Products
Solutions Services
Functional Safety
SIL (Safety Integrity Level)
Process risk
Probability of unwanted occurrence
W3
Process plant, machine
W2
No safety instrumented system
(e.g. technical measures)
W1
Risks for people, environment and assets
CA
---
---
PA
SIL 1
SIL 1
PB
SIL 2
SIL 1
SIL 1
PA
SIL 2
SIL 2
SIL 1
PB
SIL 3
SIL 2
SIL 2
FA
SIL 3
SIL 3
SIL 2
FB
SIL 4
SIL 3
SIL 3
---
FA
Risk reduction by implementation of SIL
CB
FB
Risk without protective measures
Risk
Frequency and exposure time
FA
Rare to more often
FB
Frequent to permanent
CC
SIL 1
SIL 2
SIL 3
CD
SIL 4
SIL 4
Probability of avoiding the hazard
PA
Possible under certain circumstances
PB
Hardly possible
SIL 3
Consequence
of the damage
Frequency and
exposure time
Protective measures (risk reduction)
Probability of
avoiding the hazard
Probability of unwanted occurrence
W1
Very slight
W2
Slight
W3
Relatively high
Process control safety device
insufficient
Technical requirements
Organizational requirements
SFF HFT SIL type A, type B
Technical requirements
Failure types of safety functions and subsystems
Hardware fault tolerance
(Type B complex
equipment)
1 (0*)
2 (1*)
Failure type
Detected
Undetected
<60 %
SIL 1
SIL 2
SIL 3
SIL 1
SIL 2
Safe
Safe detected SD
Safe undetected SU
Not
permitted
60 % to <90 %
SIL 2
SIL 3
SIL 4
SIL 1
SIL 2
SIL 3
Dangerous
Dangerous detected DD
Dangerous undetected DU
90 % to <99 %
SIL 3
SIL 4
SIL 4
SIL 2
SIL 3
SIL 4
99 %
SIL 3
SIL 4
SIL 4
SIL 3
SIL 4
SIL 4
Safety
Integrity
Level (SIL)
Probability of a dangerous
failure per hour PFH
(High demand or
continuous mode of
operation)
SIL 4
10-5 to <10-4
10-9 to <10-8
SIL 3
10-4 to <10-3
10-8 to <10-7
SIL 2
10-3 to <10-2
10-7 to <10-6
SIL 1
10-2 to <10-1
10-6 to <10-5
* With proven-in-use demonstration acc. to IEC 61511 (for SIL 3 only)
Proof test (test interval Ti)
PFD
0.1
SIL 1
No
pr
oo
ft
es
Average probability of
failure to perform a safety
function on demand
PFD (Average failure
probability of the safety
function with low
demand)
(less then 1/year)
SIL PFDavg PFH modes of operation
0.01
PFDavg
SIL 2
0.001
Concept
Hazard and risk analysis
Safety requirements
Planning, realization
Installation, commissioning
SIL 3
0.0001
SIL 4
Ti e.g. 1 year
Service life
Qualification, training and documentation
Safe failure
fraction (SFF)
Safety lifecycle
Hardware fault tolerance
(Type A simple
equipment)
Verification
FMEDA
Management of functional safety
Determination of safety parameters
Functional safety assessment
Tolerable risk
Consequence of the damage
CA Slight injury to one person or minor harmful
environmental effects, such as those not covered
by the Hazardous Incidence Ordinance.
CB Severe, irreversible injury to one or more persons
or the death of one person or temporary, largescale harmful environmental effects such as those
denoted by the Hazardous Incidence Ordinance.
CC Death of several persons or persistent, large-scale
harmful environmental effects, such as those
denoted by the Hazardous Incidence Ordinance.
CD Catastrophic consequences, death of large
numbers of people.
Operation, maintenance, repair
SIL calculation
SIL 2
actuator
PFD = DU Ti
Decommissioning, disposal
PFH = DU
Terminology
Functional safety:
Part of the overall safety which depends
on the correct functioning of safety-related
systems for risk reduction. Functional safety
is achieved when every safety function is
performed as specified.
Safety-related system:
System that implements the safety functions
required to achieve or maintain a safe state
for equipment under control (EUC).
Foto: BASF
Management of functional safety:
Necessary management and technical
activities and responsibilities during
the safety lifecycle for achievement of
functional safety.
Hardware Fault Tolerance (HFT):
HFT = n means, that n+1 faults could cause
a loss of the safety function.
Safety Integrity Level (SIL):
Four discrete levels (SIL 1 to SIL 4). The
higher the SIL of a safety-related system,
the lower the probability that it will not
perform the required safety functions.
Low demand mode of operation:
Frequency of demands on a safety-related
system no greater than one per year and no
greater than twice the proof-test frequency.
Average Probability of Failure on
Demand (PFDavg):
Average probability of failure of a safety
function working in low demand mode
of operation.
Probability of Failure per Hour (PFH):
For high or continuous demand, the
numerical measure of PFH is used, which
specifies the probability of a failure of
the safety function per hour (dangerous
failure rate).
Safe Failure Fraction (SFF):
Percentage part of safe failures and
dangerous detected failures of a safety
function or a subsystem related to all
failures.
High demand or continuous mode
of operation:
Frequency of demands on a safety-related
system greater than one per year or greater
than twice the proof-test frequency.
Device type A (simple subsystem):
The failure modes of all constituent
components are well defined and the
behaviour under fault conditions can be
completely determined.
Device type B (complex subsystem):
The failure mode of at least one constituent
component is not well defined (e.g. C, ASIC)
and the behaviour under fault conditions
cannot be completely determined.
FMEDA (Failure Modes, Effects and
Diagnostic Analysis):
Systematic way to identify and evaluate the
effects of different component failure modes,
to determine what could eliminate or reduce
the chance of failure, and to document a
system in consideration.
Failure rates:
SD: Total failure rate for safe
detected failures
SU: Total failure rate for safe
undetected failures
DD: Total failure rate for dangerous
detected failures
DU: Total failure rate for dangerous
undetected failures
Basic standard:
IEC 61508
Application sector standards:
IEC 61511
(process industry
IEC 61513
(nuclear power plants)
IEC 62061
(machinery)
IEC 61800-5-2 (power drive systems)
Integrity L
y
e
et
Mean Time Between Failures (MTBF):
Statistical measure of failure rates to
determine how reliable a component is.
Proof-test interval (T1):
Interval between periodic tests performed
to detect failures in a safety-related system.
SIL
nd
Safety lifecycle:
Describes all necessary activities involved
in the implementation of safety-related
systems, starting at the concept phase and
ending at the decommissioning.
Functional safety assessment:
Investigation, if functional safety was
achieved by the safety-related systems.
l
ve
Safety function:
Function which is intended to achieve
or maintain a safe state for equipment
under control (EUC), in respect of a
specific hazardous event.
Standards
ress Haus
+
SIL 2
logic unit
Sa
f
SIL 2
sensor
Modification, retrofit
Single-channel architecture
The PFDavg/PFH values of all components have to be
summed up and evaluated.
