1oo2 Pressure Transmitters Claiming SIL 3
A SIL 3 high-pressure shutdown function uses two pressure transmitters in a 1oo2 configuration. Each transmitter is type B, has a safe failure fraction of 85%, a dangerous undetected failure rate of 5E-7/h, and a proof-test interval of one year. The common-cause beta factor is estimated at 10%. The supplier's safety case calculates a PFDavg of about 2.2E-4 and claims SIL 3 because the number is between 1E-4 and 1E-3. The logic solver is certified for SIL 3, and the final element is a SIL 3 shutoff valve. The project is about to issue the safety case. A reviewer notes that the transmitters are type B and that the 1oo2 architecture has a hardware fault tolerance of 1. The supplier argues that the PFDavg is the decisive number and that the architectural constraints are conservative guidance. The customer's assessor asks whether the SIL 3 claim can be accepted.
1. Calculate the PFDavg and assess the SIL 3 claim against architectural constraints.
Read the worked answer
For a 1oo2 arrangement with common cause, a suitable approximation is PFDavg ≈ β λ_DU T/2 + (1-β)^2 (λ_DU T)^2/3. With λ_DU = 5E-7/h, T = 8760 h, β = 0.1: λ_DU T = 4.38E-3. The common-cause term is 0.1 × 4.38E-3/2 = 2.19E-4. The independent term is 0.81 × (4.38E-3)^2/3 ≈ 5.2E-6. Total PFDavg ≈ 2.24E-4, which is in the SIL 3 PFD band (1E-4 to 1E-3). So the numerical PFD calculation is consistent with SIL 3.
However, the architectural constraints are not optional guidance. For a type B element with hardware fault tolerance 1 and safe failure fraction 85%, IEC 61508-2 limits the achievable SIL to SIL 2. The SIL 3 claim cannot be accepted on PFDavg alone. The PFD calculation shows what the redundancy could achieve if the architecture were permitted; the architectural table shows that this type B, HFT 1, SFF 85% combination is not permitted to claim SIL 3. The supplier's argument reverses the logic: the architecture sets the maximum SIL, and the PFD calculation must then be shown to meet that limit.
2. What options would you present to achieve SIL 3, and what evidence would each require?
Read the worked answer
Option 1: increase hardware fault tolerance to 2, for example a 1oo3 arrangement of type B transmitters. With HFT 2 and SFF 60-90%, the architectural constraint permits SIL 3. This requires recalculation of PFDavg with common cause, review of the voting logic, proof-test procedures that test each channel and the voter, and evidence that a single failure does not defeat the function.
Option 2: keep HFT 1 but improve the safe failure fraction to at least 90% through diagnostics, so that the type B, HFT 1 architecture can claim SIL 3. This requires diagnostic coverage evidence, failure mode and effect analysis, and proof that the diagnostics detect the dangerous failures claimed. It is not enough to change the SFF number in the safety case.
Option 3: change the technology or architecture to a type A element with adequate SFF and HFT, if technically feasible. Each option needs revised SIL verification, common-cause beta justification, systematic capability evidence, proof-test analysis, and an update to the safety requirements specification. The final element and logic solver also need to be confirmed as SIL 3 capable, because the function is only as good as its weakest element.
3. The supplier says the PFDavg is below 1E-4, so it is SIL 4. How do you respond?
Read the worked answer
The arithmetic is wrong first: 2.2E-4 is greater than 1E-4, so it is in the SIL 3 band, not the SIL 4 band. SIL 4 requires PFDavg between 1E-5 and 1E-4. More importantly, selecting a SIL from a single PFD number is not a valid verification. The SIL claim must satisfy the architectural constraints, systematic capability, proof-test requirements and the safety requirements specification. For this type B, HFT 1, SFF 85% element, the architectural maximum is SIL 2 regardless of how low the calculated PFDavg appears.
I would also test the sensitivity of the result to the beta factor and proof-test interval. A beta of 10% is an assumption; if common cause is higher, the PFDavg rises quickly. The supplier should present the failure data source, the beta justification, the proof-test coverage and the diagnostic coverage. The safety case should state the achieved SIL as the minimum of the PFD result, the architectural limit and the systematic capability, not as the most favorable number.