SIL Verification for Safety Relays: A Rigorous Technical Guide for Functional Safety Engineers

What Is This Calculation—and Why It Matters

SIL (Safety Integrity Level) verification is the quantitative demonstration that a safety instrumented function (SIF)—such as a safety relay logic solver—meets its target risk reduction requirement, as defined by IEC 61508 and IEC 62061. For electromechanical or solid-state safety relays used in machinery or process safety applications, this verification centers on calculating two core metrics: the Average Probability of Failure on Demand (PFDavg) and the Diagnostic Coverage (DC).

Unlike generic reliability analysis, SIL verification is safety-critical: it directly determines whether a safety function can credibly reduce risk to an ALARP (As Low As Reasonably Practicable) level. A safety relay failing undetected during a hazardous event—e.g., a press brake not stopping when a light curtain is breached—can result in catastrophic injury or equipment loss. PFDavg quantifies that latent risk; DC reveals how effectively the relay’s internal diagnostics (e.g., coil monitoring, contact supervision, cross-wiring checks) catch dangerous faults before demand occurs. Without rigorous verification, certification bodies (e.g., TÜV, exida) will reject SIF validation, halting commissioning and exposing operators to regulatory noncompliance (e.g., under EU Machinery Directive 2006/42/EC or OSHA 1910.119).

This calculation is not optional engineering overhead—it is a mandatory deliverable in the safety lifecycle (IEC 61508-1, Clause 3.2.17), required during the realization and operation phases to close the loop between design intent and field performance.

Theory and Formula Walkthrough

The SIL Verification Calculator implements two interdependent equations derived from IEC 61508-6 Annex B and IEC 62061 Annex D. These models assume periodic proof testing with staggered intervals—a realistic representation of maintenance schedules where tests may be aligned with production cycles or shutdown windows.

1. Average Probability of Failure on Demand (PFDavg)

For a safety relay with multiple proof test intervals (t₁, t₂, t₃, t₄), the PFDavg is computed using a time-weighted average over the full test cycle (T = t₄), accounting for both undetected and detected dangerous failures:

$$ \text{PFD}{\text{avg}} = \frac{1}{T} \left[ \int_0^{t_1} \lambda{du} \cdot t , dt + \int_{t_1}^{t_2} \lambda_{du} \cdot (t - t_1) , dt + \int_{t_2}^{t_3} \lambda_{du} \cdot (t - t_2) , dt + \int_{t_3}^{t_4} \lambda_{du} \cdot (t - t_3) , dt + \sum_{i=1}^{4} \lambda_{dd} \cdot \frac{(t_i)^2}{2} \right] $$

Simplifying yields the closed-form expression implemented in the calculator:

$$ \text{PFD}{\text{avg}} = \frac{\lambda{du}}{2} \cdot \frac{t_1^2 + (t_2 - t_1)^2 + (t_3 - t_2)^2 + (t_4 - t_3)^2}{t_4}

• \frac{\lambda_{dd}}{2} \cdot \frac{t_1^2 + t_2^2 + t_3^2 + t_4^2}{t_4} $$

Variable Interpretation:

• λ_du (Dangerous Undetected Failure Rate, units: /hour): Failures that compromise safety and evade detection by diagnostics or proof tests (e.g., welded contacts in a normally open safety channel). This dominates PFDavg and must be sourced from certified failure databases (e.g., exida FMEDA, OREDA) or manufacturer data with documented confidence bounds (IEC 61508-2, Table A.4).
• λ_dd (Dangerous Detected Failure Rate, /hour): Dangerous failures detected by diagnostics (e.g., self-test identifying coil open-circuit) and repaired before demand. While less harmful, they contribute to spurious trips and maintenance burden.
• t₁, t₂, t₃, t₄: Cumulative proof test intervals (hours). These define the test schedule, not necessarily equal periods. Real-world constraints (e.g., annual shutdowns at t₁ = 8,760 h, biannual at t₂ = 17,520 h) necessitate this staggered model. The final interval t₄ sets the overall test cycle duration T.

