- SIL (Safety Integrity Level) is a property of a safety instrumented function, not a single valve — the complete SIF (sensor + logic solver + final element, including the valve and actuator) must achieve the required PFD target for the SIL level; a SIL 2-certified valve in a poorly designed SIF does not make the SIF SIL 2.
- IEC 61511 places specific demands on valve selection, proof testing, and maintenance documentation — the standard requires the PFD of the entire SIF to be calculated using actual failure rate data for all components, and the valve assembly (valve body, actuator, solenoid valve) represents a significant contributor to the overall SIF PFD.
- Common cause failure (CCF) and systematic failure considerations are as important as random hardware failure rates in SIL assessments — two redundant ESD valves on the same instrument air supply fail for a common cause when the air supply fails; this must be accounted for in the SIF architecture, and is often missed in simplified SIL calculations.
Functional safety is a topic that attracts more confusion than almost any other in process plant engineering. People talk about “SIL 2 valves” as if SIL were a product specification you can buy off a shelf. It isn’t — SIL is a performance requirement for a complete safety function, and achieving it requires a systems engineering approach that considers every component in the loop and how it fails. Let me explain what IEC 61511 actually requires and what it means for valve specification and management.
IEC 61511 Framework: The Three-Layer Model
IEC 61511 (Functional Safety: Safety Instrumented Systems for the Process Industry Sector) defines the requirements for safety instrumented systems (SIS) in the process industries. The standard applies to the complete lifecycle from hazard analysis through design, installation, operation, maintenance, and decommissioning.
The SIS consists of safety instrumented functions (SIFs). Each SIF is a complete safety function that detects a hazardous condition and takes action to prevent or mitigate it. A typical SIF might be: “On high-high level in reactor vessel, close the feed control valve and send an alarm to the operator.” The SIF includes: the level transmitter (sensor), the SIS logic solver (PLC or relay system), and the feed control valve with solenoid valve (final element).
A SIL (Safety Integrity Level) of 1, 2, 3, or 4 is assigned to each SIF based on the HAZOP/SIL assessment, representing the required risk reduction factor (SIL 1 = 10×, SIL 2 = 100×, SIL 3 = 1000×, SIL 4 = 10,000×). The Probability of Failure on Demand (PFD) of the complete SIF must be within the SIL target range: SIL 1 = 0.1–0.01, SIL 2 = 0.01–0.001, SIL 3 = 0.001–0.0001.
What Makes a Valve “SIL-Capable”
For a valve (and associated actuator, solenoid valve) to be used in a SIL-rated SIF, the following must be demonstrated:
Failure Rate Data
The PFD calculation requires quantitative failure rate data for all components. For the valve assembly, this means: the dangerous undetected failure rate (λDU) of the valve body (failure to close), the solenoid valve (failure to trip), and the actuator (failure to deliver required force). Data sources:
- Proven in use (PIU) data: field failure rate data from actual installations of the specific valve design in similar service; the preferred data source per IEC 61508 when sufficient installation hours are available
- IEC 61508 certified devices: the component has been independently assessed to IEC 61508, with certified safe failure fraction (SFF), dangerous detected failure rate (λDD), and dangerous undetected failure rate (λDU); the certification documentation supports the SIL capability claim
- Reliability databases: generic databases (OREDA, EXIDA SERH, IEEE 493) provide failure rate estimates; less preferred than PIU data but acceptable when PIU data is insufficient
Safe Failure Fraction (SFF)
The SFF (proportion of failures that are safe or detected dangerous) determines the maximum achievable SIL level for a Type B (complex) component in a given architectural configuration. Most control valve assemblies with smart positioners have SFF in the range 60–90%, which (for Type B components) limits single-channel architectures to SIL 1 or SIL 2. For SIL 3 final elements, 1oo2 (one-out-of-two) or 2oo3 redundant valve configurations are typically required.
Systematic Capability
Beyond random hardware failures, the valve design must be assessed for systematic failures — failures due to design flaws, manufacturing errors, or installation errors. IEC 61508 uses Systematic Capability (SC) ratings (SC 1–3) to represent the systematic failure claim. SIL 2 SIFs require SC 2 systematic capability as a minimum for all components.
Valve Proof Testing for Functional Safety
IEC 61511 requires that SIS components are proof tested at defined intervals to detect unrevealed failures (dangerous undetected failures that accumulate between tests). For valves, the proof test verifies that the valve actually moves to its safety position when the SIF is activated.
Partial Stroke Testing (PST)
PST verifies the valve can move (typically 10–20% of travel) without requiring full activation of the SIF. For ESD valves in production service, PST is the primary proof test method — it proves the valve and actuator can respond without shutting the process down. PST typically detects 30–60% of dangerous failures (the portion related to valve and actuator mechanical issues), so a reduced proof test interval credit is applied for PST vs. full stroke testing.
Full Stroke Testing
A full stroke test takes the valve to its safe position (typically fully closed for ESD valves) and verifies it achieves the required position and timing. This detects nearly all dangerous mechanical failures but requires process isolation or a planned shutdown. Typically performed at turnaround intervals (every 3–5 years) in combination with more frequent PST.
Proof Test Coverage
The fraction of dangerous failures detected by the proof test (proof test coverage, PTC) affects the PFD calculation. A PST with 50% coverage combined with a full stroke test at turnaround with 95% coverage gives a combined PTC that must be calculated for the specific testing regime and used in the PFD calculation.
Valve Architecture for SIL 2 and SIL 3
For SIL 2 SIFs, a single ESD valve assembly with appropriate IEC 61508 certification, PIU data, and proof testing programme is typically achievable. For SIL 3 SIFs, the PFD target is 10–100× tighter than SIL 2, and single valve assemblies typically cannot achieve this — requiring redundant architectures:
- 1oo2 (one-out-of-two): two valves in series; the SIF is activated if either valve closes; the SIF fails only if BOTH valves fail to close (AND logic). PFD is approximately the product of individual PFDs, dramatically reducing the combined PFD.
- 2oo3 (two-out-of-three): three valves; the SIF activates if any two of three close; more complex logic but provides both the reliability of 1oo2 (high availability) and the spurious trip rate of 2oo3 (lower than 1oo2).
Common cause failure (CCF) must be included in redundant architecture calculations — if two valves share the same instrument air supply, both fail when air is lost, regardless of the 1oo2 redundancy. CCF is addressed through: independence of power supplies and utilities, physical separation, different valve types (diversity), and systematic installation checks.
Valve Selection Checklist for SIL Applications
- Obtain failure rate data (λDU, λDD, SFF) from manufacturer or certified database
- Confirm IEC 61508 certification (or PIU data meeting IEC 61511 requirements)
- Verify SFF meets architectural constraints for the required SIL in a single channel
- Define proof test type (PST and/or full stroke), interval, and coverage; include in PFD calculation
- Define fail-safe position (confirmed by HAZOP/SIL assessment, not assumed)
- Specify fast-close time requirement and verify actuator sizing meets it
- Address common cause failure: independent utilities, physical separation, periodic diversity review
- Document all design decisions in the SIL verification report and functional safety assessment
Getting SIL right for valves is not a paper exercise — it’s an engineering commitment to understanding how the valve can fail in a hazardous way and taking specific, documented actions to reduce that probability to acceptable levels. The standard is demanding because the consequences of getting it wrong are severe. Treat it accordingly.