About this calculator

The architectural SIL a subsystem can claim

The SFF / HFT calculator screens architectural constraints: the highest SIL a subsystem’s hardware architecture supports, from its safe failure fraction and hardware fault tolerance. It does not compute PFDavg or PFH.

  • IEC 61508 Route 1H: SFF band and HFT give the maximum SIL from Table 2 (Type A) or Table 3 (Type B).
  • IEC 61508 Route 2H: a minimum HFT per SIL, with Type B diagnostic coverage of at least 60% and failure data that meet the confidence requirements.
  • IEC 61511-1 Table 6: the same minimum HFT for the process sector, supported by prior-use and field-data records.

Worked example

Type B transmitters in 2oo3

With λDU 60, λDD 160, λSU 20 and λSD 10 FIT, SFF = (160 + 20 + 10) / 250 = 76%. In 2oo3 the subsystem tolerates one fault (HFT 1). Under Route 1H, a Type B device with SFF between 60% and 90% and HFT 1 reaches SIL 2. Under Route 2H or Table 6, HFT 1 supports up to SIL 3 in low demand, provided the route’s evidence is in place.

When to go further

Architecture is one gate of three

The claimed SIL is the lowest of the quantitative result, the architectural SIL and systematic capability. SIL Verification works out all three for the whole SIF. For a quick PFDavg, use the PFD calculator; for the background, read Route 1H and Route 2H and Table 6.

IEC 61511-1 safety lifecycle
Management of functional safety and assessment · Cl. 5
One SIF record
  1. 5Installation, commissioning and validation (outside SILProof scope)Cl. 14–15
  2. 6Operation and maintenance (outside SILProof scope)Cl. 16
  3. 7Modification (outside SILProof scope)Cl. 17
  4. 8Decommissioning (outside SILProof scope)Cl. 18
Verification · Cl. 7

Questions

Frequently asked questions

What is the difference between SFF and HFT?

Safe failure fraction (SFF) is the share of failures that are safe or detected: (λSD + λSU + λDD) divided by all failures. Hardware fault tolerance (HFT) is how many faults the subsystem can tolerate and still perform its function: 1oo1 has HFT 0, 1oo2 and 2oo3 have HFT 1.

What is the difference between Type A and Type B?

Type A devices are simple, with well-defined failure modes and dependable field data, such as valves and relays. Type B devices are complex or not fully characterised, such as programmable electronics and smart transmitters, and Route 1H sets stricter limits for them.

When do Route 2H and IEC 61511 Table 6 apply?

Route 2H replaces the SFF tables with a minimum HFT per SIL, provided the failure data meet the confidence and field-feedback requirements of IEC 61508-2. IEC 61511-1 Table 6 uses the same minimum HFT for the process sector without that confidence requirement.

Does the architectural SIL give my claimed SIL?

No. It is one of three gates. The claimed SIL is the lowest of the quantitative result (PFDavg or PFH), the architectural SIL and systematic capability, which is what SIL verification works out for the whole SIF.