Critical instrumental systems prevent hazardous events of situations in which people could be injured (or worse) and/or the environment could be polluted.

The standards, IEC 61511:2017 and IEC 61508:2010, define the criteria for Safety Instrumented Functions (abbr. SIFs).

A SIF shall be fit for purpose preventing the identified hazard.

The integrity level of a SIF, defined as SIL 1, 2, 3 or 4, provide risk reduction.

A SIF may be compromised by systematic failures and/or random hardware failures.

Systematic failures shall be prevented by:

- An adequate functional safety management system
- Competent personnel

Fabricated instruments/components shall meet the systematic capability requirements (e.g. SC-3).

The technical integrity of a SIF is depending of:

- Independency of the SIF
- Architectural constraints of the sensor subsystem, the logic solver and the final elements
- Probabilistic constraints of the SIF (average probability of failure on demand, PFD
_{avg}).

During a SIL verification the integrity of the SIL safeguard is checked against the required integrity.

In the process industry sector, the demand rate is often less frequent than once per year. The following PFD_{avg} values are required:

SIL 1 PFD_{avg} < 10^{-1}

SIL 2 PFD_{avg} < 10^{-2}

SIL 3 PFD_{avg} < 10^{-3}

SIL 4 PFD_{avg} < 10^{-4}

IEC 61511 provides the following information:

*Several modelling approaches are available and the most appropriate approach is a matter for the analyst and can depend on the circumstances. Available means include:*

*– cause consequence analysis;*

*– reliability block diagrams;*

*– fault-tree analysis;*

*– Markov models;*

*– Petri nets models.*

PFD_{avg} is depending on:

- Dangerous Detected and Undetected failure rates of the instruments and components, λ
_{DD}and_{ }λ_{DU} - Redundancy configuration
- Common cause β-factor in case of redundancy configuration
- Proof test interval
- Proof test coverage
- Lifetime of the SIF
- Mean Time to Restoration
- Time needed for tests

But how relevant are all these variables and how sophisticated should be the modelling approach?

With powerful, sophisticated PFD calculation software, the PFD_{avg} can be calculated very precise. However, the outcome stays uncertain while the following factors are just raw estimates:

- Common cause ß factor
- Proof test coverage and lifetime

A frequently used basis to determine ß factors is the informative Annex D of IEC 61508:6. By filling in scores, a ß factor will be determined. ß= 5% is almost standard. According to a thoroughly performed study of SINTEF, the actual common cause factor is in between 10 – 15 % (reference can be made to ‘Common cause failures in safety instrumented systems’, final version, 20 May 2015).

It is the opinion of Consiltant BV that for SIL 1 and SIL 2 SIF’s it does not make sense to use complex sophisticated software to calculate precisely the PFD_{avg} if other relevant factors are just estimates.

A minimal common cause Beta factor of 10% is to be recommended.

The correct performance of proof tests is critical! Poor proof tests are never acceptable although it can be modelled in de PFD_{avg} calculation (e.g. a proof test coverage factor of 75%). A low proof test coverage may never be compensated by more frequent poor proof tests in order to meet the PFD_{avg} target.

It is the opinion of Consiltant BV that a proof test procedure shall always be complete and detailed. Personnel shall be competent in order to detect and restore dangerous undetected failures and systematic failures.

Consiltant BV developed PFD Consiltator, an Excel based tool in order to calculate the PFD_{avg}.

PFD Consiltator can be downloaded here.

PFD Consiltator consists of a simple and more advanced calculation methode. The simple calculation is based on the following formulas:

Proof test coverage is not taken into account. The test procedure is assumed to be 100% correct.

In the advanced version, the proof test coverage is included in the calculation. The expected lifespan / mission time of the selected components must also be included in the analysis. The calculation is based on the methods described in IEC-61508-6 and VDI/VDE 2180 (part 3).