You have a SIL verification calculation to finish. The vendor certificate gives one failure rate, a generic handbook gives another, and the maintenance system gives a third. Before you choose, you need to know what IEC 61511 requires of the data and which source can meet it. That is the question behind IEC 61511 prior use failure data, and it keeps coming back because the standard sets a test rather than naming a database.
What IEC 61511 requires of reliability data
IEC 61511-1:2016 is the second edition. The IEC webstore lists it as published in February 2016, with a stability date of 2029. The relevant requirement sits in clause 11.9.3. As summarised by I&E Systems, the data must be credible, traceable, documented, justified, and based on field feedback from similar devices in a similar operating environment.
The same source notes that NOTE 1 allows data from general field feedback reliability databases. Generic data is therefore not excluded. It has to pass the same test as any other source.
Nothing in the standard names an approved source. As one data-source guide puts it, neither IEC 61511 nor IEC 61508 mandates a specific one, and any source that survives the test is usable. The decision, and the evidence behind it, belongs to you.
Two clauses, two questions
Engineers often merge "prior use" and "reliability data". They are separate requirements. Prior use under clause 11.5.3 is tied to systematic integrity, meaning evidence that a device is suitable for the SIS. The credible-and-traceable requirement for reliability data always applies, whichever route you took to select the device.
The reliability data requirement also carries weight in the architecture. The 2016 edition reduced hardware fault tolerance requirements and put the emphasis on credible failure rate data instead. Commentary on the edition says it stops short of the 90% confidence level of IEC 61508 Route 2H but still requires an equivalent demonstration of confidence in the data. Several sources describe a 70% confidence level for prior use data. If your data is optimistic, the shortcuts in your architecture rest on weak evidence.
Judging IEC 61511 prior use failure data by source
Kenexis, in a webinar on generic failure data, lists the usual sources of component failure rates:
- vendor FMEDA data
- vendor field returns
- field data from operating plants
- industry data from groups of companies
- generic data compiled from industry sources
Each has a different weakness against the four tests.
Vendor data and certificates
A certificate or FMEDA report is only as credible as its derivation. exida describes published failure rates that look too good to be true. Often it is hard to tell how the rate was estimated, how failure was defined, and what assumptions were made. In a separate article, exida cites a certificate listing 3.06 FIT for a scotch yoke actuator, roughly one dangerous failure in 37,000 years. Its advice is to convert the figure to a mean time to failure and sanity-check it.
Vendor field-return data has its own limits. exida, a data provider with its own commercial interest, argues that warranty data is not a useful basis for realistic failure rates in safety verification. Treat that as one view and test it against your own situation. Use the same discipline for any figure that arrives without its definition of failure.
Generic databases
Generic sources give you breadth. They also differ widely in age, scope and failure-mode definitions. A table in an exida paper on field failure data compares sources for pressure transmitters. The values run from 6.56E-05 (CCPS, 1989) to 3.57E-07 (a manufacturer study), a spread of roughly a factor of 180. The same paper notes that a product designed in 1990 is likely to fail at a different rate from a similar modern one.
Age and scope matter. One guide to data sources describes the CCPS guidelines as static tables from 1989, and NPRD as counted field data for generic part types. Kenexis says the work of building generic data involves expert judgement in drawing on the ISA technical report, CCPS, OREDA and NPRD, and adjusting for industry relevance and failure mode. If you use a compiled generic set, you are relying on that judgement. You should be able to explain why it fits your service.
Plant data
Your own records are the closest match to "similar devices in a similar environment". The guide above describes prior use under clause 11.5.3 as the facility-side path, justified on your own device, in your own service. But raw maintenance records are rarely good enough without work. You need installed populations, operating hours, a consistent definition of dangerous failure, and proof test results that distinguish genuine failures from "found as left".
The Norwegian Offshore Federation's guideline 070 lists issues to check when deciding whether field experience data qualifies for use in PFD calculations. It also notes that the operational experience needed for credible statistics is typically much larger than for the other prior use evidence.
A defensible justification, step by step
Whatever the source, the justification should answer the same questions in the same order:
- Define the device and failure modes. Make, model, version, and what counts as a dangerous failure for this SIF.
- State the source and its derivation. Document the version, the population behind the figure, and how failures were counted.
- Show similarity. Compare process medium, temperature, vibration, duty cycle, and the maintenance and proof test regime.
- Check plausibility. Compare against at least one independent source, and investigate any large difference.
- State the confidence basis. Record how the data meets the confidence expected by the standard, and how uncertainty was handled.
- Record the review trigger. Define what operational evidence, such as proof test failures or demands, will prompt you to revisit the figure.
A Bayesian approach can help where the plant population is small. A paper on hierarchical Bayesian methods argues that generic SIL databases do not fully meet the intent of IEC 61511 on their own. It proposes combining them with plant data so the result reflects real field feedback.
Where teams go wrong
- Using a favourable figure without its context. A 5 FIT solenoid valve is a common example. Gandy at exida argues that such a figure fails the credible, traceable, documented and justified test, and would give an optimistic PFDavg.
- Treating the certificate as the justification. A certificate is evidence, not the justification itself.
- Never closing the loop. Failures found during proof tests should feed back into the assumed rate.
Key takeaways
- Clause 11.9.3 sets the test for reliability data. Clause 11.5.3 prior use is a separate requirement. Both need to be addressed.
- No source is pre-approved. Vendor, generic and plant data each have to be justified for your device and service.
- Treat unusually low failure rates as a prompt to ask how the figure was derived.
- Document the failure mode definitions, the source, the similarity argument and the confidence basis.
- Feed proof test and demand results back into the data over the lifecycle.
Learn the method in a course
The FS Engineer SIS course covers how to apply IEC 61511 across the SIS safety lifecycle, including the evidence needed to support safety functions. If you want to work through data justification with an instructor, see the course calendar for upcoming dates.
