SIL classification determines how much risk reduction a Safety Instrumented Function needs. SIL verification answers the next question: can the proposed SIF design actually achieve that integrity over its intended operating and test interval?
For low-demand process safety functions, verification commonly involves calculating the average probability of failure on demand, or PFDavg, for the complete sensor, logic solver and final-element chain. The calculation is important, but the real engineering value comes from understanding which assumptions drive the result and whether those assumptions can be maintained during operation.
SIL classification and SIL verification are different
SIL assessment and classification is a risk-allocation activity. It starts from a hazardous scenario and determines the required Risk Reduction Factor for a SIF.
SIL verification is a design check. It evaluates whether the architecture, failure data, diagnostics, proof-test interval and other parameters can meet that required level of integrity.
Keeping these steps separate prevents the target from being adjusted merely to match equipment that has already been selected.
What is PFDavg?
PFDavg represents the average probability that a low-demand safety function will fail to perform when required. Risk Reduction Factor is approximately the inverse of PFDavg, so a lower PFDavg represents greater risk reduction.
The calculation considers dangerous failures that may remain hidden until a proof test or demand reveals them. Because hidden failures accumulate between tests, the assumed proof-test interval has a strong influence on the result.
Verify the complete SIF, not one component
A SIF normally includes a sensor subsystem, logic solver and final-element subsystem. All relevant parts contribute to overall unavailability. A certified logic solver may have excellent reliability, but the SIF can still fail to meet its target if the final element dominates the PFDavg.
This is one reason statements such as “the PLC is SIL 3, therefore the loop is SIL 3” are misleading. The target applies to the complete Safety Instrumented Function.
Sensor architecture
The sensor arrangement may be 1oo1, 1oo2, 2oo3 or another voting architecture depending on the application. Redundancy can improve dangerous-failure performance, but it also introduces common-cause considerations and can affect spurious-trip behaviour.
Failure rates should be appropriate for the instrument type and service. Environmental conditions, impulse-line plugging, common process connections and shared utilities can create dependencies that a simple reliability block diagram may not fully capture.
Logic solver contribution
Modern safety logic solvers often make a relatively small contribution to the total PFDavg compared with field devices, but they still require suitable hardware, application programming, configuration control and proof testing.
The verification should reflect the actual architecture and diagnostics rather than rely only on a generic certification claim.
Final element contribution
Shutdown valves and other final elements frequently dominate SIF PFDavg. Relevant elements can include the valve body, actuator, solenoid valve, pilot components and associated utilities.
Failure data should represent the final-element configuration. If partial-stroke testing is credited, the calculation should reflect what failure modes the test actually detects and how often a full proof test is still performed.
Proof-test interval
The assumed proof-test interval is one of the most important verification inputs. Longer intervals generally allow more dangerous undetected failures to accumulate and therefore increase PFDavg.
A calculation based on an annual proof test is only valid if the operating organisation can actually complete an effective test at approximately that interval. Extending testing later may require the verification to be revisited.
Proof-test coverage
A proof test does not necessarily reveal every dangerous hidden failure. Test coverage represents the proportion of relevant failures detected by the procedure. A verification that assumes very high test coverage should be supported by a test procedure capable of achieving it.
This creates a direct connection between design calculations and operations. Our article on SIF proof testing and bypass management discusses how these assumptions are maintained after start-up.
Common-cause failure
Redundant channels are not fully independent. Common-cause failures can affect multiple devices at once due to shared environment, maintenance errors, common impulse lines, common power supplies or systematic design issues.
Verification methods therefore include a common-cause factor or equivalent treatment. Simply doubling the number of instruments does not deliver unlimited reliability improvement.
Diagnostic coverage and repair time
Online diagnostics can detect some dangerous failures before a demand occurs. Their benefit depends on what is detected and how quickly the fault is repaired. A diagnostic alarm that remains unresolved for months does not provide the same practical benefit as one linked to a controlled repair process.
Repair-time assumptions should reflect the asset’s maintenance capability, spare availability and operating constraints.
Architectural constraints
Meeting the numerical PFDavg target may not be sufficient on its own. Functional safety design can also be subject to architectural or systematic capability requirements depending on the devices and design approach.
Verification should therefore follow the project’s IEC 61511 methodology rather than be reduced to one spreadsheet result.
Response time is not captured by PFDavg alone
A SIF can have an acceptable probability of failure and still be ineffective if it acts too slowly. The Safety Requirements Specification should define the required response time based on process safety time.
Valve stroke time, sensor delay, logic execution and process dynamics all contribute to the actual response.
Separate independence from reliability
PFDavg calculations quantify random hardware failure performance, but risk assessment also depends on independence. If a SIF shares equipment or utilities with the initiating cause, the mathematical PFD may not represent the true scenario risk.
The LOPA and SIF definition should therefore be reviewed together. See our guide to LOPA IPLs and RRF for the independence principles behind protection-layer credit.
Sensitivity analysis
When a verification is close to a SIL boundary, sensitivity checks can show which assumptions matter most. Changing proof-test interval, failure rate, common-cause factor or repair time may significantly alter the result.
This helps the project focus effort on the design and maintenance features that genuinely improve integrity rather than adding complexity with little benefit.
Verification should produce actionable requirements
The output should identify not only whether the target is met, but the assumptions required to keep it met. These may include proof-test intervals, test coverage, device architecture, diagnostic response, final-element configuration and maximum repair time.
Those assumptions should be carried into the SRS, maintenance strategy and operating procedures.
Functional safety engineering support
Pro Engineers supports SIL verification, SIL assessment, SRS development and wider functional safety lifecycle work for process facilities. We focus on calculations that remain traceable to the real hazard scenario and to practical testing and maintenance requirements.
For a new SIF design or review of an existing verification basis, contact Pro Engineers.