Analytic Journal is growing – your feedback shapes the platform.Send feedback
Category: Functional Safety | Process Analytical Technology | Safety Instrumented Systems | PAT
Author: Dusko Kadijevic, Publisher Analytic Journal
Last updated: 21 October 2026
Reading time: approx. 10 minutes
Target audience: Process engineers, instrumentation engineers, PAT specialists, plant safety managers
SIL (Safety Integrity Level): A discrete level from 1 to 4 that describes the reliability requirement for a safety function in electrical, electronic, and programmable electronic systems (E/E/PE). SIL 4 is the most demanding; SIL 1 is the entry level. In the process industry, SIL 3 is the practical upper limit for most applications.
PFD (Probability of Failure on Demand): The average probability that a safety function will fail to operate correctly when called upon. PFD is the numerical foundation for calculating whether a safety system meets its SIL requirement.
SIS (Safety Instrumented System): The complete system comprising sensor, logic solver, and final element — together implementing one or more safety instrumented functions (SIFs).
SIF (Safety Instrumented Function): A specific protective action carried out by the SIS, such as closing a valve when a toxic gas concentration exceeds its limit.
In the United States, process safety is primarily governed by OSHA's Process Safety Management (PSM) standard (29 CFR 1910.119), which applies to facilities handling highly hazardous chemicals above threshold quantities. OSHA requires companies to follow Recognized and Generally Accepted Good Engineering Practice (RAGAGEP). Designing SIS in accordance with ANSI/ISA-84.00.01 — the US national standard for safety instrumented systems, closely aligned with IEC 61511 — satisfies this RAGAGEP requirement.
ISA-84 was first published in 1996 and substantially revised in 2004, at which point it adopted IEC 61511 as its technical basis with minor modifications. A notable US-specific provision is the "grandfather clause": existing SIS installed before the standard's adoption may remain in service provided they are properly documented and maintained — but this does not exempt them from ongoing functional safety management.
Layer of Protection Analysis (LOPA) is the dominant SIL determination method in US practice. LOPA provides a semi-quantitative approach to identifying how many independent protection layers are needed and what SIL each must achieve to reduce risk to a tolerable level.
In the UK, the Control of Major Accident Hazards (COMAH) regulations apply to sites handling dangerous substances above specified thresholds. COMAH requires demonstration that risks have been reduced As Low As Reasonably Practicable (ALARP). The Health and Safety Executive (HSE) recognises that designing SIS to IEC 61511 meets COMAH functional safety requirements.
The HSE has published specific guidance on the application of functional safety standards in the process industry and on human factors in safety systems — an area where UK practice is particularly well developed. The Safety Case approach, common in the UK offshore sector, integrates SIL assessment as part of a broader risk justification framework.
| Regulatory Framework | Region | Standard / Guidance |
|---|---|---|
| OSHA PSM (29 CFR 1910.119) | USA | ANSI/ISA-84.00.01 (aligned with IEC 61511) |
| EPA RMP (Risk Management Program) | USA | IEC 61511 / ISA-84 |
| COMAH Regulations | UK | IEC 61511, HSE guidance |
| Seveso III Directive (2012/18/EU) | EU | IEC 61511 |
| ATEX Directive | EU / UK (UKCA post-Brexit) | IEC 60079, IEC 61511 |
Every safety function is realised through a safety loop. The weakest link determines the achievable SIL of the overall system:
| Element | Function | Typical devices in Process Analytical Technology (PAT) |
|---|---|---|
| Sensor / Analyser | Measures the safety-relevant process variable | TOC analyser, gas detector, O₂ sensor, TDLS system, pH transmitter |
| Logic Solver | Evaluates the signal and initiates protective action | Safety PLC, safety controller per IEC 61511 |
| Final Element | Executes the protective action | Safety valve, trip relay, shutdown actuator, alarm |
What the SIL levels mean in practice: SIL is a scale from 1 to 4 describing how reliably a safety function must perform on demand. SIL 1 means the function may fail in at most 1 in 10 demands. SIL 2 requires ten times greater reliability — at most 1 in 100 failures on demand. SIL 3 is ten times stricter again; SIL 4 is the most demanding level, rarely applied outside nuclear or similarly critical sectors.