⚠️ Critical Note: Safe failure rates (λ_su, λ_sd) do not appear in PFDavg—they impact availability and nuisance trips but not safety integrity. Their inclusion in inputs supports DC calculation and system-level availability modeling.

2. Diagnostic Coverage (DC)

DC measures the effectiveness of automatic diagnostics in detecting dangerous failures:

$$ \text{DC} = \frac{\lambda_{dd}}{\lambda_{dd} + \lambda_{du}} \times 100% $$

Variable Interpretation:

• λ_dd and λ_du are as defined above. DC is dimensionless and expressed as a percentage.
• IEC 61508-2 (Table A.6) and IEC 62061 (Table D.1) assign DC categories: Low (0–60%), Medium (60–90%), High (90–99%). A typical dual-channel safety relay with cross-monitoring achieves DC ≥ 90%—a prerequisite for SIL 3 per IEC 62061 Clause 5.3.2.

Standard Requirements: Citations and Compliance

SIL verification must align with normative clauses—not just informative annexes:

• IEC 61508-2:2010, Clause 7.4.4.2: "The PFDavg shall be calculated using a method consistent with the assumptions of the safety life cycle… [and] shall take into account systematic capability, hardware fault tolerance, and diagnostic coverage." The calculator’s use of λdu/λdd and explicit DC derivation satisfies this.

• IEC 61508-2:2010, Table A.2: Defines maximum allowable PFDavg per SIL: SIL 1 (10−2–10−1), SIL 2 (10−3–10−2), SIL 3 (10−4–10−3). A PFDavg of 2.1 × 10−4 meets SIL 3 only if all other requirements (e.g., HFT ≥ 1, systematic capability SC2) are fulfilled.

• IEC 62061:2021, Clause 5.3.2: "The diagnostic coverage shall be determined by analysis… considering the type of diagnostics, their coverage, and the probability of failure modes." The calculator’s DC output must be justified by FMEDA evidence—not assumed.

• IEC 62061:2021, Annex D.2.2: Explicitly permits multi-interval proof testing models for systems with non-uniform maintenance schedules, validating the t₁–t₄ input structure.

Failure to cite these clauses—or to trace calculations to them—invalidates audit trails during third-party certification.

Common Mistakes and How to Avoid Them

1. Using Generic Failure Rates Without Traceability

Mistake: Substituting textbook λ values (e.g., “10−6/h for relays”) without referencing a specific FMEDA report tied to the exact relay model, firmware version, and operating environment. Fix: Always use manufacturer-provided FMEDA data (e.g., Pilz PNOZmulti, Siemens Sirius 3SK1) with documented confidence levels (IEC 61508-2, Annex F). Apply environmental derating factors (e.g., +50% λ for high-vibration zones per IEC 61508-2, Table A.7).

2. Misinterpreting Proof Test Intervals

Mistake: Setting t₁ = 8760, t₂ = 8760, t₃ = 8760, t₄ = 8760 (implying four annual tests), then misreading t₄ as the cycle length. This incorrectly assumes tests occur at 0, 8760, 17520, 26280, and 35040 hours—yet calculates PFDavg over only 8760 h. Fix: t₄ is the total cycle duration. If tests occur annually, set t₁ = 8760, t₂ = 17520, t₃ = 26280, t₄ = 35040. The denominator in PFDavg is always t₄.

3. Ignoring Safe Failure Contributions to DC

Mistake: Assuming λ_su and λ_sd influence DC. They do not—the numerator and denominator in DC contain only dangerous failure rates. Fix: Use λ_su/λ_sd solely for availability calculations (e.g., MTBF) or to validate that safe failures don’t mask dangerous ones (a systematic error per IEC 61508-2, Clause 7.4.2.3).

4. Overlooking Diagnostic Coverage Validation

Mistake: Reporting DC = 95% without evidence that diagnostics detect all dangerous failure modes (e.g., tracking contact wear, insulation degradation, or common-cause failures). Fix: Require FMEDA showing DC ≥ 90% for each dangerous failure mode (e.g., “welded NO contact: DC = 98% via contact resistance monitoring”). Cross-check against IEC 62061 Table D.1 test coverage requirements.

