| name | safety-integrity-level |
| description | Safety Integrity Level (SIL) determination and verification — IEC 61508/61511, LOPA (Layer of Protection Analysis), PFD/PFH calculation, hardware fault tolerance (HFT), safe failure fraction (SFF), diagnostic coverage (DC), proof test intervals, SIL 1–4 requirements, SIS lifecycle, and functional safety management. |
| metadata | {"priority":7,"promptSignals":{"phrases":["safety integrity level","SIL determination","IEC 61511","LOPA analysis","functional safety","safety instrumented system"],"minScore":3}} |
Safety Integrity Level (SIL) — Complete Skill
SIL Framework (IEC 61508 / IEC 61511)
SIL Definitions
IEC 61508: Functional Safety of Electrical/Electronic/Programmable Electronic Safety-related Systems
IEC 61511: Functional Safety for the Process Industry (derived from IEC 61508)
SIL levels — Probability of Failure on Demand (PFD) for Low Demand Mode:
| SIL | PFDavg (per demand) | Risk Reduction Factor (RRF) | Application |
|---|
| SIL 1 | 10⁻² to 10⁻¹ | 10–100 | Single loop; simple protection |
| SIL 2 | 10⁻³ to 10⁻² | 100–1,000 | Redundant systems; high hazard |
| SIL 3 | 10⁻⁴ to 10⁻³ | 1,000–10,000 | Diverse redundancy; critical plant |
| SIL 4 | 10⁻⁵ to 10⁻⁴ | 10,000–100,000 | Rarely used in process; nuclear |
High Demand / Continuous Mode:
PFH (Probability of Failure per Hour) — for systems demanded > 1/year:
SIL 1: 10⁻⁵ to 10⁻⁶/hr; SIL 2: 10⁻⁶ to 10⁻⁷/hr; SIL 3: 10⁻⁷ to 10⁻⁸/hr
SIL Determination Methods
Layer of Protection Analysis (LOPA)
LOPA concept:
Risk = Frequency × Consequence
Required SIF PFD = Tolerable frequency / (Initiating cause frequency × Independent Protection Layers)
LOPA procedure:
- Identify initiating cause (IC): frequency f_IC [events/yr]
- Identify consequence category (severity)
- Define tolerable frequency f_TOL [events/yr] — from risk matrix or QRA
- Credit independent protection layers (IPLs): each IPL has PFD_IPL (0.01–0.1 typical)
- Required SIF PFD = f_TOL / (f_IC × Π PFD_IPL_not_SIF)
Example:
f_IC = 0.1/yr (pump seal failure); f_TOL = 10⁻⁴/yr; IPLs: BPCS relief = 0.1; dike = 0.1
Required SIF PFD = 10⁻⁴ / (0.1 × 0.1 × 0.1) = 10⁻⁴ / 0.001 = 0.1 → SIL 1
Common initiating cause frequencies:
Instrument failure (control loop): 0.1–1/yr
Heat exchanger tube rupture: 0.01–0.1/yr
Gasket/flange failure: 0.001–0.01/yr
Pump seal failure: 0.01–0.1/yr
IPL credits (typical PFD values):
BPCS (Basic Process Control System): 0.1 (can claim only if independent of SIS)
Pressure relief valve: 0.01–0.1 (depending on service; creditable if independent)
Operator response (if >10 min): 0.1; (if 10–40 min): 0.1–0.3; (if <10 min): not creditable
Dike/bund: 0.01–0.1 (passive; not creditable if shared)
Deluge system: 0.01–0.1
Risk Matrix Method (Qualitative)
Alternative to LOPA for initial screening:
Consequence (Catastrophic → No Effect) × Likelihood (Frequent → Remote) → SIL required
Typically: 4×4 or 5×5 matrix; output = SIL target (no SIS needed / SIL 1 / SIL 2 / SIL 3)
Used when detailed LOPA data unavailable; conservative; may over-specify
PFD Calculation — SIS Hardware
Simplified PFD Formulas (Low Demand Mode)
1oo1 (1 out of 1 — single device):
PFD_avg = λ_D × τ / 2 [λ_D = dangerous failure rate [/hr]; τ = proof test interval [hr]]
(or with repair: PFD ≈ λ_D × MTTR/2 if repair is fast)
1oo2 (1 out of 2 — voted 1oo2 — redundant, more safe):
PFD_avg ≈ (λ_D × τ)²/3 + β_D × λ_D × τ/2
[β_D = common cause failure fraction (CCF); β = 0.02–0.10 typical]
2oo2 (2 out of 2 — both must actuate — less safe, more available):
PFD_avg ≈ λ_D × τ [only one needs to fail to lose function; worse than 1oo1]
2oo3 (2 out of 3 — voted — high availability and high safety):
PFD_avg ≈ (λ_D × τ)²/3 + β_D × λ_D × τ/2 (same form as 1oo2 but different λ)
Availability: better than 1oo2; Safety: same order as 1oo2
Example (SIL 2 sensor):
λ_D = 5×10⁻⁶/hr; τ = 8,760 hr (1 yr); β = 0.05
1oo1: PFD = 5×10⁻⁶ × 8,760 / 2 = 0.0219 (SIL 1 only)
1oo2: PFD = (5×10⁻⁶ × 8,760)² / 3 + 0.05 × 5×10⁻⁶ × 8,760/2 = 3.2×10⁻⁴ + 1.1×10⁻³ = 1.4×10⁻³ (SIL 2 if β low)
→ With 6-month proof test (τ = 4,380 hr): PFD_1oo2 ≈ 0.05×5×10⁻⁶×4,380/2 = 5.5×10⁻⁴ (SIL 2 margin)
Subsystem PFD Combination
SIS = Sensor + Logic Solver + Final Element:
PFD_SIS = PFD_sensor + PFD_logic + PFD_FE
[sum approximation valid when each PFD << 1]
Each subsystem modeled independently; proof test intervals can differ:
