IEC 61508 / IEC 61511 · SIL verification
Prove the claimed SIL before you defend it
A target SIL from risk analysis is not a verified SIF. Quantitative performance, architecture and systematic capability must all clear — claimed SIL is the lowest gate.
- Run PFDavg / PFH with architecture and SC on one record
- See which gate limits the claim — and why
- Keep verification evidence tied to the same SIF tag
- 1Hazard and risk assessment (outside SILProof scope)Cl. 8
- 2Allocation to protection layersSIL determination · Risk AnalysisCl. 9
- 3SIS safety requirements specificationSRS BuilderCl. 10
- 4SIS design and engineeringSIL Verification · issued reportCl. 11You are here
- PFDavg / PFH
- Architecture
- Systematic capability
Claimed SILthe lowest of the three gates · issued report
- 5Installation, commissioning and validation (outside SILProof scope)Cl. 14–15
- 6Operation and maintenance (outside SILProof scope)Cl. 16
- 7Modification (outside SILProof scope)Cl. 17
- 8Decommissioning (outside SILProof scope)Cl. 18
Algebraic and Markov engines · checked against IEC 61508-6 Annex B
What it decides
Does the designed SIF meet its target SIL?
Risk analysis gives a required SIL or risk reduction. SIL verification takes the designed function — sensors, logic solver and final elements, as they will be installed, tested and maintained — and shows whether it achieves that target, which gate limits it, and what you would have to change.
- Required SIL and risk reduction can come from Risk Analysis, LOPA or your own basis.
- Low demand is judged on PFDavg and risk reduction; high-demand and continuous modes on PFH.
- The result stays on the same SIF record as the risk basis and the SRS.
The method
Three gates, one claimed SIL
A SIL claim needs all three. The claimed SIL is the lowest of them, so a good PFDavg cannot hide weak architecture or unproven systematic capability.
- 1 · QuantitativePFDavg (low demand) or PFH (high demand, continuous) for the whole loop, with voting, common cause (β), proof-test coverage and interval, repair and mission time.
- 2 · ArchitectureHardware fault tolerance per subsystem against IEC 61508-2 Route 1H (SFF tables) or Route 2H, or IEC 61511-1 Table 6, with the evidence each route asks for.
- 3 · Systematic capabilityThe SC of each device from certification or proven-in-use evidence. The lowest SC in the loop caps the claim.
Members · Excel workbook
Take the calculation offline
Why Excel? Do it yourself on your desktop: no sign-in, no internet, and your plant data never leaves your machine.
The workbook reproduces the SILProof calculation cell by cell, with every formula visible and the worked example preloaded, so you can check, archive or extend a verification in Excel.
- Sensor and logic solver, including 1oo2D, and final elements with legs, groups and series components
- DU MRT, DD MTTR, detected-failure behaviour, partial stroke test and common cause β
- Checked against the SILProof engine in nine cases, to better than one part in a trillion
| A | B | |
|---|---|---|
| 8 | Sensor PFDavg · 2oo3 | 2.653E-5 |
| 9 | Logic solver PFDavg · 1oo2D | 6.563E-6 |
| 10 | Final elements PFDavg | 6.200E-5 |
| 11 | Loop PFDavg | 9.509E-5 |
| 12 | Achieved RRF | 10,516 |
| 14 | Target SIL 2 | PASS NUMERIC |
Inputs and outputs
What you enter and what you get
You enter
- Voting for each subsystem (for example 2oo3 sensors, 1oo2D logic, 1oo2 valves)
- Failure rates λDU, λDD, λSU, λSD in FIT from the safety manual, FMEDA or field data
- Device type, architectural route and systematic capability
- Proof-test coverage and interval, repair time, mission time and β
- Final elements as legs of components in series (solenoid and valve), voted between legs
- Optional: partial stroke testing, MRT, βD and diverse sensor channels
You get
- PFDavg and risk reduction (or PFH) for the whole SIF
- Each subsystem’s contribution and architectural SIL, with HFT and SFF
- The claimed SIL and the gate that limits it
- The longest common proof-test interval that still meets the target
- A reliability block diagram of the loop
- A report with inputs, assumptions and an evidence register for review
Worked example
High-high separator level shutdown
Separator V-101 trips on high-high level: three level transmitters vote 2oo3, a 1oo2D safety PLC, and two isolation paths in 1oo2, each a solenoid valve in series with an inlet ESD valve. Proof testing every year over a 20-year mission, β 5%. Target SIL 2.
