17.3 SIL Calculations and Formulas
Key Takeaways
- Demand-mode SIL 1–4 are PFDavg bands in ISA/IEC 61511-1 Table 4; continuous-mode SIL 1–4 are PFH bands in Table 5.
- Standard variables include λD, λDD, λDU, DC, MTTR, proof-test interval T (or TI), β, and RRF = 1/PFDavg.
- For a simple 1oo1 low-demand channel with a perfect proof test and negligible detected-failure downtime, PFDavg ≈ λDU·T/2 in consistent units.
- Common-cause β often dominates redundant PFDavg; omitting β overstates the benefit of 1oo2 or 2oo3.
- NCEES supplies the PE Control Systems Reference Handbook plus the 61511 tables—not a separate secret formula sheet beyond those references.
SIL as a band, not a brand name
A Safety Integrity Level is a target failure-measure band for a SIF, not a sticker on a transmitter. ISA/IEC 61511-1:2018 aligns with IEC 61508 on four levels. After you compute PFDavg (demand) or PFH (continuous), you place the number in a band. Barely inside the band still counts; 1.1×10⁻² is not SIL 2 demand-mode performance.
NCEES will supply the PE Control Systems Reference Handbook and ISA/IEC 61511-1:2018. Search those files for the 61511 SIL tables and the handbook’s simplified PFD models. That is the formula set you can look up. This guide does not claim NCEES published some additional unique formula sheet beyond the handbook and the named 61511/61508 variables. If an item gives data, use consistent units and the architecture the stem names.
Demand-mode PFDavg versus continuous-mode PFH
Demand mode — PFDavg (ISA/IEC 61511-1 Table 4):
| SIL | PFDavg range | Equivalent RRF = 1/PFDavg |
|---|---|---|
| 4 | ≥ 10⁻⁵ to < 10⁻⁴ | > 10 000 to ≤ 100 000 |
| 3 | ≥ 10⁻⁴ to < 10⁻³ | > 1 000 to ≤ 10 000 |
| 2 | ≥ 10⁻³ to < 10⁻² | > 100 to ≤ 1 000 |
| 1 | ≥ 10⁻² to < 10⁻¹ | > 10 to ≤ 100 |
Continuous / high-demand — PFH (the NCEES handbook / 61511 Table 5), average frequency of dangerous failures per hour:
| SIL | PFH (1/h) |
|---|---|
| 4 | ≥ 10⁻⁹ to < 10⁻⁸ |
| 3 | ≥ 10⁻⁸ to < 10⁻⁷ |
| 2 | ≥ 10⁻⁷ to < 10⁻⁶ |
| 1 | ≥ 10⁻⁶ to < 10⁻⁵ |
SIL 4 process SIFs are rare; architectural HFT 2 and systematic-capability demands are severe. Most process exam items live in SIL 1–3 demand mode.
Risk reduction factor: $\mathrm{RRF} = 1 / \mathrm{PFD}_{avg}$ for a low-demand SIF treated as an independent protection layer. A PFDavg of 1×10⁻² is RRF 100 (edge of SIL 1 / SIL 2). Do not compute RRF from PFH by inverting a per-hour number without converting to a dimensionless demand probability.
Variables you must be able to name
the NCEES handbook and 61508/61511 reliability models use the same symbols:
| Symbol | Meaning |
|---|---|
| λD | Dangerous failure rate |
| λDD | Dangerous detected failure rate |
| λDU | Dangerous undetected failure rate |
| λS | Safe (spurious-trip) failure rate |
| DC | Diagnostic coverage |
| MTTR | Mean time to repair |
| T or TI | Proof-test interval |
| β | Common-cause fraction for redundant channels |
| PFDavg | Average probability of failure on demand |
| PFH | Average frequency of dangerous failure (per hour) |
Identities you should write without hesitation:
the NCEES handbook also reminds you that failure rate = failures / total time, usually per hour. Example there: 1 failure in 10 years = 1 / 87 600 h = 1.14×10⁻⁵ /h, using 8760 h/year.
Unit trap. the NCEES handbook labels TI as the manual test interval in years while λ is commonly per hour. The algebra PFDavg = λDU·TI/2 is dimensionless only if λ and TI share inverse units. Convert: TI = 1 year → 8760 h if λDU is /h; or convert λDU to /year. Mixing 10⁻⁶ /h with TI = 1 “year” without 8760 understates PFDavg by about four orders of magnitude.
β trap. The handbook wording “beta (common cause) percentage” does not mean you type 5 for a 5% factor. IEC 61508 β is a fraction (0.05). If the stem says 5%, use 0.05.
Simple 1oo1 PFDavg — state the assumptions
This is the Handbook 1oo1 line and the usual 61508 simplified low-demand result. It is not magic; it is the time-average of a dangerous-undetected failure probability that rises approximately linearly from 0 just after a perfect test to λDU·T just before the next test.
Assumptions you should be ready to state:
- Low demand (use PFDavg, not PFH).
- Constant dangerous-undetected failure rate (exponential / useful-life region, not infant mortality or wear-out).
- Perfect proof test (coverage ≈ 100% of λDU; real tests have coverage CPT < 1, which leaves a residual term).
- Test duration is short compared with T.
- Detected dangerous failures are repaired quickly, so λDD·MTTR is negligible next to λDU·T/2.
- Single channel, so no β term.
- Restoration is as-good-as-new for the failures the test finds.
If those fail, the simple formula is a screening number, not a finished 11.9 verification. Real SIF PFDavg adds sensor + logic + final-element contributions (often dominated by the valve).
Handbook architectures you may be asked to recognize (same λDU, TI, β):
- 1oo1: λDU·TI/2
- 1oo2: (λDU²·TI²)/3 + λDU·β·TI/2
- 2oo2: λDU·TI + λDU·β·TI/2
- 2oo3: λDU²·TI² + λDU·β·TI/2
The β·λDU·TI/2 term is the common-cause floor. After a modest β, adding a second identical transmitter buys less than the independent λ² term suggests.
Worked numeric: λDU, T, PFDavg, SIL band
Given: 1oo1 low-demand final-element channel, λDU = 1.0×10⁻⁶ /h, proof test every 1 year, perfect test, neglect λDD·MTTR.
T = 8760 h.
Place 4.38×10⁻³ on the demand-mode table: ≥ 10⁻³ to < 10⁻² → SIL 2.
$\mathrm{RRF} = 1 / 4.38\times10^{-3} \approx 228$ (inside 100 to 1000).
Stretch the SRS interval to 4 years without changing hardware: T = 35 040 h, PFDavg = 1.75×10⁻² → SIL 1 band. The SIL 2 claim is broken even though the valve catalogue page did not change. That is why proof-test interval is a Clause 10 requirement, not an operations footnote.
Same λDU, 1oo2, β = 0.05: independent term (λDU·T)²/3 ≈ 2.6×10⁻⁵; CCF term 0.05×4.38×10⁻³ = 2.19×10⁻⁴; PFDavg ≈ 2.45×10⁻⁴ → SIL 3 band for that subsystem, with most of the benefit capped by β.
SIL success still also needs HFT and systematic capability from the previous section. A PFDavg in band with HFT 0 on a SIL 3 any-mode function fails 11.4.
A 1oo1 low-demand channel has λDU = 1.0×10⁻⁶ /h and a 1-year proof test (8760 h). Using PFDavg ≈ λDU·T/2 with a perfect proof test, which result is correct?
For a low-demand SIF, how is risk reduction factor related to average probability of failure on demand?