Advertisement Feature Cover Story
Understanding ‘SIL’ Certificates
roduct certificates of confor-
P mity to IEC 61508 (or related
standards) often vary greatly
due to different certification
bodies following their own assess-
ment methods and certificate for-
mats. The SIL is actually a
dependability measure of the overall
safety function being performed by a
specific safety system (from sensor
to actuator).
However, most certificates are
issued for mass produced devices (for
example temperature sensors, trip
amplifiers, PLCs, valves, etc), so it is
important to understand what critical
attributes of a device need to be stated
on a certificate to indicate it’s suitabil-
ity in SIL rated safety functions. For
example, it is not just the probabilistic
failure data that is important - many
other factors of a device can lead to
system failure. Furthermore, any men-
tion of a SIL number on a device cer-
tificate must be highly dependent on
conditions and assumptions about the
overall safety system and the other
devices in it.
Actually, IEC 61508 does not men-
tion the requirement for a certificate,
but rather it requires a Functional
Safety Assessment (FSA), so it is
important that certification covers all
the requirements of a FSA (see IEC
61508-1 clause 8). For product FSAs
(and hence product certificates) it is
essential that all the information the
user of the product requires is cov-
ered. The FSA report (on which a cer-
tificate is based) should itself be
auditable, i.e. all relevant clauses
from IEC 61508 should be traceable.
Furthermore, the process by which
the FSA has been conducted should
comply with IEC 61508, namely the
independence, competence and the
tools/procedures of the assessment
body. A certification body which has
the relevant parts of IEC 61508 in its
scope of accreditation will ensure
this is the case.
Where is certification useful
Certification is particularly suitable
for mass produced devices where it
provides evidence of the FSA by an
8 SUMMER 2011 Industrial
In recent years there has been an increasing number of Safety Integrity Level
(‘SIL’) product certificates to IEC 61508 and related standards. Paul Reeve,
Sira Certification’s principal functional safety consultant, explains the purpose
and benefits of such certificates whilst pointing out the necessity to take care
in understanding the finer points of what is (and what is not) being certified
independent and trusted body that
declares that the product complies
with the standard (for a specified
scope). Of course, the manufacturer
may also be using the certificate as a
marketing document.
However, the user should be compe-
tent in understanding functional safety
data rather than being satisfied with a
SIL capability claim. This can be illus-
trated by considering the following
real example.
Certificate to
IEC 61508
D = 2.3 x 10 per hour
-10
PFD = 2.0 x 10-7
MTTF (dangerous) = 500,000 yrs
MTBF (total) = 5,000 yrs
Achieves SIL4 per IEC 61508
Comparison of these figures with
others for similar devices shows it
claims to be several orders of magni-
tude better. Experience says that it
would be unwise to accept such fig-
ures at face value without asking some
searching questions.
Another example where caution is
advised is where a certificate states
‘SIL3 @HFT=1’. An HFT
of 1 means that you need
two devices to achieve
SIL3 capability. But you
don’t need a certificate
to tell you that - the stan-
dard tells you what SIL
is achievable when
using redundant
devices. Reading the cer-
tificate more carefully
reveals the device is
actually SIL2 capable -
So the certificate can
easily be misunderstood
by the unwary reader whose eye is
caught with the words ‘SIL3’.
The SIL capability of an instru-
ment is an important parameter but
there are dangers in putting a SIL
number as a ‘headline’ on the certifi-
cate, as once a SIL capability is
stated, there is a tendency to ignore
Below: there are the rest of the certificate.
dangers in putting a
SIL number as a
‘headline’ on the
certificate as once a
SIL capability is
Whilst SIL is a parameter of the
safety function performed by a safety
instrumented system (sensor to final
element) rather than the individual
elements, the 2010 version of IEC
stated, there is a 61508 has created the term
tendency to ignore ‘Systematic Capability’ of an element
the rest of (SC1 to SC4), which corresponds to
the certificate SIL1 to SIL4 capability respectively.
The SC <number> refers to the rigour
of the documentation and quality
process used throughout the prod-
uct’s development to avoid system-
atic failures.
What should be certified?
In order to engineer a safety func-
tion, the system designer needs to
know certain information about the
constituent instruments (in relation
to use in safety functions), in partic-
ular the hardware safety integrity
(numerical failure data
/HFT/SFF/type), and the systematic
safety integrity (measured by the SC
number). Both of these have to meet
the SIL for the device to be capable
at that SIL.
Terms ‘safe failure’, ‘dangerous fail-
ure’ and hence the ‘safe failure frac-
tion’ for an instrument are only
relevant when there is knowledge of
the target application. For example, if
TO OPEN = 50 FITS, TO CLOSE = 500 FITS.
Then, SFF is either 50/(50+500) = 9%,
or 500/(50+500) = 91%.
So the SFF depends on whether fail-
ure to open or to close is the ‘safe’ mode.
Where devices have internal hard-
ware fault tolerance (HFT), is the cer-
Compliance
 Advertisement Feature Cover Story