5. Neglecting Uncertainty Propagation

Mistake: Reporting PFDavg = 1.82 × 10−4 without stating uncertainty (e.g., ±35% at 90% confidence). Fix: Perform Monte Carlo analysis on λ inputs using beta distributions (IEC 61508-2, Annex F) and document confidence bounds. SIL claims require PFDavghigh ≤ SIL target.

Worked Example with Realistic Numbers

Scenario: A Pilz PNOZ X1 safety relay (dual-channel, category 4, DC = 95%) protects a robotic cell. FMEDA data (certified by TÜV Rheinland, Report #PNOZ-X1-FMEDA-2023) provides:

• λ_du = 3.2 × 10−6 /h
• λ_dd = 1.4 × 10−5 /h
• λ_su = 8.1 × 10−6 /h
• λ_sd = 2.7 × 10−5 /h

Proof testing is scheduled at:

• t₁ = 8,760 h (1 year)
• t₂ = 17,520 h (2 years)
• t₃ = 26,280 h (3 years)
• t₄ = 35,040 h (4 years)

Step 1: Calculate DC
$$ \text{DC} = \frac{1.4 \times 10^{-5}}{1.4 \times 10^{-5} + 3.2 \times 10^{-6}} \times 100% = \frac{1.4 \times 10^{-5}}{1.72 \times 10^{-5}} \times 100% = 81.4% $$ → DC = 81.4% (Medium coverage; acceptable for SIL 2, insufficient for SIL 3 without HFT enhancement).

Step 2: Calculate PFDavg
First compute interval squares:

• t₁² = (8,760)² = 7.674 × 107
• (t₂ − t₁)² = (8,760)² = 7.674 × 107
• (t₃ − t₂)² = (8,760)² = 7.674 × 107
• (t₄ − t₃)² = (8,760)² = 7.674 × 107
• Sum of squared intervals = 4 × 7.674 × 107 = 3.070 × 108
• Sum of tᵢ² = 7.674×10⁷ + 3.070×10⁸ + 6.927×10⁸ + 1.228×10⁹ = 2.215 × 10⁹

Now apply formula:
$$ \text{PFD}_{\text{avg}} = \frac{3.2 \times 10^{-6}}{2} \cdot \frac{3.070 \times 10^8}{35,040}

• \frac{1.4 \times 10^{-5}}{2} \cdot \frac{2.215 \times 10^9}{35,040} $$ $$ = (1.6 \times 10^{-6}) \cdot (8,760) + (7.0 \times 10^{-6}) \cdot (63,220) = 0.0140 + 0.4425 = 0.4565 \times 10^{-3} = \mathbf{4.57 \times 10^{-4}} $$

Result: PFDavg = 4.57 × 10−4, DC = 81.4%.

SIL Assessment:

• PFDavg falls within SIL 2 range (10−3–10−2) but exceeds SIL 3 upper bound (10−3).
• DC = 81.4% is Medium—insufficient for SIL 3 (requires High DC ≥ 90% per IEC 62061 Table D.1).
  → Conclusion: The SIF achieves SIL 2. To reach SIL 3, either improve DC (e.g., add external contact monitoring) or reduce λdu (e.g., select a relay with higher inherent reliability).

Final Recommendations

1. Trace every input: Log FMEDA report IDs, environmental derating factors, and test schedule rationale.
2. Validate DC empirically: Conduct diagnostic coverage validation tests per IEC 61508-6, Annex C.
3. Re-run quarterly: Update λ values with field failure data (e.g., via MOC procedures).
4. Document uncertainty: Report PFDavg with 90% confidence bounds—not just point estimates.
5. Integrate with PHA: Feed PFDavg results back into Layer of Protection Analysis (LOPA) to verify risk reduction targets.

SIL verification is not a one-time math exercise—it is the quantitative heartbeat of functional safety. When performed rigorously, it transforms a safety relay from a component into a provably trustworthy guardian of human life.