SIL VERIFICATION CHEAT SHEET
| SIL Level | PFDavg Range (Demand Mode) | RRF Range | Risk Reduction | Typical O&G Application |
|---|---|---|---|---|
| SIL 1 | ≥ 10⁻² to < 10⁻¹ | 10 – 100 | 1 order of magnitude | General process shutdown, low-risk utilities trips |
| SIL 2 | ≥ 10⁻³ to < 10⁻² | 100 – 1,000 | 2 orders of magnitude | ESD, BMS, compressor protection, HIPPS (lower tier) |
| SIL 3 | ≥ 10⁻⁴ to < 10⁻³ | 1,000 – 10,000 | 3 orders of magnitude | HIPPS, well head control, fire & gas critical SIFs |
| SIL 4 | ≥ 10⁻⁵ to < 10⁻⁴ | 10,000 – 100,000 | 4 orders of magnitude | Nuclear / rarely justified in Oil & Gas |
PFDavg represents the average probability over the entire proof test interval. It is NOT the instantaneous probability at any single moment. Just before the proof test is due, actual PFD is at its highest.
SIL verification must cover the full loop: sensor(s) + logic solver + final element(s). A SIL-certified transmitter alone does NOT give you a SIL-rated SIF. Every element contributes to the overall PFDavg.
VOTING ARCHITECTURES — BLOCK DIAGRAMS & FORMULAS
S1
&
VOTE →
VOTE →
PROOF TESTING · DIAGNOSTICS · COMMON CAUSE FAILURE
| Device / Feature | Diagnostic Type | Typical DC | DC Level | PFDavg Impact |
|---|---|---|---|---|
| Simple 4-20mA transmitter (no HART) | None (manual proof test only) | < 60% | Low | Full TI contribution to PFDavg |
| HART transmitter with EDDL diagnostics | Online: sensor health, loop check | 60–90% | Medium | Reduces residual PFDavg by detected failures |
| Smart transmitter + online proof test | Full end-to-end functional test | > 90% | High | Major PFDavg reduction. Supports longer TI. |
| Partial Stroke Test (PST) — ESD Valve | Automated valve movement test | 60–80% | Medium | Significant reduction in final element PFDavg |
| Full Stroke Test (FST) — ESD Valve | Full travel proof test | ≈ 99% | High DC | Near-complete dangerous failure detection |
| Logic Solver (SIL-certified, TMR) | Internal self-diagnostics, watchdog | > 99% | Very High | Logic solver PFDavg typically very small vs. field devices |
Two identical transmitters from the same vendor on the same impulse line share ALL the same failure modes. A plugged impulse line takes both out simultaneously. That is 100% CCF. Apply IEC 61508 Table D.4 separation guidelines.
Physical separation · Different impulse tapping points · Diversity in technology (DP + radar for level) · Independent cable routing · Independent power supplies · Different vendor devices where justified by risk.
BYPASS / OVERRIDE · WORKED EXAMPLE · COMMON MISTAKES
⚠ The SIF is effectively disabled — PFDavg becomes 1.0 (100% failure probability)
⚠ Any process demand during bypass period is unprotected
⚠ If bypass duration is significant vs. TI, your SIL number is degraded
⚠ Multiple concurrent bypasses = compounding integrity loss
✗ Bypass without MOC/MOPC = non-compliance with IEC 61511 Cl. 11.9
✓ Require written MOPC (Management of Process Change / Override) for every bypass
✓ Define maximum allowed bypass time in the SRS (Safety Requirements Specification)
✓ Compensating measures required: increased operator rounds, independent monitoring
✓ DCS/SIS should log bypass start/end time with operator ID for audit trail
✓ IEC 61511 requires bypass management procedure in your SMS (Safety Management System)
PFDavg_total = PFDavg_normal × (TI − t_bypass)/TI + 1.0 × t_bypass/TI
Where t_bypass = total bypass hours per interval. Even 24 hrs bypass per year on a 1-year TI SIF adds ~2.7% to PFDavg on top of baseline. For SIL 2 border cases, this can push you out of SIL 2 band.