tificate clear about how are faults in Right: An example plied with. These might be condi-
one channel detected and reported? certification tions for the manufacturer and/or for
What is the channel Mean Down scheme is CASS the end user regarding design modi-
Time (which must not be exceeded) (Conformity fications, action on failure, ongoing
for the failure data to be valid? Assessment of management of functional safety,
Accounting for the non-ideal inde- Safety related etc. Whether stated or not, it is cer-
pendence between channels? And, Systems) software, expect to see an explicit tainly the case that selection of
the proof test method needed to exer- statement of conformity in the certifi- equipment for use in safety func-
cise each channel independently? Below: for SIL cate. Remember that software failures tions and the installation, configura-
It has been noticed that some cer- product certificates are systematic rather than probabilis- tion, overall validation,
tificates use HFT=0 (1) meaning the it is important to tic. The certificate is a statement that maintenance and repair should only
normal HFT requirement (1 in this understand what is the software: be carried out by competent person-
case) is reduced by 1 (to 0 in this (and what is not), l Has been developed according to a nel, observing all the manufacturer’s
case) due to knowledge of probabilis- being certified compliant process (IEC 61508-3, clause conditions and recommendations in
tic failures from ‘prior use’ (although 7) and using appropriate techniques and the user documentation.
this is actually an approach accepted measures (IEC 61508-3, Annexes).
by IEC 61511 for end users rather l Assessment includes justification Choosing an assessor/certifier
than IEC 61508). for the development tool chain. As already stated, the assessment
Sources of component failure data If sufficient valid data is available process should comply with IEC
vary as they are often industry spe- (millions of operational hours) it is 61508-1 clause 8, so look for the
cific. The source should be stated and possible to use a statistical approach accreditation logo on the certificate
it is worth checking whether the (IEC 61508-7, Annex D), but the analy- which should ensure these require-
component failure rates are taken sis is not trivial. ments are met. An example certifica-
from a database appropriate for the It must be realised that especially tion scheme is CASS (Conformity
intended location and application of when the certificate is based on pre- Assessment of Safety related
the instrument. How has the data dicted (FMEA) data, the ongoing life- Systems) which is unique in the fol-
been factored for the environmental cycle should be reviewed by lowing respects:
conditions? (If not stated, best to performing field failure analysis to l Open/transparent methodology
assume control room use only). Are
components used well within their
rating? (61508 mentions de-rating).
Are there certain components that
dominate the unit’s failure rate that
require special attention? (e.g. relays,
gas sensors, etc).
If Probability of Failure on Demand
(PFDAVG) is quoted for an instrument,
remember this is also governed by the
proof test interval.
Every compliant instrument
should have a ‘Safety Manual’ which
should be referenced in the certifi-
cate. It is critical to use the device
only in accordance with the Safety
Manual (the certified failure data is
usually invalid otherwise). It should
give any constraints in use and any
assumptions for which the failure
data is valid. Plus, it should cover
configuration, installation, mainte-
nance, operation, etc, to avoid sys-
tematic failures. Refer to IEC 61508-2,
ed 2, Annex D which gives specific
requirements for the Safety Manual.
In regard to mechanical devices, sys-
tematic failures are more dominant, so
expect the certificate to reference
information on avoiding these. confirm the actual failure rates are and framework for assessment to IEC
Generally speaking: no worse than those predicted. It 61508 (and sector standards).
l Constant failure rates are usually would be reasonable to expect condi- l Requirements are all in the public

very low. tions in the certificate that obligate: domain so there are no hidden surprises.
l Wear out faults may have a differ- l The end user to collect (see IEC l Originally a UK government
ent operational profile (no. of 60300-3-2) and feedback field failure funded initiative, designed by indus-
cycles) compared to electronic information to the manufacturer. try for industry.
devices (which tend to follow the l The manufacturer to analyse field l CASS is a collective interpretation

idealised time-based ‘bath tub’ pro- failures and take necessary action of IEC 61508 - this ensures the asses-
file more closely). (inform the certification body, notify sor’s ego is kept in check. (About 60
l Sources such as NPRD-2011 give users, etc). companies contributed).
real field data for thousands of compo-
nents, including the statistical basis Read the conditions Sira Certification
for each value. Most certificates have conditions of www.siracertification.com
For devices that include embedded certification which should be com- T: 01244 670 900

Industrial Compliance SUMMER 2011 9