Functional safety: SIL, probability of failure and common cause
Risk reduction, SIL levels, average PFD for 1oo1 and 1oo2 proved, the beta factor with an example, ISO 13849 and practical principles for machinery.
A press, a robot, a chemical reactor can kill. Functional safety concerns the control-system functions that protect people: the emergency stop, light curtains, safety interlocks on guards, automatic shutdowns of a process plant. Standards require proving with numbers how reliable these functions are. In this lesson we look at risk reduction and SIL integrity levels, the probability of failure on demand with the proofs for one channel and for two redundant channels, the decisive effect of common-cause failures with an example, and the standards for machinery.
Risk and integrity levels
Risk combines the severity of a harm and its probability. The process is always the same: identify the hazards, estimate the risk, reduce it first with inherently safe design (eliminate the hazard), then with safeguards, and only finally with information (warnings, training). When the reduction is entrusted to a function of the control system, the IEC 61508 standard (and the standards derived from it, IEC 61511 for the process industry, IEC 62061 for machinery) requires assigning it a safety integrity level (SIL), from 1 to 4.
For functions that act rarely (low demand), the SIL is defined by the average probability of failure on demand (PFD):
| SIL | Average PFD | Risk reduction |
|---|---|---|
| 1 | from 10⁻² to 10⁻¹ | from 10 to 100 |
| 2 | from 10⁻³ to 10⁻² | from 100 to 1000 |
| 3 | from 10⁻⁴ to 10⁻³ | from 1000 to 10,000 |
| 4 | from 10⁻⁵ to 10⁻⁴ | from 10,000 to 100,000 |
Dangerous undetected failures
A safety function stays inactive for months; a failure may remain hidden until it is needed. What counts are the dangerous undetected failures, with rate 
: those that would prevent the action and that automatic diagnostics do not detect. Only a complete proof test every 
finds them, after which the function is considered as good as new.
Theorem. For a single channel (1oo1 architecture) with 
, the average probability of failure on demand is
![\[ PFD_{avg} \approx \frac{\lambda_{DU}T}{2} \]](https://www.electronics-engineering.com/wp-content/ql-cache/quicklatex.com-584e416db5e80cf99b5155d65182acb4_l3.png "Rendered by QuickLaTeX.com")
Proof. With a constant failure rate, the probability that the channel has failed at time 
after the test is 
(lesson on probability). A demand can arrive at any instant of the interval with equal probability, so we take the average:
![\[ PFD_{avg} = \frac{1}{T}\int_0^T\lambda_{DU}t\,dt = \frac{\lambda_{DU}T}{2} \]](https://www.electronics-engineering.com/wp-content/ql-cache/quicklatex.com-a780930393a9a25a467fb242807e8324_l3.png "Rendered by QuickLaTeX.com")
∎
Theorem. For two independent channels, either of which is enough to act (1oo2 architecture),
![\[ PFD_{avg} \approx \frac{(\lambda_{DU}T)^2}{3} \]](https://www.electronics-engineering.com/wp-content/ql-cache/quicklatex.com-064c8c27f80c406c8025c65392656da5_l3.png "Rendered by QuickLaTeX.com")
Proof. The function fails only if both channels have failed; with independent failures the probability at time is 
. The average over the interval is 
. ∎
Common cause
Example. A shutdown pressure switch with 
/h, tested once a year (
h): 
, SIL 2. Duplicating it in 1oo2, the formula gives 
: it would seem to be SIL 4.
But the two pressure switches are identical, mounted on the same tapping, calibrated by the same person: a calibration error, a blockage, a surge put them out of service together. The beta factor 
is the fraction of failures that hit all channels through a common cause, and that part behaves like a single channel: 
is added. With 
%, the term is 
, ten times the independent term, and the function is SIL 3, not 4. Redundancy is useful, but common-cause failures limit its benefit: they are fought with diversity (sensors of different principles or manufacturers), physical separation, staggered maintenance procedures.
Another way to reduce PFD is to shorten the test interval or to increase diagnostic coverage, turning undetected failures into detected ones, which bring the plant to a safe state.
Machinery
For machinery the ISO 13849 standard is often used, which classifies safety functions into performance levels (PL a to e) based on the category of the architecture (B to 4: from a simple single channel to two channels with diagnostics detecting every single fault), the mean lifetime of the components and the diagnostic coverage. The required level is derived from the risk graph: severity of injury, frequency of exposure, possibility of avoiding the hazard.
Some practical principles:
- the emergency stop is a complementary measure, it does not replace safeguards; it has priority over everything and requires a manual reset;
- safety contacts with positive opening: the contact is opened mechanically even if it welds;
- safety circuits work on the closed-circuit principle: a cut wire leads to the safe state, like the live zero of 4-20 mA (lesson on sensors);
- certified safety PLCs are used, with dual processors and diagnostics, and safety input and output modules; the safety program is separate from the functional one and protected against changes.
In Europe the general requirements are set by the Machinery Directive, replaced by Regulation (EU) 2023/1230 applicable from 2027.
