SIL Verification Calculations per IEC 61511

SIL verification begins with recognizing that safety functions operate under two distinct demand modes: low-demand (e.g., emergency shutdown triggered <1x/year) and continuous (e.g., burner management system operating constantly). For low-demand, PFDavg is the core metric — it quantifies the long-term average chance the SIF won’t act when called. This depends not just on component failure rates, but critically on how well those failures are detected and corrected.

The calculation framework relies on architecture modeling: a 2oo3 voting system isn’t simply 'twice as safe' as 1oo2 — it trades higher hardware fault tolerance against increased complexity and common cause vulnerability. Diagnostic coverage (DC) determines what fraction of dangerous failures become visible before demand; without sufficient DC, proof tests become the only line of defense — and their effectiveness hinges on rigor, frequency, and completeness.

Advanced verification incorporates uncertainty propagation: λDU values carry ±30–50% statistical uncertainty, and β estimates vary by orders of magnitude depending on implementation quality. Leading practitioners use Monte Carlo simulation (not just simplified equations) when architectures exceed 2oo3 or when field data is sparse. They also mandate 'verification boundary reviews' — ensuring all elements inside the SIF (e.g., marshalling cabinet terminations, isolation valve position feedback wiring) are included in the model, not just the certified devices.