Audio deep dive
6:11What a credible SIL claim needs after design approval
A practical discussion about the SIS lifecycle, SIL evidence, proof testing, bypass control and the distinction between engineering standards and South African legal duties.
Editorial note: This AI-produced discussion is an accessible companion to the written guide and may simplify or paraphrase technical and regulatory points. For precise terminology, standards references and engineering boundaries, refer to the written article and its cited sources. Always follow the applicable OEM instructions, approved site procedures and project-specific engineering requirements.
A safety system can be correctly designed on paper and still lose credibility in operation. The plant manager's question is not only “Was it commissioned?” but “Does today's evidence still support the assumptions behind every safety function?”
01 — Standard at a glance
IEC 61511 manages a safety function across its whole life—not only its hardware
The IEC catalogue description for Part 1 covers specification, design, installation, operation and maintenance of a safety instrumented system so that it can achieve or maintain a safe process state. That scope makes functional safety an operating-management discipline, not a once-off project deliverable.
Three terms are often blurred together. Keeping them separate makes the rest of the lifecycle easier to understand.
The system
SIS
The sensors, logic solver and final elements used to implement one or more safety instrumented functions.
The function
SIF
A defined action that takes or keeps a process in a safe state when its stated conditions are met.
The target
SIL
The safety-integrity target assigned to an individual SIF—not a blanket label for the whole plant or a single device.
Edition check — 11 August 2026
The 2026 product is a series pack, not a new technical edition
The current consolidated Part 1 is IEC 61511-1:2016+AMD1:2017, Edition 2.1. IEC lists an IEC 61511:2026 SER, but its own page describes an “all parts” pack containing the existing 2016–2020 publications. It does not replace Parts 1, 2 or 3 with a new edition.
02 — Follow the evidence
The lifecycle is a chain: weak evidence in one phase moves risk into the next
The standard is detailed, but a plant manager can view the work in three practical movements. Functional safety management and verification span the entire chain.
- 01
Analyse and specify
Identify hazards, decide which protection layers are required and define each SIF in the safety requirements specification.
- Hazard and risk assessment
- SIL determination
- Safety requirements specification
- 02
Design and realise
Engineer, program, test, install and validate the SIS against the approved requirements before relying on it.
- Design and engineering
- Application programming
- FAT, installation and validation
- 03
Operate and sustain
Maintain the assumptions behind the design through proof testing, bypass control, records and managed change.
- Operation and maintenance
- Management of change
- Modification and decommissioning
03 — Legal duties and engineering practice
South African law and IEC 61511 answer different questions
The safest wording is precise: the Major Hazard Installation Regulations, 2022 do not name IEC 61511. They impose regulatory duties on establishments within their scope. IEC 61511 supplies an engineering framework for the SIS lifecycle; applying it does not automatically prove legal compliance.
What the MHI Regulations say
- Risk assessment by an approved inspection authority in accordance with SANS 1461, at intervals not exceeding five years or when the establishment changes.
- A written major incident prevention policy, including a process safety management system.
- Additional safety-report and licence-to-operate duties for high-hazard establishments.
What IEC 61511 contributes
- A process-sector framework for the complete SIS lifecycle.
- Requirements and guidance for defining, designing, validating, operating and maintaining SIFs.
- An evidence base for instrumentation protection claimed in a wider risk-management programme.
04 — Read the target correctly
SIL is a target for a defined safety function—not a universal risk-reduction slogan
The target failure measure depends on how the SIF operates. The calculation is only as credible as its demand basis, device data, architecture, proof-test coverage, proof-test interval and systematic controls.
Low-demand functions
PFDavg
Average probability of failure on demand. The proof-test interval and achieved coverage materially influence the result.
High-demand or continuous functions
PFH
Average frequency of dangerous failure per hour. It is a different measure and should not be collapsed into a simple “times safer” comparison.
A device certificate or “suitable for use” statement does not verify the complete SIF. Ask for the function-level design basis, calculation, architecture, safety manuals, proof-test assumptions and lifecycle evidence.
05 — Operating discipline
Proof tests, bypasses and change control keep the paper design connected to the plant
Proof testing
Use written procedures that test the intended SIF path and record the result. The interval and achieved coverage must remain consistent with the assumptions used in the SIL verification.
Management question: Do the records prove the complete function was tested at the planned interval?
Bypass control
A bypass changes the protection available to the process. It needs authorisation, visible status, a defined duration and appropriate compensating measures based on the risk.
Management question: Can every active bypass be explained, approved and closed out?
Management of change
Setpoint changes, device substitutions, logic revisions and process changes can invalidate the SRS or verification assumptions even when the change appears minor.
Management question: Did the latest plant change flow through the SRS, verification and validation records?
06 — Evidence to request
Twelve document groups reveal whether the lifecycle is being managed
The files do not need to sit in one binder, but they should be controlled, traceable and consistent with one another. Start with the SRS and verification, then test the assumptions against operating records.
- 01Hazard and risk assessment records supporting each SIF
- 02Safety requirements specification for every identified SIF
- 03SIL determination and verification records with assumptions stated
- 04SIS architecture, loop, logic and as-built documentation
- 05Application-program version and configuration records
- 06Factory, site, commissioning and validation test records
- 07Operation, maintenance and proof-test procedures
- 08Proof-test results, deferrals and corrective-action evidence
- 09Current and historical bypass or override register
- 10Demand, failure, spurious-trip and incident records
- 11Management-of-change and revalidation records
- 12Competence, audit and functional-safety-assessment records
07 — What operating drift looks like
The first warning is often a mismatch between records—not an alarm on the panel
- Proof tests are overdue, repeatedly deferred or do not cover the complete function.
