SafeGuard PSMPSM Consulting
OSHA 1910.119Free PSM Resource
Calculate PFDavg for your Safety Instrumented System and verify whether it meets the required Safety Integrity Level per IEC 61511. Supports 1oo1, 1oo2, 2oo2 and 2oo3 architectures with common cause and diagnostic coverage.
| Architecture | PFDavg | SIL Achieved | Status vs. SIL 2 |
|---|
Order-of-magnitude placeholders for early screening only. Use the manufacturer FMEDA/SIL certificate or a documented database (exida, OREDA, SINTEF PDS) for the specific device.
| Component | λD (/hr) |
|---|---|
| Pressure transmitter | 1×10⁻⁶ |
| Temperature transmitter | 5×10⁻⁷ |
| Level transmitter | 2×10⁻⁶ |
| Flow transmitter | 1×10⁻⁶ |
| Pressure switch | 3×10⁻⁶ |
| Solenoid valve | 5×10⁻⁷ |
| Control valve (SIL-rated) | 2×10⁻⁶ |
| Logic solver / PLC (SIL-rated) | 1×10⁻⁷ |
| Relay (safety rated) | 1×10⁻⁷ |
| Architecture | Simplified PFDavg Formula |
|---|---|
| 1oo1 | λDU × TI/2 |
| 1oo2 | [(1−β)·λDU·TI]²/3 + β·λDU·TI/2 |
| 2oo2 | λDU × TI |
| 2oo3 | [(1−β)·λDU·TI]² + β·λDU·TI/2 |
SIL verification answers one question: will this safety instrumented function (SIF), as designed, actually deliver the risk reduction it was assigned? It comes after SIL determination. A LOPA or risk graph says a function needs SIL 2. Verification proves the hardware, architecture, and test plan get you there.
Under IEC 61511 (ISA 84 in the U.S.), a SIF must pass three separate checks. Passing the math alone is not enough.
| SIL | PFDavg range | Risk reduction factor (RRF) |
|---|---|---|
| SIL 1 | ≥ 10⁻² to < 10⁻¹ | > 10 to ≤ 100 |
| SIL 2 | ≥ 10⁻³ to < 10⁻² | > 100 to ≤ 1,000 |
| SIL 3 | ≥ 10⁻⁴ to < 10⁻³ | > 1,000 to ≤ 10,000 |
| SIL 4 | ≥ 10⁻⁵ to < 10⁻⁴ | > 10,000 to ≤ 100,000 |
RRF is simply 1 ÷ PFDavg. Most process-industry SIFs are SIL 1 or SIL 2. SIL 3 is uncommon and expensive, and SIL 4 is essentially never used in process plants. If your LOPA lands on SIL 3 or higher, it's usually worth revisiting the scenario or adding independent protection layers first.
A SIF is a chain of three subsystems: sensors, a logic solver, and final elements (valve, actuator, solenoid). The PFDavg of the function is the sum of the three subsystems, because any one failing defeats the function.
For each subsystem, the simplified formulas from IEC 61508-6 Annex B are:
| Architecture | Meaning | Simplified PFDavg |
|---|---|---|
| 1oo1 | Single device, no redundancy | λDU × TI / 2 |
| 1oo2 | Two devices, either can trip | [(1−β) × λDU × TI]² / 3 + β × λDU × TI / 2 |
| 2oo2 | Two devices, both must trip | λDU × TI |
| 2oo3 | Three devices, any two trip | [(1−β) × λDU × TI]² + β × λDU × TI / 2 |
LOPA assigns SIL 2 (RRF > 100) to a high-pressure trip that closes the reactor feed valve. The first design is one pressure transmitter, a SIL 3-certified safety PLC, and one shutdown valve assembly. Everything is proof tested annually (TI = 1 year).
