Ask for a SIL verification and you will usually get a number: the average probability of failure on demand, PFDavg, with a note that it falls inside the SIL 2 band. The number matters. It is also one third of the answer.
IEC 61511 asks three separate questions of every safety instrumented function. A function meets its target SIL only when all three answers are yes.
The three questions
- Is the probability of failure low enough? PFDavg for low-demand functions, or PFH for high-demand and continuous ones, must fall inside the band for the target SIL.
- Is there enough fault tolerance? Each subsystem needs the minimum hardware fault tolerance for the target SIL, so that a single fault cannot defeat the function where the standard does not allow it.
- Is every element suitable for the SIL? Each device needs the systematic capability for the target, through certification to IEC 61508 or through documented prior use.
The first question is about random hardware failures. The second is about architecture. The third is about design and manufacturing errors that no amount of redundancy of the same device will remove. They are independent, which is why a good result on one tells you nothing about the others.
A worked example
Take a low-demand high-pressure trip with a SIL 2 target: one pressure transmitter, a safety logic solver, and one shutdown valve with its solenoid. Proof test interval one year (8,760 hours), perfect proof testing for now. The figures are illustrative.
| Subsystem | λDU (per hour) | PFDavg ≈ λDU·T/2 |
|---|---|---|
| Transmitter, 1oo1 | 3.0 × 10⁻⁷ | 1.3 × 10⁻³ |
| Logic solver | from certificate | 1.0 × 10⁻⁴ |
| Valve and solenoid, 1oo1 | 1.5 × 10⁻⁶ | 6.6 × 10⁻³ |
| Function | 8.0 × 10⁻³ |
8.0 × 10⁻³ sits inside the SIL 2 band, between 10⁻³ and 10⁻². On the first question, the function passes.
Now the second question. With single devices everywhere, each subsystem has a hardware fault tolerance of zero. For a low-demand SIL 2 function, IEC 61511 accepts that, so the function passes again. Raise the target to SIL 3 and it fails, however good the PFDavg becomes, because SIL 3 needs a tolerance of one fault.
Then the third question. Suppose the solenoid valve's certificate states a systematic capability of SC 1. It does not matter that its failure rate is low or that the total PFDavg is comfortable. An SC 1 element cannot be used on its own in a SIL 2 function. The function fails, and the fix is a different solenoid or a justified prior-use argument, not a shorter test interval.
Where calculations usually go wrong
- Only the PFDavg is reported. The report gives a probability and a band, with no statement on fault tolerance or systematic capability.
- The fault tolerance is read from the drawing, not from the voting. Two transmitters wired so that both must trip are 2oo2, which tolerates no fault, even though there are two of them.
- The systematic capability of the weakest element is missed. Interposing relays and solenoids are the usual candidates.
- The proof test in the calculation is not the proof test in the procedure. That is a large enough topic for its own article.
What a verification report should show
For each function: the PFDavg or PFH with its inputs and their sources, the hardware fault tolerance per subsystem and the route used to judge it, the systematic capability of every element and how it was established, and the spurious trip rate so availability is visible too. Three results, stated separately, with a single conclusion only at the end.
Anything less leaves a reviewer to assume the other two answers, and assumptions are what verification is supposed to remove.