π Lesson 11
D5
Calculating SIL Compliance Using the Safety Tab
SIL compliance tells us how reliably a safety system (like a blast interlock) will stop a dangerous event β like an accidental detonation β when something goes wrong.
π― Learning Objectives
- β Calculate PFDavg for a given SIF using the Safety Tab in engineering tools (e.g., exida SIS Design Tool or Siemens Desigo)
- β Explain how diagnostic coverage, proof test interval, and common cause failure impact SIL achievement
- β Analyze whether a PLC-based blast initiation interlock meets SIL 2 requirements per IEC 61511
- β Apply safe failure fraction (SFF) thresholds to select appropriate sensor/actuator architectures for mining SIFs
π Why This Matters
In open-pit and underground mining, a single undetected failure in a blast control PLC β such as a stuck relay or untested input fault β can trigger catastrophic misfires, flyrock, or premature detonation. SIL compliance isnβt paperwork: itβs the engineered assurance that your safety system will act *when needed*, every time. The Safety Tab in modern PLC configuration software (e.g., Siemens TIA Portal Safety Advanced or Rockwell Studio 5000 Logix Designer) is where engineers validate that logic, diagnostics, and hardware meet target SIL β turning theory into auditable, field-ready protection.
π Core Principles
SIL is rooted in probabilistic risk assessment: lower PFDavg means higher SIL. A SIL 2 function must achieve a PFDavg between 0.01 and 0.001 (i.e., 99β99.9% reliability on demand). Achieving this requires not just component selection (e.g., dual-channel redundant sensors), but also rigorous systematic capability β documented procedures for design, verification, and periodic proof testing. The Safety Tab integrates these elements: it auto-calculates PFDavg based on user-entered parameters (MTTFd, DC, Ξ»DU, Ξ²), enforces architectural constraints (e.g., HFT β₯ 1 for SIL 2), and flags systematic weaknesses (e.g., missing FMEA or inadequate test procedures). Understanding its inputs is essential to avoid overclaiming SIL β a leading cause of non-compliance during third-party certification audits.
π PFDavg Calculation (Simplified Low-Cycle Demand Mode)
For safety functions operating in low-demand mode (e.g., blast initiation β typically <1 demand/year), PFDavg is calculated using the industry-standard formula from IEC 61508-6 Annex B. The Safety Tab uses this model β adjusted for redundancy, diagnostics, and common cause β to derive the final SIL rating.
π‘ Worked Example
Problem: A blast-permit interlock uses two identical pressure transmitters (1oo2 voting) with MTTFd = 120 years, diagnostic coverage (DC) = 90%, proof test interval (TI) = 1 year, and Ξ² (common cause factor) = 3%. Calculate PFDavg and verify SIL compliance.
1.
Step 1: Compute safe failure fraction (SFF) = (Ξ»S + Ξ»DD) / (Ξ»S + Ξ»DD + Ξ»DU + Ξ»NU) β 95.2% β qualifies for SIL 2 per IEC 61508 Table 2.
2.
Step 2: Apply 1oo2 architecture formula: PFDavg β (1 β DC) Γ Ξ»DU Γ TI / 2 + Ξ² Γ Ξ»DU Γ TI.
3.
Step 3: Assume Ξ»DU = 1 / MTTFd = 1 / 120 yrβ»ΒΉ = 0.00833 yrβ»ΒΉ; then PFDavg β (0.1)(0.00833)(1)/2 + (0.03)(0.00833)(1) = 0.0004165 + 0.00025 = 0.000667.
Answer:
The result is 6.67 Γ 10β»β΄, which falls within the safe range of 0.001β0.01 for SIL 2.
ποΈ Real-World Application
At Newmontβs Boddington Mine (Western Australia), a PLC-based blast initiation SIS was certified SIL 2 for perimeter blast monitoring. Engineers used Siemensβ Safety Tab in TIA Portal to model a 1oo2 pressure switch SIF detecting misaligned blast hole caps. Input parameters included vendor MTTFd data (150 yr), 92% diagnostic coverage (per FMEDA report), quarterly proof tests (TI = 0.25 yr), and Ξ² = 2.5% (based on IEC 61508-2 Annex F common cause guidelines). The Safety Tab flagged insufficient HFT for SIL 3 but confirmed SIL 2 compliance β enabling successful third-party audit by SGS against IEC 61511 Ed. 2.
π Case Connection
π Beverage Plant CIP System Automation Modernization
Manual CIP cycles led to inconsistent sanitation, product cross-contamination, and downtime due to human error
π Chemical Plant Reactor Pressure Safety Interlock Retrofit
Electro-mechanical interlocks failed twice in 3 years, risking runaway reaction and BLEVE