Sensor τ = 12 months; Logic solver τ = 48 months (lower failure rate); Valve τ = 12 months (partial stroke test)
Hardware Architectural Constraints
Safe Failure Fraction (SFF)
SFF = (λ_S + λ_DD) / (λ_S + λ_D)
[λ_S = safe failure rate; λ_DD = dangerous detected failure rate; λ_D = all dangerous]
λ_DD = DC × λ_D [DC = diagnostic coverage; DC ≥ 60% for SIL 2 sensors]
SFF = (λ_S + DC × λ_D) / (λ_S + λ_D)
Minimum SFF vs. SIL (IEC 61508 Table 2 — Type A subsystem):
| Hardware Fault Tolerance (HFT) | SFF < 60% | 60–90% | 90–99% | ≥ 99% |
|---|
| HFT = 0 | Not allowed | SIL 1 | SIL 2 | SIL 3 |
| HFT = 1 | SIL 1 | SIL 2 | SIL 3 | SIL 4 |
| HFT = 2 | SIL 2 | SIL 3 | SIL 4 | SIL 4 |
Type B (complex: microprocessor-based): more restrictive — HFT = 0 max SIL 1 even at SFF ≥ 99%
Hardware Fault Tolerance definition:
HFT = N - 1 where N = minimum number of failures to cause dangerous function loss
1oo1: HFT = 0; 1oo2: HFT = 1; 2oo3: HFT = 1; 1oo3: HFT = 2
Diagnostic Coverage (DC)
DC = λ_DD / λ_D:
Low DC: < 60%; Medium DC: 60–90%; High DC: 90–99%; Very high DC: ≥ 99%
Diagnostic techniques by DC level:
Low (< 60%): manual proof test only
Medium (60–90%): continuous self-diagnostics; plausibility checks; readback
High (90–99%): hardware diagnostics; valve partial stroke testing; sensor crosschecks
Very high (≥ 99%): fully automated; hot standby with continuous comparison
Partial stroke test (PST) for final elements:
DCval_PST = 0.45–0.60 (conservative credit); full stroke test for remaining credit
PST frequency: monthly or quarterly; full proof test: annually
Common Cause Failure (CCF)
β-factor model:
β = fraction of dangerous failures that are common to all redundant channels
β_D = β × proportion that are detected (often β_D = β)
Typical β: 0.02–0.10 depending on physical separation, diverse technology, maintenance practice
Zeta factor (IEC 61508 Part 6 Annex D) — checklist score:
Areas: physical separation, different technology, testing schedule diversity, environment
β = 5% to 10% for similar technology same location; β = 1–2% with diversity and separation
SIS Lifecycle (IEC 61511 Lifecycle)
Phase 1–4: Design:
Hazard and Risk Assessment → SIL determination → SIS conceptual design → detail engineering
Phase 5–8: Installation and Commissioning:
Installation → commissioning → validation (vs. SRS) → pre-startup safety review
Phase 9–16: Operation:
Maintenance (proof tests) → modifications (MOC) → decommissioning
SRS (Safety Requirements Specification):
Must contain: SIL target; safe state; process demand rate; process conditions; response time; proof test interval; diagnostic requirements; environmental conditions
Proof Test Interval Optimization
Optimal interval minimizes spurious trips while meeting PFD:
For 1oo1: PFD_avg = λ_D × τ / 2 ≤ PFD_target → τ ≤ 2 × PFD_target / λ_D
Spurious trip rate: λ_S = safe failure rate → MTTF_spurious = 1/λ_S
Target: λ_S < 1 spurious trip/10 years = 10⁻⁴/hr
Incomplete proof tests:
PFD_residual = PFD × (1 - θ) [θ = fraction detected by proof test; typical 90% for good PT]
Systematic failure not detectable by hardware PT → qualitative assessment
Standards and References
| Standard | Scope |
|---|
| IEC 61508 Parts 1–7 | Functional safety — E/E/PE systems |
| IEC 61511 Parts 1–3 | Functional safety — Process industry |
| IEC 62061 | Functional safety — Machinery sector |
| ISA TR84.00.02 | SIL verification — Simplified equations |
| CCPS "Guidelines for SIL" | Layer of Protection Analysis reference |
| IEC 61508-6 Annex B | PFD calculation equations |
Output
Provide: hazard scenario (initiating cause f_IC [/yr]; consequence severity; tolerable frequency f_TOL [/yr]), LOPA table (f_IC; IPL credits; residual risk; required SIF PFD), SIL target (SIL 1/2/3; PFD range required; RRF), SIS architecture (sensor voting 1oo1/1oo2/2oo3; logic solver; final element voting; HFT per subsystem), PFD calculation (λ_D [/hr] each subsystem; proof test interval τ [hr]; PFDavg per element; total PFD_SIS), SFF and DC verification (SFF [%]; DC level; architectural constraint from IEC 61508 Table 2; HFT adequate?), CCF (β value; physical separation; diversity strategy), proof test interval recommendation [months] (per subsystem; MTTF_spurious [yr]), comparison vs. SIL target (PFD_SIS ≤ PFD_limit: pass/fail with margin), and applicable standard (IEC 61508/61511; ISA 84; LOPA methodology).