Core principle: Every element in the safety loop must meet the target SIL. A SIL 2-rated analyser paired with a SIL 1-rated valve produces a SIL 1 system — limited by the weakest component. Selecting a highly certified analyser is of no benefit if the final element or logic solver does not meet the same standard. System-level verification is mandatory.
The notation "MooN" (M out of N) describes how many channels must agree before a protective action is triggered.
| Architecture | Meaning | Fault Tolerance | Availability | Typical Use |
|---|---|---|---|---|
| 1oo1 | 1 of 1 | No fault tolerated | High | SIL 1, simple protective functions |
| 1oo2 | 1 of 2 | One channel may fail | Medium (spurious trip risk) | SIL 2–3, high safety demand |
| 2oo2 | 2 of 2 | No fault tolerated | Very high | High availability, lower safety |
| 2oo3 | 2 of 3 | One channel may fail or give spurious signal | High | SIL 2–3, optimal safety/availability balance |
2oo3 in practice: Three sensors measure the same variable. A single outlier is overruled by majority vote. If one sensor fails completely, the system continues operating on a 2oo2 basis. Only when two channels independently agree does the protective action trigger. This architecture prevents spurious trips and allows one sensor to be taken out of service for maintenance without interrupting production — a significant advantage in continuous operations.
Standard redundancy using multiple identical sensors protects against random hardware failures, but not against systematic errors — faults that affect all identical sensors simultaneously. A cross-sensitivity to a process constituent not covered in the original specification could simultaneously bias all three sensors in a 2oo3 system, without triggering any fault signal.
Diverse redundancy addresses this by deploying two fundamentally different measurement principles for the same target variable:
Example — O₂ monitoring in an inerting system:
The two principles are sufficiently different that a single interference source affecting both simultaneously is practically excluded.
An important practical distinction between the two channels: The paramagnetic sensor is an online device — it requires sample conditioning: a sample line, filter, cooler, pressure regulator, and a sample pump or flow meter to transport the process gas to the sensor. These auxiliary components are part of the safety loop and must be included in the SIL assessment. A filter blockage or pump failure renders the sensor blind without generating a fault signal.
The TDLS system, by contrast, measures inline — directly in the process pipe — without sample extraction, sample line, or pump. This significantly reduces the number of auxiliary safety-relevant components and simplifies the overall SIL assessment.
Note: The differences between online and inline measurement principles, their respective implications for SIL assessments, and the role of flow meters in safety loops will be covered in a dedicated Analytic Journal article.
| Aspect | Standard Redundancy (same type) | Diverse Redundancy (two principles) |
|---|---|---|
| Capital cost | Medium | High |
| Calibration | One method, one standard | Two methods, two standards |
| Maintenance | Uniform | Two maintenance concepts, two spare parts inventories |
| Protection against systematic faults | Limited | Very high |
| Validation effort | Standard | Extensive — both principles must be validated |
Conclusion: Diverse redundancy is not a default approach. It is reserved for high-risk applications where systematic faults cannot be ruled out and where the consequence of failure is unacceptable. The effort involved — two measurement principles, two calibration regimes, two maintenance concepts — is substantial and must be explicitly justified in the HAZOP process.
