February 27, 2020

Last updated on July 1, 2021

SIL Verification - PFD or PFH?

This blog will help if you have ever tried to do a SIL verification for probability of failure (PFD or PFH) of a safety function. 


A safety integrity level - SIL verification - is needed for compliance with IEC 61511 / ISA 61511 in the process sector and in IEC 62061 projects in the machinery sector.


But how do you approach PFD and PFH calculations?

Limitations of SIL verification probability of failure calculations

At the outset, let's be clear that probability of failure calculations are far from an exact science. Analyses do not make the results accurate, especially if the assumptions are incomplete or if the underlying data is flawed.

Note that the goal is to ensure that safety functions result in integrity that meets a range of probabilities. Calculations should be realistic and as conservative as possible.

Get the safety requirements specification (SRS)

The Safety Requirements Specification (SRS) must be the starting point for any SIL verification probability of failure calculation exercise. Requirements for each safety function provide a vital link back to the hazard and risk analysis.

If completed correctly, the SRS will specify what each safety function must achieve, including what to sense and actuate to achieve or maintain a safe state. The SRS is also the primary reference source for the SIL target and other critical performance factors like required response and reaction time.

In the early stages of design, the SRS may not specify the actual equipment or even the required level of redundancy. It is commonplace for there to be several updates of the SRS following SIL verification at multiple stages in design.

Select a modelling method and tool

To complete a SIL verification, the analyst must decide on a calculation method. Below are the most common methods used in industry today.

  • Simplified equations such as those published in IEC61508-6.
  • Reliability block diagram (RBD) modelling tools such as Isograph RBD.
  • Fault tree modeling tools such as Fault Tree Analyser or Isograph FTA
  • Specialist SIL verification tools such as aeSolutions aeShield or exida exSILentia for process application PFD calculations.
  • Performance Level (*PL) calculation tool SISTEMA for machinery safety PFH calculations.
  • *Note that the term Performance Level (PL) is used in some machinery safety applications as specified in ISO 13849-1. Each PL can be approximately mapped to an equivalent SIL. 

There are positives and negatives in every method, but with higher integrity requirements (higher SIL), analysts should adopt a more rigorous approach or use multiple methods.

It is possible to calculate the most common SIL 1 safety function designs using simplified equations provided in basic safety standard IEC 61508 part 6.

A good source for safety function equations, RBD and fault trees is ISO/TR 12489:2013.

Sadly, very few of the above items are free, so it is wise to choose carefully or get a specialist company to provide support.

Find conservative failure data

Failure rates of equipment items are the source information needed for any PFD or PFH calculation. A good reference source for free and paid resources is provided at this blog by Stephen Thomas at the SIS engineer.com website. I would echo many of the sentiments written on his blog about "words of caution" on failure rate data.

Agree on all assumptions

It is an excellent idea to develop a checklist to agree on the assumptions for the calculations.

Consider the following questions as a starting prompt:

  • Which standard or standards are being followed?
  • How will you demonstrate Systematic Capability?
  • What is the maintenance regime and mean repair/restoration times in the case of failure?
  • Is there an optimum proof test interval to tie-in with turnarounds?
  • What proof test coverage will you expect by equipment type?
  • How will you estimate common cause for any redundant elements?
  • What is the required service life or mission time?

Completing the SIL verification

For a new-build project, completing the SIL verification exercise may involve several calculation stages, safety requirement specification update and re-calculation as the design matures and equipment selection occurs.

If you are already operating a safety system, you can complete the calculations based on the installed equipment. If there are field failure rate data available, then you should use that in preference to other data sources.

The conclusion of a SIL verification calculation requires that the resulting PFD or PFH for each safety function meets the target set in the SRS.

The target may be simply a SIL band, in which case the PFD or PFH is technically only required to meet the minimum requirement in that band.

If the target is a numerical value, then the PFD or PFH achieved must be LOWER than this value.

The SIL verification exercise is not fully complete until other factors have also been considered, including hardware fault tolerance and systematic capability.

FAQ's

What does SIL stand for?

Safety Integrity Level (SIL) is now somewhat familiar to most process plants with hazards requiring independent protection layers.

When correctly applied, a SIL requirement from SIL 1 to SIL 4 can be assigned to an end-to-end safety function to provide a marker of the level of integrity required for equipment hardware and software concerning the risk of a given hazard; SIL 1 being the lowest integrity and SIL 4 the highest.

Why is SIL verification needed?

Equipment designed for automatically sensing and reacting to hazards can be created and employed in many different applications.

Typical process industry applications include emergency shutdown or trip systems that prevent potentially dangerous pressure, temperature or level conditions from escalating.

For hazardous machinery, automated safety functions detect human proximity and bring about a safe state to protect workers from harm.

Whatever the application, the hazard owner should decide the SIL target for each safety function. This process is known as SIL determination or SIL selection.

A PFD or PFH calculation is required to demonstrate that each safety function can meet random failure targets.

PFD and PFH

PFD = Probability of Failure on Demand
PFH = Probability of Failure per Hour

Why are there two different types of calculation: PFD and PFH?

There are two calculation methods due to the different MODES OF OPERATION defined for a safety function; LOW DEMAND MODE and HIGH DEMAND / CONTINUOUS MODE. 

Are PFD or PFH the only thing that need to be demonstrated for SIL?

The answer to this is an emphatic NO! PFD/PFH calculations are only a part of a much larger picture.

MODE of operation

Put simply, this is the way (mode) in which a safety function operates. Examples follow in the definitions below.

LOW DEMAND MODE

As the name indicates, this is where the end application of a safety function gets called upon very INFREQUENTLY. The standards define low demand mode as a maximum frequency of demands no greater than once per year.

LOW DEMAND MODE safety functions require a Probability of Failure on Demand - *PFD calculation. These are common in process industry applications.

*Note: The technically correct term is PFDavg; where "avg" is the abbreviation for "average", as it is an average probability value that is calculated.

HIGH DEMAND MODE

This is where a safety function still works on demand, but the frequency of demands is greater than once per year.

HIGH DEMAND MODE safety functions require a Probability of Failure per Hour (*PFH) calculation.

*Note: PFH is more accurately known as PFHD in machinery safety standards IEC 62061 and ISO 13849-1.

CONTINUOUS MODE

Note that the word "demand" does not appear in this case. This type of safety function is continously operating to retain a safe state.

CONTINOUS MODE safety functions require a Probability of Failure per Hour (*PFH) calculation.

*Note: PFH is more accurately known as PFHin machinery safety standards IEC 62061 and ISO 13849-1.

{"email":"Email address invalid","url":"Website address invalid","required":"Required field missing"}
>