- The proof-test interval differs from the interval used in the SIL verification.
- Bypasses have no current authorisation, expiry date or compensating measures.
- The SRS and loop documentation do not reflect accepted plant changes.
- Logic versions, setpoints or device substitutions cannot be traced through MOC.
- Demand and failure data are collected but never compared with the design basis.
- Competence records do not match the SIS activities people actually perform.
- Audit or assessment findings remain open without evidence of closure.
08 — Five misconceptions
Statements that sound reassuring but do not survive an evidence check
“IEC 61511 is South African law.”
The 2022 MHI Regulations do not name IEC 61511. They create separate statutory duties, including an AIA-led risk assessment in accordance with SANS 1461. IEC 61511 is the process-sector engineering framework for SIS work—not a substitute for legal advice or statutory assessment.
“A SIL-capable device makes the complete loop SIL compliant.”
Device evidence is only one input. The complete SIF, its architecture, application, proof-test assumptions, systematic controls and lifecycle evidence must support the target.
“SIL 3 simply means ten times safer than SIL 2.”
SIL bands express target failure measures for a defined function and operating mode. The actual result depends on the design and its assumptions; the label is not a universal multiplication factor for plant safety.
“Calibration and routine maintenance are the same as proof testing.”
Calibration can confirm instrument response and maintenance can restore equipment, but proof testing must demonstrate the defined safety function and reveal dangerous failures covered by the procedure.
“Once the SIS is validated, functional safety becomes an engineering-file issue.”
Operating discipline keeps the claim credible. Proof tests, bypasses, competence, failures, changes and records continue for as long as the SIS remains in service.
Common questions
IEC 61511 questions plant teams ask first
Which IEC 61511 edition is current, and is there a 2026 edition?+
The current consolidated Part 1 is IEC 61511-1:2016+AMD1:2017, Edition 2.1. Parts 2 and 3 remain 2016 editions. IEC also lists an IEC 61511:2026 SER product, but SER is an all-parts series pack containing those existing publications and technical reports; it is not a new technical edition of Parts 1, 2 or 3.
Is IEC 61511 mandatory under South African law?+
The Major Hazard Installation Regulations, 2022 do not name IEC 61511. They impose their own duties, including risk assessment in accordance with SANS 1461 by an approved inspection authority. IEC 61511 remains an important engineering framework for process-sector SIS work, but following it does not by itself prove statutory compliance.
What is the difference between verification, validation and a functional safety assessment?+
Verification checks whether the output of a lifecycle activity meets its stated inputs and requirements. Validation tests whether the installed and commissioned SIS meets the safety requirements specification. A functional safety assessment forms a judgement about the functional safety achieved using the available lifecycle evidence and the required degree of independence.
Why does the proof-test interval matter to a SIL claim?+
The proof-test interval and coverage are assumptions in the quantitative evaluation of many safety functions. If the plant tests later, tests less of the function or cannot demonstrate the assumed coverage, the operating evidence no longer matches the basis used for the calculation.
What should a plant manager request first when reviewing a SIS programme?+
Start with the safety requirements specification and the SIL determination and verification records. Then compare their assumptions with current proof-test records, bypasses, management-of-change records, validation evidence, competence records and actual demand or failure history.
Authoritative references
Sources and further reading
Four supplied research reports were consolidated for this rewrite. Conflicting edition claims were resolved against the current IEC catalogue, and the South African section was checked against the published MHI Regulations and government standards notice.
- IEC — IEC 61511-1:2016 scope, edition and lifecycle status
- IEC — IEC 61511-1:2016+AMD1:2017 consolidated version, Edition 2.1
- IEC — IEC 61511:2026 SER all-parts series pack
- IEC — IEC 61511-2:2016 application guidance
- IEC — IEC 61511-3:2016 SIL-determination guidance
- IEC — IEC TR 61511-0:2018 overview of functional safety for the process industry
- IEC — IEC TR 61511-4:2020 rationale for Edition 1 to Edition 2 changes
- South African Government — Major Hazard Installation Regulations, 2022
- South African Government — 2016 standards notice issuing SANS 61511-1 and SANS 61511-2
What this article does not promise
This article does not claim that Touch Teqniques Engineering is an approved inspection authority, SANAS-accredited inspection body, SIS certification body or legal-compliance authority. It does not guarantee a SIL outcome, an audit pass or incident prevention. An MHI risk assessment under SANS 1461, independent functional safety assessment, SIL verification, cybersecurity review and other specialist activities require the correct documented scope and competent route.
This guide is general technical information. The applicable legislation, standards edition, competence requirements, assessment independence and project method must be confirmed for the specific site and decision.
Research status
Source-led technical briefing
Primary standards and South African regulatory sources checked
This article was rebuilt from a consolidated technical research pack and checked against current IEC catalogue pages and published South African regulatory material. It is general information and does not replace a site-specific engineering, legal or approved-inspection-authority assessment.
Research updated: August 2026
Relevant domains: IEC 61511, Safety instrumented systems, Functional safety lifecycle, South African MHI regulatory context.