| SIL Level | PFD Range (Low Demand) | PFH Range (High Demand) | Risk Reduction Factor | Typical Application |
|---|---|---|---|---|
| SIL 1 | 10⁻¹ to 10⁻² | 10⁻⁵ to 10⁻⁶/h | 10–100 | General process monitoring, simple protective functions |
| SIL 2 | 10⁻² to 10⁻³ | 10⁻⁶ to 10⁻⁷/h | 100–1,000 | Safety-critical chemical and pharmaceutical processes |
| SIL 3 | 10⁻³ to 10⁻⁴ | 10⁻⁷ to 10⁻⁸/h | 1,000–10,000 | High-criticality facilities, oil & gas, offshore |
| SIL 4 | 10⁻⁴ to 10⁻⁵ | 10⁻⁸ to 10⁻⁹/h | 10,000–100,000 | Nuclear, rarely applied in standard process industry |
| Feature | Low Demand Mode | High Demand / Continuous Mode |
|---|---|---|
| Demand rate | Max. once per year | More than once per year, or continuous |
| Key metric | PFD (Probability of Failure on Demand) | PFH (Probability of Failure per Hour) |
| Typical example | Emergency shutdown valve | Continuous gas detector |
| Parameter | Full Term | Meaning |
|---|---|---|
| HFT | Hardware Fault Tolerance | Number of hardware faults tolerable without loss of safety function |
| SFF | Safe Failure Fraction | Proportion of all possible failures that do not lead to a dangerous state (%) |
| MTBF | Mean Time Between Failures | Average operating time between two failure events |
| DC | Diagnostic Coverage | Proportion of dangerous failures detected by self-diagnosis |
| PFDavg | Average PFD | Mean PFD value over the proof test interval — the benchmark for SIL verification |
SFF and HFT together determine the maximum achievable SIL for a device. A high SFF (above 90%) may allow SIL 2 to be reached even with a simple architecture (HFT = 0). The relationship between these parameters is defined in IEC 61508 Part 2.
Pressure and temperature transmitters are installed in the millions worldwide. This installed base delivers well-established failure rate data, standardised proof test procedures, and accepted PFD values supported by decades of operational experience.
Process analysers face a fundamentally different situation:
| Characteristic | Pressure / Temperature Transmitter | Process Analyser |
|---|---|---|
| Global installed base | Millions of units | Hundreds to thousands (type-dependent) |
| Failure rate database | Extensive, statistically robust | Limited, often application-specific |
| Influence of chemistry on measurement | Low — physics dominates | High — cross-sensitivities, matrix effects |
| Calibration effort | Low, highly standardised | Medium to high, application-specific |
| Sample conditioning required | Not required | Frequently required (filters, coolers, conditioning) |
| Failure modes | Mechanical, membrane, drift | Chemical, optical, mechanical, matrix-induced |
| Proof testing method | Simple (apply reference pressure) | Complex (reference gas, standard solution, multi-point) |
| Validation studies required | Rarely | Frequently |
The critical difference: A pressure transmitter relies on physics — a measurement principle that is inherently robust against process chemistry changes. A process analyser interacts directly with the chemistry of the process medium. A constituent not accounted for in the original specification may systematically bias the measurement — without the device registering any fault. This is the most dangerous failure mode in SIL applications: no alarm, but incorrect information reaching the logic solver.
A cross-sensitivity occurs when an analyser responds not only to its target component but also to other substances in the process stream, producing a biased reading without generating a fault signal.
| Measurement Principle | Target Component | Potential Cross-Sensitivity |
|---|---|---|
| NDIR (infrared) | CO | CO₂, H₂O, CH₄ (spectral overlap) |
| Electrochemical | O₂ | H₂S, SO₂, Cl₂ (sensor poisoning or interference) |
| Paramagnetic | O₂ | NO, NO₂ (also paramagnetic) |
| UV fluorescence | SO₂ | Aromatic hydrocarbons |
| TDLS | H₂O, O₂, NH₃, CO | Pressure dependence, temperature effects on absorption lines |
| Thermal conductivity | H₂, He, CO₂ | All gases with thermal conductivity differing from carrier gas |
| NIR spectroscopy | Moisture, concentrations | Particle scattering, temperature, matrix variability |
Consequence for SIL applications: Cross-sensitivities must be systematically investigated, documented, and quantified. Without this validation, no reliable PFD value can be established for an analyser in a specific application — and no SIL case can be made.
A central concept in functional safety is the distinction between detected and undetected failures:
Detected failure: The device recognises its own malfunction — through self-diagnostics, plausibility checks, or signal range monitoring — and outputs a clear fault signal (for example, a below-minimum current output per NAMUR NE 43 / ISA equivalent). The safety loop knows this channel has failed. The situation is manageable.
