Safety Instrumented Systems and Functional Safety
Safety Instrumented Systems and Functional Safety tests whether you can specify, design, verify and maintain a safety instrumented function independently of the basic control system. The exam centres on IEC 61508 and IEC 61511, SIL determination, PFD/PFH calculation and the safety lifecycle.
Core rules and concepts
- A safety instrumented function comprises sensors, logic solver and final elements. Its SIL is a system property, not a device label. SIL 1-4 correspond to increasing risk reduction; for low-demand mode, PFDavg ranges are 1e-2 to 1e-1 (SIL 1), 1e-3 to 1e-2 (SIL 2), 1e-4 to 1e-3 (SIL 3) and 1e-5 to 1e-4 (SIL 4).
- IEC 61511 applies the safety lifecycle to the process sector: hazard and risk assessment, safety requirements specification, design and engineering, installation and commissioning, validation, operation and modification.
- SIL determination uses risk graph, LOPA or risk matrix. LOPA compares initiating-event frequency, independent protection layers and tolerable risk; each IPL must be independent, specific, dependable and auditable.
- Architecture uses hardware fault tolerance, safe failure fraction, diagnostic coverage and common-cause factors. Redundancy reduces random failure but not systematic failure; common-cause, proof-test coverage and bypass management remain critical.
- PFDavg for a simple 1oo1 element with dangerous undetected failure rate λDU and proof-test interval TI is approximately λDU × TI/2, assuming constant failure rate, perfect proof test and no repair credit.
Worked example
A 1oo1 pressure transmitter has λDU = 2 × 10^-6 per hour and a one-year proof-test interval of 8,760 h. PFDavg ≈ 2 × 10^-6 × 8,760/2 = 8.76 × 10^-3. That is within the SIL 2 band (1e-3 to 1e-2) for that element alone, but the whole SIF includes the logic solver and valve. If the valve has a higher PFDavg, the SIF may not achieve SIL 2. Reducing the proof-test interval to six months halves the transmitter contribution but may not fix a poor final element.
Traps
Treating SIL as a device certificate; mixing PFDavg and PFH; ignoring proof-test coverage; claiming credit for non-independent alarms; and leaving bypasses unmanaged.