Skip to content
SILProof
My SIFs Join free
Home/Knowledge Hub/Designing a Safety Instrumented Function

Design · Core workflow

Designing a Safety Instrumented Function

A SIF design begins with the required action and process constraints. Architecture, devices and voting are selected to satisfy that requirement with adequate independence, timing, integrity and maintainability.

Engineering guide10 min readUpdated 10 October 2026Published by SILProof Engineering

In brief

What to carry into the engineering work

  • Define the hazardous condition, safe state and timing before selecting hardware.
  • Treat sensors, logic solver interfaces and final-element legs as explicit subsystem boundaries.
  • Redundancy only helps when common-cause, independence, testing and maintenance are addressed.

Define the function before the hardware

State the hazardous condition, trip setpoint, safe state, process safety time, required response time, operating modes and reset philosophy. These requirements determine what the sensors must detect and what the final elements must achieve.

Three subsystem roles

Sensor part
Detects the defined process condition. Consider range, accuracy, diagnostics, common process connections and environmental causes.
Logic solver part
Evaluates the trip logic and commands the final action. Include required input and output channels in the engineering boundary.
Final-element part
Performs the physical action. A leg can contain serial components such as an output channel, solenoid and shutdown valve.

Voting and independence

MooN voting states how many of N channels must act. Redundancy can improve random-hardware performance, but only when common-cause failures, shared utilities, shared process connections and maintenance practices are addressed. The architecture must also meet the applicable hardware-fault-tolerance route.

Timing and safe state

The response-time budget should include sensing, filtering, logic execution, output actuation, final-element travel and relevant process delays. The required response time should remain below the process safety time with an engineering margin justified by the project.

Design-review questions

  • Can every device perform the required action in the stated service and environment?
  • Are sensor, logic and final-element boundaries explicit?
  • Are common-cause and shared-service dependencies visible?
  • Can the proof test reveal the failure modes credited by the calculation?
  • Are bypass, reset, override and degraded-mode behaviours specified?

Primary references

  1. IEC — Overview of IEC 61508 and functional safety
  2. IEC 61511-1 — process-industry SIS framework and requirements
  3. UK HSE — Functional safety

Use the applicable edition and national adoption. Project specifications and controlled procedures may add requirements.

Continue

Related guides

Failure data for SIL verificationSelect, classify and document failure-rate data without losing its application conditions or provenance.Proof testing and restoration assumptionsConnect proof-test interval, coverage, diagnostics and repair assumptions to a procedure that can actually be executed.Writing a SIF Safety Requirements SpecificationWrite one controlled SIF requirement set that can drive design, verification, testing and validation.