Undetected failure: The device has failed but shows no indication. It continues to output a signal — which is incorrect. The logic solver receives what appears to be a valid reading. When the hazardous event occurs, the safety function fails to activate.
| Failure Type | Signal Behaviour | Consequence for the Safety Loop |
|---|---|---|
| Detected failure | Fault signal, alarm, defined output state | Failure is known — maintenance is initiated, remaining channels continue |
| Undetected failure | Apparently normal reading, but incorrect | Failure is invisible — safety function may fail silently on demand |
Why undetected failures are the core SIL challenge: The PFD value of a device is driven primarily by the rate of dangerous undetected failures (λDU — Dangerous Undetected Failure Rate). The higher this rate, the worse the PFD, and the harder it becomes to achieve the required SIL. A high Diagnostic Coverage (DC) — the ability of a device to detect its own failures — directly reduces λDU and improves the achievable PFD.
Particularly critical for process analysers: An analyser may be functioning correctly in a technical sense — no electronic failure, no hardware fault — yet deliver a systematically incorrect value due to a cross-sensitivity. No fault signal is generated. This is the highest-risk failure mode: the safety loop receives confident but wrong information. It is precisely for this reason that cross-sensitivity studies in SIL projects involving analysers are not optional.
In the chemical industry, devices are not only tested for measurement accuracy and cross-sensitivities. SIL qualification requires systematic testing for environmental disturbances that originate outside the device itself — and that disqualify many instruments before they reach the assessment stage:
Electromagnetic Compatibility (EMC): Process environments contain powerful electromagnetic sources — variable frequency drives, large motors, welding equipment, high-voltage lines. An analyser whose measurement or control electronics are susceptible to electromagnetic interference can produce undetected errors. EMC testing to the IEC 61000 series is mandatory for SIL-rated devices. Many instruments that measure accurately in a laboratory setting fail these tests under industrial conditions.
Software and Firmware: Modern analysers contain complex software for signal processing, calibration management, self-diagnostics, and communication. Software faults are systematic failures — they affect every unit of the same type simultaneously, cannot be mitigated through hardware redundancy, and are difficult to detect in the field. IEC 61508 Part 3 establishes specific requirements for software development processes, test coverage, and documentation in safety-related systems. Many manufacturers underestimate this requirement — and fail precisely here during SIL assessment.
Temperature Effects on the Sensor: Both ambient and process temperature can directly affect measurement results — through thermal expansion of mechanical components, changes in electrical characteristics, shifts in optical properties, or influences on the reference element. An instrument whose output shifts with temperature changes in the process or its surroundings has a temperature cross-sensitivity. This must be quantified, compensated, or accounted for in the PFD calculation.
Vibration and Mechanical Stress: In proximity to pumps, compressors, or mills, vibration can cause accelerated wear and measurement instability.
| Disturbance | Test Standard (selection) | Typical Disqualification Reason |
|---|---|---|
| Radiated electromagnetic interference | IEC 61000-4-3 | Measurement shift under field influence |
| Conducted interference | IEC 61000-4-4, -4-5 | Signal disturbance on measurement lines |
| Software / firmware | IEC 61508 Part 3 | Insufficient testing of software execution paths |
| Ambient temperature | IEC 60068-2-1, -2-2 | Output drift outside specification at extreme temperatures |
| Vibration | IEC 60068-2-6 | Mechanical wear, signal instability |
| Humidity | IEC 60068-2-78 | Corrosion, leakage currents, insulation failure |
Practical consequence: SIL qualification projects for process analysers frequently fail not because of inadequate measurement performance, but because of these environmental qualification tests. An instrument that measures perfectly in a controlled laboratory may deliver systematically incorrect values in a real process environment — with vibration, EMC interference, and temperature swings — without any fault indication. These tests must be completed before the SIL assessment begins, not after.
