You have a dangerous failure rate in your SIL verification calculation, and the PFDavg comes out comfortably inside the target. Then an assessor asks whether that rate is a 70% upper confidence limit, and the answer is less obvious than it should be. The IEC 61511 70% confidence level failure rate requirement is short to state, but the figure you quote can pass a PFD check and still fail it.
What the IEC 61511 70% confidence level failure rate means
One paper on updating SIS failure rates reads IEC 61511 as saying that failure rate data should have a confidence level of at least 70%. It takes this to mean you should choose the upper 70% confidence value for the failure rate. In plain terms, you are 70% confident that the true failure rate, and so the true PFD, is below the estimate you used.
Put another way, the confidence level is the chance that the actual average failure rate is less than or equal to the estimated rate. There is therefore a 30% chance that the true rate is higher than your figure. The requirement is a deliberately modest margin of conservatism. It is not a guarantee.
This is an upper bound on one side only. Kenexis describes the idea as setting boundaries with a degree of confidence. You do not claim to know the frequency precisely; you say you are confident it is below a stated value.
For reference, the wording is in IEC 61511-1 Edition 2. PR electronics quotes clause 11.4.9 as saying that reliability data used in the failure measure calculation should be determined by an upper bound statistical confidence limit of no less than 70%. The IEC webstore lists the consolidated version as the second edition (2016) with its amendment 1 (2017).
Why Route 2H asks for 90% and IEC 61511 accepts 70%
IEC 61508 offers two ways to reduce the hardware fault tolerance you need. One is to increase diagnostic coverage (Route 1H). The other is to raise the confidence level in the measured failure rates to at least 90% (Route 2H). At 90%, there is only a 10% chance that the true average failure rate is above the estimate.
IEC 61511 takes a strategy consistent with Route 2H but requires only a 70% confidence level. It also requires documentation showing the failure rates are credible and based on field feedback from a similar operating environment. In other words, some of the work that Route 2H does through a higher percentage, IEC 61511 asks you to do through data quality. Generowicz's summary puts it this way: the standard stops short of requiring 90% but does require an equivalent demonstration of confidence in the data.
A recent instrumentation article on hardware fault tolerance restates the same gap. It also notes that failure rates stated at 90% confidence are typically about 1.6 times higher than those at 70%. That ratio is not fixed, as the next section shows.
How the 70% figure is calculated
Where all failures for a type of equipment are recorded, the failure rate can be estimated at any required confidence level using the chi-squared distribution. The formula is the chi-squared value for the chosen confidence level and degrees of freedom, divided by twice the accumulated time in service.
For the special case of no failures, the rates are approximately 1.2/T at 70% and 2.3/T at 90%, where T is the time in service. So 100 device-years with no recorded failures gives a 70% limit of about 0.012 per year, not zero.
For a case with failures, take one dangerous failure in 100 device-years. The point estimate is 0.01 per year. Working this through the chi-squared formula (my calculation, not a quoted figure) gives a 70% upper limit of roughly 0.024 per year. The 90% limit is about 0.039 per year, which is consistent with the 1.6 ratio above.
The ratio narrows as failures accumulate. The ratio of λ90% to λ70% depends only on the number of failures recorded. With ten or more failures, λ90% is no more than about 20% higher than λ70%. The uncertainty band becomes narrower with each recorded failure.
Why a quoted figure can look fine yet fail the test
A rate can sit well inside your SIL target and still not be a 70% upper confidence limit. These are the usual ways that happens:
- It is a point estimate. A simple average rate is failures recorded divided by total time in service. That is the central estimate. It is not an upper bound, and with few failures the gap between the two is large.
- Few or no failures were observed. A low count can reflect a short observation period or a small population, not a reliable device. With a single recorded failure, the 90% confidence interval spans more than an order of magnitude.
- The data is not credible for your service. Generowicz notes that confidence levels relate to the spread of the data. A high level can be claimed on small datasets, and it says nothing about whether the measured rates are valid or applicable.
- The figure looks too good. exida's duty-of-care article points to the IEC 61511 requirement that data be credible, traceable, documented, justified and based on field feedback from similar devices in a similar environment. A very low number with no such evidence behind it does not meet that requirement, whatever percentage is attached to it.
- Failures went unrecorded. The calculation assumes all failures for the equipment type have been recorded. If proof tests or maintenance records miss dangerous failures, the data overstates the confidence.
What to check in your SIL verification
- Identify the source of each dangerous failure rate. Is it a manufacturer's FMEDA, a generic database, or your own site records? Note which statistic it represents.
- Find the confidence basis. If the source gives a mean or point value, ask for the 70% upper bound, or derive it from the failures and operating hours.
- Test the evidence for credibility. Check that the devices, the duty and the operating environment are comparable, and that the data is traceable and documented.
- Record how failures are captured. Generowicz observes that the failure rates need to be measured for the exact same type of components in actual operation and in a similar environment. That needs working inspection and failure-recording practices, not only a calculation.
- Document the decision. Whoever reviews the SIL verification later should be able to see the figure, its basis and the reasoning.
Keep in mind that IEC 61511-1 also allows IEC 61508-2 Route 1H or 2H as an alternative to its own hardware fault tolerance table. If you choose Route 2H, the 90% requirement applies in full.
Key takeaways
- A 70% upper confidence limit means there is a 70% chance the true dangerous failure rate is at or below the figure you used. There remains a 30% chance it is higher.
- IEC 61511 asks for a 70% upper bound plus credible, traceable field data. IEC 61508 Route 2H asks for 90%.
- A PFD that meets the target does not show the input rate is an upper confidence limit. Averages and point estimates often are not.
- With few recorded failures the gap between a point estimate and a 70% limit can be large. With ten or more it narrows considerably.
- Document the source, the confidence basis and the credibility argument for every failure rate in the verification.
The FS Engineer SIS course covers how to interpret IEC 61511 across the SIS safety lifecycle and the evidence needed to support safety functions. Failure recording in operation is covered from the maintenance side in FS Technician SIS. You can see upcoming dates on the course calendar.