| Subsystem | Architecture | PFDavg | Architectural SIL |
|---|---|---|---|
| Sensors LT-101A/B/C | 2oo3 · Type B · SFF 76% | 2.653e-5 | SIL 2 |
| Logic solver SPLC-101 | 1oo2D · Type B · SFF 85% | 6.563e-6 | SIL 2 |
| Final elements XV-101A/B | 1oo2 legs · Type A · SFF 78% | 6.200e-5 | SIL 3 |
| Whole SIF | RRF ≈ 10,516 | 9.509e-5 | SIL 2 (lowest) |
Claimed SIL 2, target SIL 2 met. The PFDavg sits in the SIL 4 band and systematic capability is SC 3, but the Type B sensors and logic solver with SFF between 60% and 90% and one fault tolerated reach SIL 2 on architecture, so architecture sets the claim.
Calculation basis and limits
Transparent assumptions, independent review
- Algebraic PFDavg in the IEC 61508-6 Annex B form (βD = β unless entered), extended for proof-test coverage and mission time; checked against the Annex B closed forms.
- Optional continuous-time Markov model with a periodic proof-test map; PFH in the Annex B.3.3 form for high-demand and continuous modes.
- Series components and series voting take no common-cause credit; redundant voting uses β on the voted channels.
- Failure rates, β and test coverage are your inputs. The tool does not supply certified data.
- SILProof is engineering support, not a certificate. Results need competent, independent review against IEC 61508, IEC 61511 and your project procedures.
Read the engineering basis and review guide for the full scope.
Questions
Frequently asked questions
How is SIL verification different from the PFD calculator?
The PFD calculator gives a quick 1oo1 low-demand PFDavg for screening. SIL verification assesses the whole Safety Instrumented Function: sensor, logic solver and final elements with their voting, common cause, proof testing, architectural constraints and systematic capability, and it shows which of the three gates limits the claimed SIL.
Which standards does the calculation follow?
Low-demand PFDavg is calculated in closed form: each channel’s unavailability over the mission, voted at every instant and averaged exactly, with a β-factor for common cause; an optional Markov model is available. It is benchmarked against the IEC 61508-6:2010 Annex B equations on the validation page. High-demand and continuous modes use the Annex B.3.3 PFH form. Architectural constraints follow IEC 61508-2 Route 1H or 2H, or IEC 61511-1 Table 6.
Why can the claimed SIL be lower than the PFDavg band?
A PFDavg in the SIL 3 band is only the quantitative gate. The claimed SIL is the lowest of the quantitative result, the architectural constraints and systematic capability. In the worked example the PFDavg is in the SIL 4 band, but architecture limits the claim to SIL 2.
Can I model partial stroke testing, diverse sensors or a separate repair time?
Yes. Partial stroke testing, a repair time after proof testing (MRT) and a separate common-cause factor for detected failures (βD) are optional inputs; left blank, the standard model applies. Sensor channels can carry different failure data when the devices are diverse.
Do I need an account?
No. The workspace runs in your browser and keeps your SIF records there. Signing in is optional and only adds a cloud copy. Membership is free.
Is the result a SIL certificate?
No. SILProof is engineering support. Failure data, assumptions and the final claim need competent, independent review against the applicable editions of IEC 61508 and IEC 61511 and your project procedures.
Related
Read more and related tools
Learn
Tools
- Risk Analysis — set the required SIL first
- SRS Builder — specify the SIF
- PFD calculator — 1oo1 screening estimate
- SFF / HFT calculator — architectural screening
- SIF register — all functions in one place
Next step
Open the verification workspace
Select a SIF and run the full assessment. Example SIF-Example-LSH is ready if you want a worked path first.