TDLS (Tunable Diode Laser Spectroscopy) has established itself over the past two decades as one of the most reliable principles for in-situ gas measurement in demanding process environments. The level of confidence in this technology has grown to the point where TDLS systems are increasingly integrated directly into SIL-relevant PAT applications.
| Property | Significance for SIL |
|---|---|
| High selectivity | Gas-specific absorption lines — minimal cross-sensitivities when the correct wavelength is selected |
| In-situ measurement | No sample extraction, no sample line — fewer failure sources, faster response |
| No consumables | No reference gas, no reagents — reduced maintenance burden, fewer possible failure modes |
| Integrated self-diagnostics | Laser power and optical signal quality monitored continuously — high Diagnostic Coverage (DC) |
| Pressure dependence manageable | Absorption line broadening is pressure-dependent — compensable when process pressure is known |
| Growing installed base | Over 20 years of industrial operation — increasingly robust PFD data from field experience |
Typical TDLS target applications in SIL-relevant contexts:
Limitations of TDLS:
For pressure transmitters, type testing and operational track record (prior use) are generally sufficient to establish PFD values. For process analysers in SIL applications, this is often not enough — for two reasons:
1. Limited field data: A PFD value without an adequate statistical foundation is not defensible in a SIL case.
2. Application-specific influences: The same analyser behaves differently in natural gas than in synthesis gas. The process matrix affects the measurement in ways that can only be quantified through application-specific testing.
| Validation Item | Purpose |
|---|---|
| Cross-sensitivity analysis | Systematic testing of all relevant interfering substances |
| Long-term stability / drift | Determining drift rate relevant to PFD over the proof test cycle |
| Environmental influences | Testing temperature, vibration, and EMC effects on measurement |
| Sample conditioning failure | Assessing impact of filter failure, pump failure on measurement validity |
| Fail-safe behaviour | Identifying what state the analyser enters on self-failure |
| Calibration stability | Confirming calibration integrity between proof test intervals |
There is a dedicated framework for analysers in safety functions. Technical report IEC TR 63176:2019 provides guidance on planning, installation and operation, including maintenance. From the user side, NAMUR recommendation NE 146 addresses process analytical systems as part of safety instrumented systems and relates existing experience with process analytical measuring equipment to the existing standards.
For process analysers, prior use is the more important route to demonstrating suitability in practice. Certified failure rates from a manufacturer's analysis are rare in this device segment. NE 130 describes the selection of field devices for safety instrumented systems taking prior use into account and therefore provides a route for devices without certification to IEC 61508.
This has a practical consequence for operation: without documented faults, failures and test results from your own plant, there is no basis for demonstrating prior use. Maintenance records are therefore part of the safety evidence, not merely good practice.
| SIL Level | Certification Route | Examples |
|---|---|---|
| SIL 1 | Manufacturer declaration possible | Internal assessment with documented evidence |
| SIL 2 | Manufacturer declaration possible | Internal or third-party (TÜV, Exida, Intertek) |
| SIL 3 | Independent third-party certification mandatory | Exida, TÜV Rheinland, TÜV SÜD, Bureau Veritas, Intertek |
| SIL 4 | Independent certification mandatory, highest requirements | Specialist accredited bodies |
Important: SIL certification of an individual device does not automatically mean that a safety loop built from it achieves the same SIL. System-level PFDavg verification is a separate obligation of the plant designer and operator.
Simplified approximation: PFDavg ≈ λDU × Ti / 2 (λDU = dangerous undetected failure rate; Ti = proof test interval)
| Proof Test Interval | Effect on PFDavg | Operational Impact |
|---|---|---|
| Short (3 months) | PFDavg decreases, SIL improves | High maintenance burden, frequent process interruptions |
| Medium (1 year) | Typical for SIL 2 applications | Balance between safety assurance and operational continuity |
| Long (4 years) | PFDavg increases | Low maintenance demand, but stricter device requirements |
The selection of an appropriate proof test interval is one of the most consequential decisions in SIL planning — and one of the most common sources of non-compliance when it is set too conservatively without adequate device performance data to support it.
