A Safety Instrumented System (SIS) is the last layer of protection before a hazardous event. Verifying that a SIS meets its required Safety Integrity Level (SIL) is a mathematical exercise defined in IEC 61511. This article explains the key calculations every functional safety engineer needs to understand — and the common mistakes that lead to incorrect results.

The Safety Life Cycle

IEC 61511 defines a safety lifecycle from hazard identification through decommissioning. SIL verification sits in Phase 11 (Safety Requirement Specification verification) and Phase 12 (design and engineering) of the lifecycle. Before you can verify a SIL, you need:

  • A completed HAZOP or LOPA (Layer of Protection Analysis) that defines the required risk reduction for each Safety Instrumented Function (SIF)
  • A defined SIL target (SIL 1, 2, or 3) for each SIF, derived from the LOPA
  • A proposed SIF architecture (sensors, logic solver, final elements) with certified failure rate data from vendor SIL certificates

Key Metrics: PFD, PFH, and RRF

SIL verification revolves around three metrics:

  • PFDavg (Average Probability of Failure on Demand): Used for demand-mode SIFs — those that operate infrequently and only act when a hazardous event occurs. Most process safety functions are demand-mode. PFDavg is the probability that the SIF will fail to respond when called upon.
  • PFH (Probability of Dangerous Failure per Hour): Used for continuous-mode SIFs — those that must operate continuously to prevent a hazard. High-speed machinery guarding and some burner management systems fall in this category.
  • RRF (Risk Reduction Factor): The reciprocal of PFDavg. A PFDavg of 0.01 corresponds to an RRF of 100. LOPA typically expresses required risk reduction as an RRF, which is then converted to a target PFDavg for the SIL verification.

SIL bands for demand mode (PFDavg): SIL 1 = 0.1 to 0.01; SIL 2 = 0.01 to 0.001; SIL 3 = 0.001 to 0.0001. For continuous mode (PFH): SIL 1 = 10^-5 to 10^-6; SIL 2 = 10^-6 to 10^-7; SIL 3 = 10^-7 to 10^-8.

The Simplified Equations

For a single-channel (1oo1) SIF with a proof test interval T1, the simplified PFDavg formula is:

PFDavg = (lambda_DU x T1) / 2

Where lambda_DU is the dangerous undetected failure rate of the subsystem (in failures per hour). This formula assumes no diagnostic coverage, which is conservative. For systems with diagnostic coverage (DC), the effective lambda_DU is reduced.

For a 1oo2 (one-out-of-two) redundant architecture, two channels provide the SIF function. Either channel failing dangerous and undetected is only a problem if both channels fail simultaneously:

PFDavg (1oo2) = (lambda_DU x T1)^2 / 3

This is roughly the square of the 1oo1 PFDavg, which is why redundancy dramatically improves SIL capability. A 1oo2 architecture can typically achieve one full SIL higher than a 1oo1 architecture with the same components.

How Component Failure Rates Are Used

Vendor SIL certificates provide the following data for each component:

  • lambda_D (Dangerous failure rate): Total dangerous failures per hour (detected + undetected)
  • lambda_DU (Dangerous Undetected failure rate): Dangerous failures not revealed by diagnostics
  • DC (Diagnostic Coverage): Fraction of dangerous failures detected by internal diagnostics. DC = lambda_DD / lambda_D
  • SFF (Safe Failure Fraction): Fraction of all failures that are either safe or detected dangerous. SFF = (lambda_S + lambda_DD) / (lambda_S + lambda_D)
  • HFT (Hardware Fault Tolerance): Number of faults that can be tolerated. HFT of 0 means a single failure can cause loss of SIF function.

For a complete SIF, you calculate the subsystem PFDavg for sensors, logic solver, and final elements separately, then sum them to get the total SIF PFDavg. The SIF meets its SIL target if the total PFDavg falls within the target SIL band.

Proof Test Interval and Its Impact

The proof test interval T1 has a linear effect on PFDavg in the simplified equations. Halving the proof test interval halves the PFDavg — a full SIL improvement. In practice, this means:

  • A SIF that cannot reach SIL 2 with annual proof testing may achieve SIL 2 with six-month proof testing
  • Reducing proof test intervals has real costs — SIS downtime, maintenance labour, production loss
  • Proof test effectiveness matters as much as frequency. A partial proof test that only tests 60% of the dangerous failure modes should only be credited for that 60% coverage in the calculation

Common Calculation Mistakes

In practice, four mistakes appear repeatedly in SIL verification reports:

  • Using catalogue MTBF instead of lambda_DU: Published MTBF figures from device datasheets are total failure rates, not dangerous undetected failure rates. Always use the lambda_DU from the SIL certificate, not the inverse of MTBF.
  • Ignoring common cause failures: In redundant architectures, a beta factor (typically 1-10%) is applied to account for failures that affect multiple channels simultaneously. Omitting beta overestimates the benefit of redundancy.
  • Crediting 100% proof test effectiveness: Real proof tests rarely detect every possible dangerous failure. The proof test coverage fraction must be documented and applied correctly.
  • Misapplying the architecture constraint: IEC 61511 Table 6 defines minimum HFT requirements based on SFF. A component with SFF below 60% requires HFT of 2 (at least 1oo3 voting) for SIL 2, regardless of the PFDavg calculation result.

Tools for SIL Verification

Spreadsheet calculations are acceptable for simple 1oo1 and 1oo2 architectures but become error-prone for complex voting or mixed architectures. Dedicated SIL calculation tools such as EXIDA SILver, HIMA SILworX, and Kenexis SACA automate the architecture modelling and flag constraint violations automatically. For any SIF above SIL 1 in a covered process, a dedicated tool is strongly recommended.

SIL Verification Tools Worth Knowing

Spreadsheet-based verification is acceptable for simple 1oo1 architectures, but for complex voting or mixed architectures it becomes error-prone. Dedicated tools:

  • EXIDA SILver: The most widely used dedicated SIL verification tool. Supports all IEC 61511 architectures, common cause failure modelling, and produces audit-ready reports. Includes a device failure rate database with certified data.
  • Kenexis SACA: Web-based tool with integrated LOPA module. Good for organisations wanting LOPA and SIL verification in one platform.
  • Spreadsheets: Appropriate for simple SIL 1 SIFs with straightforward 1oo1 architectures, where calculation complexity does not justify a tool licence. Must follow IEC 61511 equations rigorously and be independently reviewed.

Regardless of tool, the verification output must document: assumed proof test interval, beta factor for common cause, failure rate source for each device, and the resulting PFDavg. This supports both initial compliance demonstration and future modifications.