| Subsystem | Data | Calculation | PFD |
|---|---|---|---|
| Sensor (1oo1 transmitter) | λDU = 3.0×10⁻⁷/hr = 2.63×10⁻³/yr | 2.63×10⁻³ × 1 / 2 | 1.31×10⁻³ |
| Logic solver (SIL 3 PLC) | From manufacturer certificate | — | 1.0×10⁻⁴ |
| Final element (1oo1 valve + actuator + solenoid) | λDU = 2.0×10⁻⁶/hr = 1.75×10⁻²/yr | 1.75×10⁻² × 1 / 2 | 8.76×10⁻³ |
| SIF total | 1.02×10⁻² → RRF ≈ 98 |
Result: SIL 1. Fails the SIL 2 target. Notice where the risk sits: the final element is 86% of the total PFD. That's typical. Valves are almost always the weak link, which is why redundancy or testing on the valve side gives the biggest return.
New SIF total: 2.37×10⁻³ → RRF ≈ 420. Passes SIL 2 with margin. Note that 90% of the redundant valve's PFD comes from the common cause term.
Halving TI halves every 1oo1 term. The sensor drops to 6.57×10⁻⁴ and the valve to 4.38×10⁻³, for a total of 5.14×10⁻³ → RRF ≈ 195. Passes SIL 2, but you've signed up for twice the testing and twice the bypass time, and the plant has to be able to test the valve online. On paper it's cheaper. In operation it often isn't.
The formulas above assume each proof test finds 100% of dangerous failures. Real tests don't. A valve stroke test may not catch seat leakage, for example. With proof test coverage (PTC) below 100%, the untested failures accumulate over the whole mission time (MT) of the device:
Take the original single valve with an 80% effective proof test and a 10-year mission time: valve PFD becomes 2.45×10⁻², nearly three times worse, and the whole SIF is no longer SIL 2-capable even with annual testing. This is the most common reason "verified" SIFs fail an audit. Write proof test procedures that are designed to find each failure mode, and use their realistic coverage in the calculation.
Even if the math passes, IEC 61511-1 (2016 edition, clause 11.4) sets a minimum hardware fault tolerance (HFT), the number of device failures the subsystem can tolerate and still perform its function:
| SIL | Minimum HFT | Practical meaning |
|---|---|---|
| SIL 1 | 0 | 1oo1 acceptable |
| SIL 2 (low demand) | 0 | 1oo1 acceptable |
| SIL 2 (high/continuous demand) | 1 | Redundancy required |
| SIL 3 | 1 | Redundancy required (1oo2, 2oo3) |
| SIL 4 | 2 | Triple redundancy |
The standard allows some adjustments, for example based on prior use evidence or safe failure fraction for devices assessed to IEC 61508. Treat this table as the starting point and confirm against the edition of the standard your project is contracted to.
Whatever you use, document the source for every number. An auditor's first question is "where did this λDU come from?"
For a single device (1oo1), PFDavg ≈ λDU × TI / 2, where λDU is the dangerous undetected failure rate per year and TI is the proof test interval in years. For the complete SIF, add the PFDavg of the sensor, logic solver, and final element subsystems.
Multiply by 8,760 (hours in a year). For example, 2.0×10⁻⁶/hr × 8,760 = 1.75×10⁻²/yr.
PFD is the probability the function fails on demand at a given moment. It rises between proof tests and resets after each one. PFDavg is its average over the test interval, which is the number compared against SIL bands. RRF (risk reduction factor) = 1 / PFDavg.
SIL determination (or assignment) decides how much risk reduction a function needs, usually through LOPA or a risk graph. SIL verification proves the designed function achieves it. Try our free LOPA calculator for the determination step.
For straightforward 1oo1 and 1oo2 designs with realistic data, simplified IEC 61508-6 equations are widely used. Complex architectures, partial stroke testing credit, staggered testing, or high-demand functions generally need Markov models or fault tree analysis.
This guide is a technical overview for engineers and project teams. It is not a substitute for a SIL verification performed by a qualified functional safety engineer against the edition of IEC 61511 / ISA 84 applicable to your project.