= 3×(0.0044)² + 0.05×0.0044
= 5.8×10⁻⁵ + 2.2×10⁻⁴ = 2.8×10⁻⁴
→ SIL 2 ✓ (10⁻³ to 10⁻²)
RRF ≈ 295
The ESD valve (final element) contributes ~88% of the total PFDavg. This is common. Investing in PST + FST on the valve is far more effective than adding a third sensor. Do NOT over-engineer the sensor side and ignore the valve.
FIELD ENGINEERING NOTES — FAT · SAT · MAINTENANCE
‣ Proof test simulation in FAT must replicate the actual field proof test procedure — NOT just inject a signal at the marshalling cabinet
‣ Test each voting logic permutation. For 2oo3: test 1-trip, 2-trip, 3-trip and verify correct response at each
‣ Verify bypass function: engage bypass, confirm SIS does NOT trip on live signal, confirm bypass alarm activates in DCS
‣ Record all logic solver diagnostic alarms and verify correct annunciation in HMI
‣ Document proof test coverage achieved per device — this becomes your field baseline
‣ Test SIL-required response time: confirm the SIF trips within the required process safety time (PST)
‣ SAT is NOT a repeat of FAT. SAT verifies the installed loop in real field conditions — actual process connections, real cables, real earthing
‣ Loop test must be end-to-end: apply stimulus at the sensor, confirm trip at the final element
‣ Verify impulse lines: no plugging, correct slope, no dead legs, correct manifold configuration (5-valve vs. 3-valve)
‣ Confirm ESD valve stroking: record open/close time, check actuator spring return, verify fail-safe position
‣ Check all SIS panel earthing, cable shields, and cable segregation from HV/power cables
‣ Pre-startup SIS punch list must be cleared before mechanical completion sign-off
‣ Never miss a proof test deadline. Overdue tests invalidate the SIL claim — escalate to FSM if test cannot be performed on time
‣ Use the approved Proof Test Procedure (PTP) every time. Do not improvise or shortcut — PTC claim depends on it
‣ Document every proof test: start time, end time, as-found condition, as-left condition, technician ID, any deviations
‣ As-found failures must be reported to the Functional Safety Manager (FSM) and trigger a revalidation review
‣ PST frequency on ESD valves must match what was assumed in the SIL calculation — verify during management review
‣ Trend your as-found failure rates. If actual λD exceeds assumed λD, your SIL claim is degraded — revalidate
‣ SRS (Safety Requirements Specification) missing or incomplete — IEC 61511 Cl.10 mandates it before design starts
‣ SIL allocation from LOPA not reviewed against hardware architecture — mismatch causes late redesign
‣ No defined proof test procedure at design stage — PTC assumptions in SIL calc cannot be verified later
‣ ESD valve SIL certificate does not cover the actual trim, body, and actuator combination in the datasheet
‣ Logic solver SIL certificate scope does not match installed configuration (e.g. different I/O modules than certified)
‣ Functional Safety Assessment (FSA) not scheduled — IEC 61511 Cl.5.2 requires FSA before startup
| Standard | Scope | Key Clauses for SIL Verification | Who Applies It |
|---|---|---|---|
| IEC 61511 (Ed.2) | SIS for Process Industry | Cl.10 SRS · Cl.11 SIS Design · Cl.12 Integration · Cl.16 Proof Test | Process plant engineers, FSM, EPC contractor |
| IEC 61508 (Ed.2) | Functional safety of E/E/PE systems | Part 2: Hardware · Part 3: Software · Part 6: Annex B (PFD formulas) | SIS vendors, system integrators, device manufacturers |
| IEC 61511-3 | Guidance for LOPA & SIL determination | LOPA methodology · Risk graph · SIL allocation | Process safety engineers, HAZOP/LOPA team |
| ISA-84.00.01 | US equivalent of IEC 61511 | Aligns with IEC 61511 — additional US-specific guidance | US-based projects (refining, chemicals) |
SIL integrity must be maintained from HAZOP through decommissioning. A properly designed SIF that is poorly maintained, bypassed without control, or never proof-tested to plan is NOT a SIL-rated SIF — regardless of what the design report says. The Functional Safety Manager (FSM) owns this lifecycle.