LOPA & SIL — Functional Safety Fundamentals

1. Layers of Protection

Process safety uses defence in depth: a hazard scenario is met by successive independent protection layers (IPLs) — process design, the basic process control system (BPCS), alarms with operator response, the safety instrumented system (SIS), relief devices, and physical containment/mitigation. LOPA (Layer of Protection Analysis) is the semi-quantitative method, defined by CCPS, that checks whether the credited layers reduce a scenario's risk to a tolerable level — and, if not, how much additional risk reduction the SIS must provide. That required reduction becomes the SIL target for the safety instrumented function (SIF).

2. LOPA Arithmetic

For one cause-consequence pair, the mitigated event frequency is the initiating-cause frequency multiplied by the probability of failure on demand of every independent layer that can stop that scenario:

This is compared to the owner's tolerable frequency for that consequence severity. If f_mitigated is still too high, the gap is closed by a SIF whose required PFD_avg = tolerable frequency ÷ (residual frequency without the SIF). The reciprocal of that PFD is the required risk reduction factor (RRF), which maps to a SIL.

3. What Qualifies as an IPL

CCPS requires every credited IPL to be independent of the initiating cause and of the other layers, specific (capable of detecting and acting on the scenario), dependable (its claimed PFD is justified), and auditable. A BPCS control loop and a SIF that share the same sensor or final element are not independent and cannot both be credited. Typical credited PFDs: a well-engineered BPCS loop ~1×10⁻¹ (≤ one credit per IEC 61511), a relief valve ~1×10⁻², an operator response to an independent alarm ~1×10⁻¹ (with adequate time).

4. SIL Bands & Risk Reduction Factor

IEC 61508/61511 define SIL by the average probability of failure on demand for low-demand mode (demand ≤ once/year, the normal process case):

SIL	PFDavg (low demand)	Risk reduction factor (RRF = 1/PFD)
1	≥ 10⁻² to < 10⁻¹	10 – 100
2	≥ 10⁻³ to < 10⁻²	100 – 1,000
3	≥ 10⁻⁴ to < 10⁻³	1,000 – 10,000
4	≥ 10⁻⁵ to < 10⁻⁴	10,000 – 100,000

SIL 4 is rarely used in the process sector; IEC 61511 effectively expects SIL 4 needs to be designed out. Note the inequality direction — a smaller PFD is a higher SIL.

5. PFDavg & Proof Testing

For a simple non-redundant (1oo1) subsystem dominated by undetected dangerous failures, the average probability of failure on demand over a proof-test interval TI is approximately:

where λ_DU is the dangerous-undetected failure rate. The whole SIF PFD is the sum of sensor, logic-solver and final-element subsystem PFDs (the final element usually dominates). Two levers improve PFD: shorter proof-test interval and redundancy (e.g. 1oo2 voting), the latter limited by common-cause failure (the β-factor). Because PFD scales with TI, the proof-test interval is a safety-critical assumption, not an operations convenience.

6. Architectural Constraints

Meeting the PFD target numerically is necessary but not sufficient. IEC 61508/61511 also impose architectural constraints — a minimum hardware fault tolerance (HFT) tied to the safe-failure-fraction (SFF) or to the device's route 2H proven-in-use/reliability data — and systematic-capability requirements on the design process. A device can be excluded from a given SIL by these constraints even if its computed PFD looks adequate.

7. References

• IEC 61511 (Parts 1–3) — Functional safety: Safety instrumented systems for the process industry sector.
• IEC 61508 (Parts 1–7) — Functional safety of E/E/PE safety-related systems (base standard; SIL tables, SFF/HFT).
• ANSI/ISA-84.00.01 — US adoption of IEC 61511.
• CCPS — Layer of Protection Analysis: Simplified Process Risk Assessment (2001); Guidelines for Initiating Events and Independent Protection Layers (2015).