ErgoPlanner

Appearance

SIL — Safety Integrity Level Verification ​

Build a Safety Instrumented Function from subsystems and voted elements, then verify its achieved SIL against the target — IEC 61508 / IEC 61511.

Overview ​

A SIL (Safety Integrity Level) assessment verifies that a Safety Instrumented Function (SIF) — for example an overpressure trip — achieves the integrity its risk assessment demands. ErgoPlanner builds the SIF from its subsystems (sensor, logic solver, final element) and the elements within each, applies the chosen voting architecture, and computes the average Probability of Failure on Demand (PFDavg) per IEC 61508-6. From PFDavg it derives the achieved SIL, the Risk Reduction Factor (RRF), and a target-vs-achieved verdict.

In this guide you'll learn

  • How to create a SIL assessment and define a SIF with a target SIL
  • How to model subsystems, elements and voting architecture
  • Which reliability inputs (λDU, Ti, β) drive the PFD calculation
  • How to read the achieved SIL, RRF and verdict

Estimated Time: 30 minutes Difficulty: Advanced

Prerequisites ​

  • A signed-in account
  • An engineering calculations entitlement to run the verification
  • Reliability data for each element (dangerous-undetected failure rate, proof-test interval, common-cause factor)
  • Familiarity with IEC 61508 / 61511 SIL concepts

Where to find it ​

The assessment list is at /sil/assessments; an individual assessment opens at /sil/assessments/{id}.

How the calculation works ​

For a low-demand SIF, ErgoPlanner computes the average probability of failure on demand per subsystem using the IEC 61508-6 simplified equations, then combines the subsystems in series to give the SIF PFDavg. The core single-channel term is:

PFDavg (1oo1) ≈ λDU × Ti / 2

Voted architectures (1oo2, 2oo2, 2oo3) extend this with the redundancy terms and a common-cause (β) contribution, so that redundancy reduces random-failure probability while β captures the failures that defeat redundancy together. From the SIF PFDavg:

RRF = 1 / PFDavg

and the achieved SIL is the IEC 61508 band that PFDavg falls into:

SILPFDavg (low demand)RRF
110⁻¹ to 10⁻²10 – 100
210⁻² to 10⁻³100 – 1000
310⁻³ to 10⁻⁴1000 – 10 000
410⁻⁴ to 10⁻⁵10 000 – 100 000

Workflow ​

Step 1 — Create the assessment ​

  1. Go to /sil/assessments and click Create Assessment.
  2. Enter an assessment name and optional description, and nominate a lead engineer.
  3. The assessment opens in Draft and progresses through In Progress → Verified → Approved → Closed.

Step 2 — Define the SIF and its target ​

Add a Safety Instrumented Function with:

  • A SIF tag and function description (e.g. "Overpressure shutdown").
  • The target SIL (1–4) that the risk assessment — typically the LOPA — requires.

Step 3 — Model subsystems and elements ​

A SIF is verified subsystem-by-subsystem (sensor → logic solver → final element). For each subsystem:

  1. Choose the voting architecture: 1oo1, 1oo2, 2oo2 or 2oo3.
  2. For each element, enter the reliability data:
    • λDU — dangerous-undetected failure rate (per hour).
    • Ti — proof-test interval (hours).
    • β — common-cause (beta) factor for voted architectures (a fraction, 0–1).
    • Diagnostic coverage, where applicable.

Step 4 — Verify ​

Click Verify on the SIF. ErgoPlanner computes the subsystem PFDavg values, combines them into the SIF PFDavg, and reports:

  • PFDavg — the computed average probability of failure on demand.
  • Achieved SIL — the band PFDavg falls into.
  • RRF — 1 / PFDavg.
  • Verdict — whether the achieved SIL meets the target SIL (pass / fail).

If the verdict fails, increase redundancy (a higher voting architecture), shorten the proof-test interval Ti, reduce β with diverse/independent elements, or select elements with a lower λDU, then re-verify.

Step 5 — Report ​

Click Report (PDF) in the assessment header to download the assessment report as sil-<assessment name>.pdf. If it cannot be generated, an error message appears at the bottom right of the screen.

Worked example ​

A single-channel pressure trip (1oo1) with λDU = 5×10⁻⁷ /h and a Ti = 8760 h (annual proof test):

PFDavg ≈ λDU × Ti / 2 = 5×10⁻⁷ × 8760 / 2 ≈ 2.19×10⁻³
RRF    = 1 / 2.19×10⁻³ ≈ 456

PFDavg falls in the SIL 2 band (10⁻² to 10⁻³), giving an achieved SIL 2 with an RRF of roughly 456. If the target was SIL 2, the verdict passes.

Use cases ​

  • SIF verification — Prove a new trip system meets the SIL its LOPA demanded before detailed design is frozen.
  • Architecture trade studies — Compare 1oo1 vs 1oo2 vs 2oo3 for the same elements to find the cheapest architecture that still passes.
  • Proof-test-interval optimisation — Vary Ti to find the longest test interval that keeps the achieved SIL on target, balancing integrity against maintenance burden.

References ​

  1. IEC 61508-6 — Functional safety: guidelines on the application of parts 2 and 3 (PFD equations)
  2. IEC 61511 — Functional safety: safety instrumented systems for the process industry sector