From hazard to verified safety instrumented function
SIL determination, SIL verification and the documents that carry them through the IEC 61511 lifecycle. Each package states what you get, what I need from you and what it costs.
Service packages
-
SIL Determination & LOPA
Target SIL for each safety instrumented function, set with a calibrated risk matrix, a risk graph or layer of protection analysis. Independent protection layers are tested against their criteria, not assumed.
Deliverables
- SIL determination report
- LOPA worksheets per scenario
- Independent protection layer register
- Assumptions and open-items log
from $3,900Two remote sessions, up to 15 scenarios, report included
See an example deliverable
Item Value Basis Initiating event: level control fails, inlet valve stays open 0.1 per year BPCS loop failure frequency from your site data Enabling condition: tank receiving product 0.5 Fraction of the year, from operating records IPL 1: high level alarm and operator response PFD 0.1 Alarm independent of the failed loop; 20 min response < 45 min available Dike around the tank Not credited Limits the spill but does not prevent the fire consequence Mitigated event frequency 5 × 10⁻³ per year 0.1 × 0.5 × 0.1 Tolerable frequency 1 × 10⁻⁵ per year Your company risk criteria Required risk reduction from the SIF RRF 500 → SIL 2 Required PFDavg 2 × 10⁻³ Illustrative excerpt written for this site; tags and values are invented, not client data. -
SIL Verification Study
Each function checked against its target on all three requirements: average probability of failure on demand (or PFH), hardware fault tolerance, and systematic capability. Spurious trip rate is reported alongside.
Deliverables
- Verification report per function
- Calculation files you can re-run
- Proof test interval and coverage recommendations
- Register of failure-rate sources
from $260 per functionComplex functions $420. Minimum five functions.
See an example deliverable
Subsystem Architecture PFDavg Share HFT achieved / required Pressure transmitters 2oo3 3.1 × 10⁻⁵ 3 % 1 / 0 Safety PLC 1oo1, internal 1oo2D 9.0 × 10⁻⁶ 1 % 1 / 0 Shutdown valve with solenoid 1oo1 1.16 × 10⁻³ 96 % 0 / 0 Function Series 1.2 × 10⁻³ SIL 2 band Systematic capability SC 3 ≥ 2 Verdict SIL 2 achieved Meets 2 × 10⁻³ Spurious trip MTTFS 9.4 years Recommendation Valve dominates Partial stroke test every 3 months Recalculate after test procedure is agreed Illustrative excerpt written for this site; tags and values are invented, not client data. -
Safety Requirements Specification
An SRS for each function: trip setpoints, response time against process safety time, voting, bypass and reset requirements, proof test requirements and spurious trip limits.
Deliverables
- SRS document, structured to IEC 61511
- Traceability from hazard to function
- List of open data and decisions
from $180 per functionMinimum $1,500
See an example deliverable
Requirement Specification Hazard and source Separator overpressure; HAZOP node 3 "more pressure"; LOPA scenario S-03 Sensors and voting PT-12A/B/C, 2oo3; trip at 18.0 barg (design pressure 20 barg) Final elements XV-12 closes; feed pump P-12 stops Safe state Inlet isolated; held until manual reset Response time ≤ 10 s from sensor to valve closed; process safety time 30 s Bypass Maintenance override per channel, 8 h limit, alarm in the control room Reset Manual, local, after the cause is cleared Proof test Every 12 months; coverage ≥ 90 % including valve stroke and seat leakage Spurious trips Mean time to spurious trip ≥ 5 years Illustrative excerpt written for this site; tags and values are invented, not client data. -
Proof Test Planning
Proof test intervals that match the verification, coverage you can defend, and step-by-step procedures a technician can follow and sign.