| Standard | Scope |
|---|---|
| IEC 61508 (EN 61508) | Fundamental standard covering E/E/PE safety-related systems across all industries |
| IEC 61511 (EN 61511) | Application standard for safety instrumented systems in the process industry |
| IEC 61508-3 | Software development and qualification requirements for safety-related systems |
| IEC 61000 (series) | Electromagnetic compatibility — testing and qualification requirements |
| IEC 60068 (series) | Environmental testing — temperature, vibration, humidity qualification |
| IEC 60079 | Equipment for explosive atmospheres (ATEX) — overlaps with SIL for gas detectors |
| ANSI/ISA-84.00.01 | US national standard for SIS — closely aligned with IEC 61511 with minor modifications |
| IEC 62061 | Functional safety standard for machinery sector |
| IEC TR 63176:2019 | Analysers as part of safety-related systems (technical report) — guidance on planning, installation, operation and maintenance of analysers in safety functions |
| NAMUR NE 146 (version 21.10.2013) | Process analytical systems as part of safety instrumented systems — user-side perspective on process analytical measuring equipment as the sensor part of safety instrumented systems |
| NAMUR NE 130 (edition 14.07.2023) | Selection of field devices for safety instrumented systems taking prior use into account — a route for devices without certification to IEC 61508 |
| Standard / Guidance | Issuer | Content |
|---|---|---|
| VDI/VDE 2180 | VDI/VDE | Safety of process industry facilities — DACH-specific implementation guidance |
| NAMUR NE 43 | NAMUR | Standardised signal behaviour for process analysers in fault conditions (4–20 mA) |
| NAMUR NE 79 | NAMUR | Use of field instruments in safety instrumented systems |
| HSE Guidance Documents | UK Health and Safety Executive | Functional safety application notes for the UK process industry; human factors in SIS |
| OSHA PSM (29 CFR 1910.119) | US OSHA | Process Safety Management — regulatory framework requiring RAGAGEP compliance |
| COMAH Regulations | UK HSE / Environment Agency | Major hazard site requirements — functional safety evidence expected |
| Organisation | Resource |
|---|---|
| Exida (www.exida.com) | SIL data, device failure rates, FMEDA assessments, safety manual database |
| TÜV SÜD / TÜV Rheinland | SIL certification, technical guidelines, assessment whitepaper |
| NAMUR (www.namur.net) | Process industry recommendations, NE series |
| ISA (www.isa.org) | ISA-84 standard, technical resources for SIS practitioners |
| HSE (UK) | Functional safety guidance, human factors reports |
| Exida SERH | Safety Equipment Reliability Handbook — industry-standard source for device failure rate data |
| Source | Content |
|---|---|
| ASTM E1655 | Testing practices for quantitative infrared analysis methods — foundation for NIR in PAT |
| ISO 10723 | Framework for evaluating the performance of gas analysers in industrial applications |
| ISO 13528 | Statistical approaches for assessing analytical method performance through interlaboratory studies |
| Device Safety Manuals and SIL Certificates | Device-specific PFD values and safety parameters must be obtained from the official safety documentation of the respective manufacturer, or through accredited certification bodies such as Exida or TÜV. |
| AIChE CCPS publications | Process safety guidance for chemical and petrochemical facilities — relevant for gas analytics in SIL environments |
Note: Standards are revised periodically. For any SIL verification, the edition valid at the time of design is the governing document. The references listed here reflect the state of practice as of May 2026.
What is the difference between SIL and PFD?
SIL is the level (1–4); PFD is the numerical value behind it. SIL 2 means the probability of failing on demand falls between 10⁻³ and 10⁻². PFD is the calculated result; SIL is the normative classification of that result.
What is the relationship between IEC 61511 and ISA-84?
ISA-84 (ANSI/ISA-84.00.01) is the US national standard for safety instrumented systems and serves as the US equivalent to IEC 61511. Since its 2004 revision, ISA-84 has adopted IEC 61511 as its technical basis with minor modifications. Compliance with either satisfies OSHA PSM RAGAGEP requirements in the United States.
Why is a process analyser harder to qualify for SIL than a pressure transmitter?
Pressure transmitters have an enormous installed base and rely on physics — a measurement principle that is inherently robust against process chemistry changes. Process analysers interact with the chemistry of the process medium directly. Cross-sensitivities, matrix effects, and a limited operational database make application-specific validation studies frequently unavoidable.
