Safety Integrity Level (SIL)

HFT defines the number of dangerous faults a subsystem can sustain without losing its safety function. HFT = N means the system can tolerate N hardware failures.

• HFT 0: A single fault causes loss of safety (typical for SIL 1/2).
• HFT 1: Requires at least two channels (1oo2 architecture); one fault is tolerated (mandatory for SIL 3).
• HFT 2: Requires triple modular redundancy; two faults tolerated (often required for SIL 4).

In virtualized environments, HFT must account for shared physical resources to ensure a single silicon fault doesn't cascade across redundant virtual PLCs.

SFF is the ratio of safe failures plus detected dangerous failures to total failures. It determines the maximum SIL a subsystem can claim based on its diagnostic coverage.

• SFF < 60%: Restricted to SIL 1 (Type A) or not allowed (Type B).
• SFF 60%–90%: Permits SIL 2.
• SFF 90%–99%: Permits SIL 3.
• SFF > 99%: Required for SIL 4.

Achieving high SFF requires extensive diagnostic circuits and proof-test intervals that detect latent faults before a second fault creates a dangerous condition.

IEC 61508 classifies subsystems based on failure mode predictability.

• Type A: Well-understood components with fully defined failure modes (e.g., relays, discrete transistors). Less stringent SFF requirements apply.
• Type B: Complex components with undefined or partially defined failure modes (e.g., microprocessors, FPGAs, software). These require higher SFF or HFT to achieve the same SIL.

Virtualized controllers are inherently Type B due to the complexity of the hypervisor and host OS, demanding rigorous fault injection testing to validate failure mode assumptions.

In mixed-criticality systems, safety functions must be strictly partitioned from non-safety workloads.

• Spatial Isolation: Prevents a non-safety partition from writing to the memory space of a safety partition. Enforced by the hypervisor's memory management unit (MMU).
• Temporal Isolation: Guarantees the safety partition receives its allocated CPU time slice deterministically, regardless of non-safety workload demand. Enforced by a real-time scheduler.

Without verified isolation, a denial-of-service in a non-critical container could starve a SIL 3 control loop, violating the safety requirement.

The PTI is the scheduled period between manual or automatic diagnostic tests designed to reveal undetected dangerous faults. The SFF calculation directly depends on the PTI.

• A shorter PTI increases diagnostic coverage, improving SFF.
• Automatic diagnostics (continuous monitoring) can reduce or eliminate the need for manual proof tests.
• In virtualized safety systems, the hypervisor can automate proof tests by injecting fault conditions into redundant channels during runtime without stopping production.

While HFT and SFF address random hardware failures, Systematic Capability addresses design and human errors. SC defines the maximum SIL a component can claim based on the rigor of its development process.

• SC 1: Basic quality management.
• SC 2: Formal specification and structured design.
• SC 3: Formal methods, semi-formal verification, and extensive static analysis.

A virtual PLC must demonstrate SC 3 to be used in a SIL 3 safety function, requiring a certified development lifecycle for both the hypervisor and the control runtime.