Deliverables
- Proof test procedures with record sheets
- Interval justification
- Test coverage register
from $220 per procedureOne procedure per device type and function
See an example deliverable
Step Action Acceptance 1 Permit, bypass PT-12A only; inform the control room Bypass alarm shown; other channels in service 2 Apply pressure to PT-12A with a calibrated test pump Trip at 18.0 ± 0.2 barg; as-found recorded 3 Repeat for PT-12B and PT-12C One channel in trip gives alarm only; two give trip (2oo3) 4 Full stroke XV-12 closed from the SIS Closed in ≤ 8 s; limit switch confirmed in SIS and DCS 5 Seat leakage test across XV-12 Within the leakage class in the SRS 6 Remove bypasses, record as-left state No active bypass; record signed by tester and supervisor Illustrative excerpt written for this site; tags and values are invented, not client data. -
HAZOP Facilitation & Reporting
Remote HAZOP sessions with node definition, deviation analysis and a recommendations register that feeds SIL determination.
Deliverables
- HAZOP worksheets
- HAZOP report
- Action register with owners
from $2,900First day including preparation and report; $1,600 per additional day
See an example deliverable
Deviation Cause Consequence Safeguards Action More pressure Gas outlet valve closed in error Overpressure, loss of containment PIC-11, high pressure alarm, PSV-13 A-07: candidate SIF, take to LOPA Less level LCV-14 fails open Gas blow-by to the downstream tank Low level alarm A-08: check tank vent capacity for blow-by Reverse flow Pump P-12 stops with discharge open Backflow into the feed line Check valve A-09: confirm check valve is on the test plan Illustrative excerpt written for this site; tags and values are invented, not client data. -
Cause & Effect Matrix
A cause and effect matrix built from P&IDs and the shutdown philosophy, with each safety function separated out and traceable to its hazard.
Deliverables
- Cause & effect matrix (Excel)
- Safety instrumented function list
from $180 per functionMinimum $1,200; from the P&IDs and shutdown philosophy
See an example deliverable
Cause XV-12 close P-12 stop XV-15 close Alarm PT-12A/B/C high-high (2oo3), SIF-12 X X X LT-14 low-low (1oo2), SIF-14 X X X Confirmed fire in area 100 (2ooN) X X X X ESD push button, control room X X X X Illustrative excerpt written for this site; tags and values are invented, not client data.
Prices in US dollars, excluding any taxes that apply to your organisation.
Sample work package: SIL verification of ten functions
Three weeks from complete inputs to final report, with one review round.
Week 0: inputs
You send the function list, P&IDs, cause & effect, target SILs and device data sheets or certificates.
Week 1: gap list
Missing data and questionable assumptions come back as a short list, so nothing is guessed.
Week 2: draft
Draft report and calculation files. Your reviewer comments once, in one consolidated list.
Week 3: final
Final report, calculation files and the source register, issued under revision control.
Standards and methods
Work follows IEC 61511 for the process sector and IEC 61508 where device-level requirements apply. Probability calculations use the simplified equations of IEC 61508-6 and ISA-TR84.00.02, with imperfect proof testing, mission time, repair time and common cause failures modelled explicitly. LOPA follows the established CCPS approach.
Failure rates come from the device's own certificate or FMEDA, or from data you provide. Licensed reliability databases are used only under your own licence.
Qualification
TÜV Rheinland Functional Safety Engineer (SIS), with more than twelve years leading instrumentation and control at a world-scale petrochemical plant.
Questions
Who is responsible for the final functional safety decision?
You are, as owner or designer. Reports are prepared and signed as engineering work by a TÜV Rheinland Functional Safety Engineer. Independent functional safety assessment, where IEC 61511 requires it, stays with your assessment team.
What happens if our data is incomplete?
You get a gap list in the first week. Each missing value either gets an answer from you or a stated, conservative assumption that you approve before it is used.
Can you work with our existing calculation tool or template?
Yes. Results can be delivered in your template or tool format alongside the standard report.
Do you sign an NDA?
Yes, before any documents are shared.
Is everything remote?
Yes. Calculations, specifications and procedures are delivered online, and HAZOP and LOPA workshops run over video.