ข้ามสารบัญไปยังเนื้อหา
อัปเดต 2026-09-07
SIL verification (IEC 61508)
PFDavg + architectural constraint
Verifies a safety instrumented function two ways at once, per IEC 61508: the quantitative average probability of failure on demand (PFDavg) against a target SIL, AND the architectural-constraint cap from hardware fault tolerance and safe-failure fraction — so a good PFDavg number can never silently overclaim a SIL the hardware doesn't support.
เมื่อไรจึงใช้
- A LOPA gap analysis calls for a new or upgraded SIF and you need to verify it actually meets the target SIL.
- Auditing an existing SIF's claimed SIL against its real component data and proof-test interval.
- Comparing lumped vs. subsystem-level credit for the same SIF architecture.
ค่าที่ต้องกรอก
| ค่า | คำอธิบาย |
|---|---|
| Component λD & diagnostic coverage | Dangerous failure rate and diagnostic coverage per element — from the FMEDA library or a vendor certificate. |
| Proof-test interval | How often the SIF is fully tested; the dominant lever on PFDavg. |
| Element type & voting | Type A (simple) vs Type B (complex) per IEC 61508-2, and the voting architecture (1oo1, 1oo2, 2oo3, 1oo2D…). |
คำนวณอย่างไร
PFDavg is computed per IEC 61508-6 Annex B from failure rate, proof-test interval, and diagnostic coverage; the achieved SIL is the LOWER of the PFDavg-implied SIL and the IEC 61508-2 Route 1H architectural-constraint cap for the element's type and hardware fault tolerance.
สมการ
Low-demand PFDavg (single channel)
λ_DU = dangerous-undetected failure rate, T_proof = proof-test interval. The full model also folds in diagnostic coverage and MTTR per IEC 61508-6 Annex B.
Achieved SIL
SIL_architectural comes from the IEC 61508-2 Route 1H SFF/HFT table for the element's Type A/B classification — the hard cap a good PFDavg number cannot exceed.
ข้อควรระวัง
noteVerifying only PFDavg without the architectural-constraint cap is a common and dangerous over-claim — DekEn always reports the capped (lower) figure.
ที่เกี่ยวข้อง