The three barriers
A SIF must pass all three — not just the calculation
Most engineers equate SIL verification with the PFDavg calculation. That's only one of three independent checks — and a loop that fails any one of them fails the SIL claim, no matter how good the other two look.
1
Random hardware failure — PFDavg
The average probability that the SIF fails dangerously when a demand occurs, calculated from device failure rates, redundancy, and proof test intervals. Each SIL band sets a PFDavg range the whole loop — sensor, logic solver, final element — must meet together.
2
Architectural constraints — HFT
Hardware Fault Tolerance: how many dangerous failures the SIF can suffer and still perform its function. IEC 61511 sets a minimum HFT by SIL and demand mode — a SIL 3 SIF needs HFT ≥ 1, so no single dangerous failure can defeat it, regardless of how good the PFDavg number looks.
3
Systematic capability
Every device in the loop must be suitable for the target SIL against systematic (design) faults — either certified to IEC 61508 with a systematic capability rating at or above the target, or justified through prior use per IEC 61511 clause 11.5.
Pro members only
The full guide is part of Control Signal Pro
Pro members get every deep-dive guide, plus the dashboard, asset register, and CVE alerts matched to the equipment they actually run. Sign in to upgrade, or start with a free account.