What is diverse redundancy and when is it needed?
Diverse redundancy means deploying two fundamentally different measurement principles for the same target variable, to eliminate systematic failures that would affect all identical sensors simultaneously. It is costly and complex, but in high-risk applications where cross-sensitivities cannot be excluded, it may be the only path to a defensible SIL case.
Why is TDLS gaining acceptance in SIL applications?
High selectivity, no consumables, in-situ measurement without sample conditioning, integrated self-diagnostics with high diagnostic coverage, and over twenty years of industrial operational data have established TDLS as a credible measurement principle for safety-relevant gas monitoring applications.
What are the most common failures in SIL projects involving analysers?
First: the device is SIL-certified but the complete loop is not verified. Second: cross-sensitivities are not systematically investigated. Third: the proof test interval is set too long, causing PFDavg to exceed the SIL requirement. Fourth: sample conditioning components are excluded from the safety assessment, even though a filter failure can render the analyser blind without generating a fault signal.
What is an undetected failure and why is it the most serious concern?
An undetected failure occurs when a device produces an incorrect output without generating any alarm or fault indication. The logic solver receives what appears to be a valid measurement. When the hazardous condition arises, the safety function fails to activate. The PFD value of a device is dominated by its dangerous undetected failure rate — which is why high diagnostic coverage is central to achieving demanding SIL levels.
Why do many analysers fail EMC and temperature qualification?
Process environments contain strong electromagnetic sources and significant temperature variation. An analyser that measures correctly in a laboratory may produce systematically biased readings under industrial conditions — without generating any fault signal. EMC testing to the IEC 61000 series and environmental testing to IEC 60068 are mandatory prerequisites for SIL devices. Many instruments do not pass these tests, which is why they must be completed before an SIL assessment is initiated.
What is NAMUR NE 43 and why does it matter for SIL analysers?
NAMUR NE 43 defines standardised signal behaviour for process analysers in fault conditions — for example, dropping below 3.6 mA as a fault indicator in a 4–20 mA loop. In SIL applications, the fail-safe behaviour of an analyser is critical: does it enter a recognised, defined safe state when it fails? NE 43 provides the convention for this. The ISA and ANSI equivalents serve a comparable function in US practice.
Which standards and recommendations apply specifically to process analysers in safety instrumented systems?
Beyond the general standards IEC 61508 and IEC 61511, technical report IEC TR 63176:2019 covers analysers as part of safety-related systems. From the user side, NAMUR recommendation NE 146 addresses process analytical systems as part of safety instrumented systems. NE 130 complements this with the selection of field devices taking prior use into account, which is the usual route for analysers without certification to IEC 61508.
SIL and PFD are the fundamental metrics of functional safety in the process industry — in the United States, the United Kingdom, and internationally. For process analysers, the qualification requirements go significantly further than those for pressure and temperature transmitters: the direct influence of process chemistry on the measurement principle, cross-sensitivities, limited operational databases, and complex sample conditioning make application-specific validation studies frequently unavoidable.
TDLS has established itself as a technology with growing SIL credibility — driven by its selectivity, self-diagnostic capability, and two decades of field experience. Diverse redundancy remains the exception, not the rule — but in high-risk applications where systematic failures cannot be excluded, it is sometimes the only path to a defensible SIL verification.
The SIL case is always a system responsibility — not the responsibility of any single device.
Analytic Journal — The Portal for PAT
Standards are subject to revision — current editions are authoritative for any SIL verification.
Related topics on Analytic Journal:
Editorial Note
This article has been written to the best of our knowledge based on publicly available technical information, standards, and manufacturer data. Specifications may change — for binding information, consult current manufacturer datasheets and relevant standards bodies. Analytic Journal produces editorial content independently of manufacturers and advertising partners.
Author: Dusko Kadijevic — 20 years of experience as a PAT practitioner in the process industry
Dusko Kadijevic | Publisher Analytic Journal | analyticjournal.com
Written October 2026. All content formulated in our own words, created with AI assistance.
Erstveröffentlicht am 8. Juni 2026 auf analyticjournal.com