solenoid, actuator, valve body, and sometimes a quick exhaust. Each can have its own useful life. A solenoid rated for 5 years inside an actuator and a body rated for 10 doesn’t mean the valve is good for 10. The shortest-lived component sets the real replacement clock for the assembly, unless you deliberately match components with aligned lifetimes at the project stage.

1. Are you clear that mission time applies to the whole SIF, not a single component? Where useful life is equipment-specific, mission time is defined at the level of the complete safety function: the intended operational duration before it’s fully replaced or overhauled.

2. Do you know who actually sets this number? Not the manufacturer. Not a standard. Mission time is an end-user decision. Standards guidance is thin. ISO 13849-1 references a default assumption of 20 years if nothing else is specified, but there’s no mandated value.

3. Have you understood why mission time exists — accumulation of unrevealed failures? Every partial test (such as partial stroke testing) catches some failures, but not all of them. Between overhaul-level tests, undetected failures quietly accumulate; picture a line that slowly slopes upward over time. The longer your mission time stretches without a full reset, the higher that accumulation climbs, and the higher your PFD average rises with it.

4. Have you checked what happens if mission time is stretched too far? Extend mission time from 20 years to 50, and the PFD average can climb sharply, potentially double, simply because unrevealed failures were never fully cleared. That can push a SIF past its target PFD without a single physical failure having occurred; it’s purely a modeling consequence of the assumption you chose.

5. Have you capped it at a sensible, commonly-used interval? 20 years is most common in practice; 30 years is also common. The point of capping mission time is to force a full overhaul or replacement before unrevealed failure accumulation gets out of hand, not to match how long the hardware could physically survive.

6. If you’re working in a tool without an explicit “useful life” field, do you know the workaround? Some SIF calculation platforms don’t expose a distinct useful life parameter. The workaround: model an overall test with a 100% test coverage factor at an interval equal to the equipment’s useful life. That single high-coverage test drives the PFD back down to zero, functionally reproducing what useful life is meant to represent, even without a dedicated field.

If you only have time for one pass before a shutdown or brownfield scope review, run through this:

If any box goes unchecked, that’s exactly where a PFD calculation quietly drifts from the equipment’s real-world behavior — and exactly what tends to surface at the worst possible time: mid-turnaround, scope already locked.