🎓 Lesson 9
D5
SIL Verification Math: PFDavg, Spurious Trip, and Proof Test Coverage
SIL verification math checks how reliably a safety system will stop a dangerous event—and how often it might accidentally shut things down when it shouldn’t.
🎯 Learning Objectives
- ✓ Calculate PFDavg for a 1oo2 voting SIF using failure rate data and proof test intervals
- ✓ Analyze the impact of proof test coverage (β) on PFDavg and SIL achievability
- ✓ Explain the trade-off between spurious trip rate and functional safety performance
- ✓ Apply IEC 61508/61511 equations to verify SIL 2 compliance for a pressure relief SIF
- ✓ Design proof test strategies that maximize β while minimizing process disruption
📖 Why This Matters
In mining and blasting operations, a failed pressure sensor or stuck valve in a detonation control system could allow over-pressurization—or worse, premature initiation. SIL verification math isn’t just paperwork: it’s the quantitative proof that your safety system won’t fail when lives and infrastructure depend on it. Regulatory bodies (e.g., MSHA, OSHA) and insurers increasingly require documented PFDavg calculations—not just 'it’s safe'—before approving automated blast initiation systems.
📘 Core Principles
Safety Instrumented Systems (SIS) are independent layers of protection designed to reduce risk to tolerable levels. SIL verification rests on three interdependent pillars: (1) PFDavg—the average probability the SIF fails *to act* when demanded; (2) Spurious Trip Rate (STR)—the frequency the SIF shuts down *unnecessarily*, risking production loss or hazardous transients (e.g., sudden venting during confined-blast sequencing); and (3) Proof Test Coverage (β)—the fraction of dangerous failures detected and corrected by periodic manual or automatic tests. Crucially, β is not binary: partial coverage (e.g., 60–90%) dominates real-world systems due to undetectable latent faults (e.g., corrosion under insulation, drift in analog transmitter zero). Diagnostic coverage (DC) from built-in self-tests complements—but does not replace—proof testing.
📐 Key Calculation
For a simplex (1oo1) SIF with proof testing, PFDavg is approximated using the low-demand formula from IEC 61508-6 Annex D. For redundant architectures like 1oo2, the formula incorporates common cause failure (α) and proof test coverage (β). This version assumes constant failure rates, perfect diagnostics for safe failures, and exponential failure distributions.
💡 Worked Example
Problem: A 1oo2 pressure-safety SIF uses two identical pressure transmitters (λDU = 4.2 × 10⁻⁶ /hr, λDD = 1.8 × 10⁻⁶ /hr), one logic solver (λDU = 2.0 × 10⁻⁶ /hr, λDD = 0.8 × 10⁻⁶ /hr), and one final element (valve, λDU = 3.5 × 10⁻⁶ /hr, λDD = 2.2 × 10⁻⁶ /hr). Proof test interval τ = 4380 hr (6 months), β = 0.85, α = 0.05 (IEC 61508 β-factor model). Calculate PFDavg.
1.
Step 1: Compute total dangerous undetected failure rate per channel: λDU_total = 4.2 + 2.0 + 3.5 = 9.7 × 10⁻⁶ /hr
2.
Step 2: Compute total dangerous detected failure rate per channel: λDD_total = 1.8 + 0.8 + 2.2 = 4.8 × 10⁻⁶ /hr
3.
Step 3: Apply IEC 61508-6 Eq. D.8 for 1oo2: PFDavg ≈ (1/3) × λDU_total × τ × (1 − β) + (α/2) × λDU_total × τ
4.
Step 4: Plug in values: PFDavg ≈ (1/3)(9.7e−6)(4380)(1−0.85) + (0.05/2)(9.7e−6)(4380) = 0.000212 + 0.001063 = 0.001275
Answer:
PFDavg = 1.28 × 10⁻³, which satisfies SIL 2 (PFDavg ≤ 1.0 × 10⁻²) with margin.
🏗️ Real-World Application
At Newmont’s Boddington Gold Mine (Western Australia), a SIL 2-compliant blast initiation interlock system was verified using this methodology. The SIF monitors borehole charge temperature and oxygen concentration before firing. Initial modeling showed PFDavg = 0.014 (just outside SIL 2) due to low β (0.62) on legacy thermocouple assemblies. Engineers upgraded to smart transmitters with partial stroke testing (PST) and added quarterly functional proof tests—raising β to 0.91 and reducing PFDavg to 0.0078. Crucially, STR was simultaneously reduced from 1.2/year to 0.3/year by eliminating nuisance alarms via improved signal filtering—demonstrating the dual objective of SIL verification.
📋 Case Connection
📋 Ammonia Refrigeration System HAZOP & LOPA Integration at Midwest Food Processing Plant
Unplanned releases during maintenance due to undocumented isolation points and missing P&IDs
📋 Offshore LNG Transfer System Fault Tree Analysis and SIS Architecture Optimization
High consequence of LNG spill + ignition in congested maritime corridor; existing SIS used single-channel logic