Header row
Formatted, frozen, with set column widths so the sheet scrolls cleanly on long registers.
SIL calculation Excel template.
A SIL verification calculation register is the IEC 61511 functional safety document that compares the target SIL for each safety instrumented function, SIF against the achieved SIL of the as-designed sensor, logic solver, and final element architecture. One row per SIF tag carries the hazardous event, demand mode, target SIL, achieved SIL, average probability of failure on demand, PFDavg, risk reduction factor, RRF, voting architecture, 1oo1, 1oo2, 2oo2, 2oo3, and proof-test interval.
What the template carries.
SIL verification calculation template with 14 columns covering SIF tag, hazardous event, demand mode, target SIL, achieved SIL, PFDavg, RRF, voting architecture, sensor, logic-solver, final-element references, MTTR, proof-test interval, proof-test coverage, and common-cause beta factor. Pre-formatted with frozen header, auto-filter, and 48 blank rows.
By Tagsight Team·Published Sep 21, 2025·Reviewed Aug 7, 2026
- Format.xlsx
- Columns14
- Rows48 blank
- Opens inExcel · Sheets · LibreOffice
Every column, defined.
14 columns mapped to how a sil verification calculation is issued on a real project. Dropdown columns enforce values; free-text columns let house notation preserve as drawn.
| # | Column | Type | Description |
|---|---|---|---|
| 01 | SIF Tag | Text | Safety instrumented function identifier |
| 02 | Hazardous Event | Text | Hazard the SIF protects against |
| 03 | Demand Mode | List | Low demand, High demand, Continuous |
| 04 | Target SIL | List | SIL 1, SIL 2, SIL 3, SIL 4 |
| 05 | Achieved SIL | List | SIL 1, SIL 2, SIL 3, SIL 4 |
| 06 | PFDavg | Text | Average probability of failure on demand |
| 07 | RRF | Text | Risk reduction factor, the inverse of PFDavg. |
| 08 | Voting Architecture | List | 1oo1, 1oo2, 2oo2, 2oo3 |
| 09 | Sensor Elements | Text | Sensor tag references |
| 10 | Logic Solver | Text | Logic solver tag reference |
| 11 | Final Elements | Text | Final element tag references |
| 12 | MTTR | Text | Mean time to restore, hours. |
| 13 | Proof Test Interval | Text | Months between proof tests |
| 14 | Common-Cause β | Text | Common-cause beta factor fraction |
Target SIL against achieved SIL, and what each column contributes
| Column | What it records | What breaks without it |
|---|---|---|
| SIF Tag, Hazardous Event | The safety function and the event it protects against, traceable to the HAZOP recommendation that raised it. | Without traceability the function cannot be justified at audit. |
| Demand Mode | Low demand, under one demand per year, against high demand and continuous. Low demand is verified on PFDavg, high demand on PFH. | The wrong mode means the wrong metric is being calculated entirely. |
| Target SIL | The integrity level the risk assessment called for, per IEC 61511. | This is the number achieved SIL gets compared against. |
| PFDavg, RRF | Average probability of failure on demand, and its reciprocal, the risk reduction factor. | PFDavg is what sets the achieved SIL for a low-demand function. |
| Voting Architecture | 1oo1, 1oo2, 2oo2, 2oo3, stated per subsystem. Sensor, logic solver and final element can each differ. | Architecture moves PFDavg by orders of magnitude. 2oo2 is worse than 1oo1 for dangerous failures. |
| Sensor, Logic Solver, Final Elements | The dangerous undetected failure rate for each subsystem, from the certificate or the failure-rate database. | Final elements usually dominate the total. Leaving them out flatters the result. |
| Proof Test Interval | How long dangerous undetected failures accumulate before a test finds them. | PFDavg is roughly proportional to this. It is the most sensitive input in the register. |
| MTTR | Time to restore after a detected failure. | Dominates the 1oo2 result once the interval term gets small. |
| Common-Cause Beta | The fraction of failures that take out more than one channel at once. | Redundancy sharing a process tapping or a cable route is not independent. Beta is where that gets admitted. |
What ships in the file.
Worked example
One filled row shows the format for every column so the schema is clear before the engineer starts typing.
Auto-filter
Enabled on every column. Pivot by any field without a single formula.
48 blank rows
Pre-formatted and ready to paste into. Extends without breaking the dropdown or filter range.
Enforced dropdowns
Categorical columns (priority, signal class, status, type) enforce values so the register stays clean.
Cross-tool
Plain .xlsx. Opens cleanly in Excel, Google Sheets, and LibreOffice. No macros, no add-ins.
No tracking
No macros, no add-ins, no telemetry inside the file. Edit and ship.
Quiet signoff
A single mint-italic line at the bottom: Drag a source document at tagsight.io to fill this automatically. Easy to delete.
Extract from a source document instead.
Upload the source document instead and the same 14-column schema this template defines comes back populated. Type, tag, vendor, model, and per-row metadata come from the document itself.
Scanned binders, CAD-exported PDFs, and image scans all work. House conventions, vendor-specific forms, and dialect-specific tag schemes read as drawn.
Common questions
What is a SIL verification calculation.
The SIL verification calculation is the per-SIF computation that compares the target SIL, from the SIL determination to the achieved SIL, from the actual sensor, logic-solver, final-element architecture. PFDavg is the per-SIF result. The RRF is its reciprocal. The calculation is the document the IEC 61511 audit reads to verify the protective scope meets the target risk reduction.
What columns are in this template.
Fourteen columns. Demand Mode, Target SIL, Achieved SIL, and Voting Architecture are dropdowns. Everything else stays free text so PFDavg, RRF, MTTR, proof-test interval, and common-cause beta factor preserve the source notation from your calculation tool, exida exSILentia, SIS-PRO, Sphera SafeTech.
Does this template do the SIL calculation.
No. The template is a register of as-issued SIF results. The PFDavg calculation itself, component reliability data, beta-factor modelling, proof-test coverage is done in your validated SIL calculation tool. The template carries the result row per SIF for the IEC 61511 evidence package.
What is the difference between target SIL and achieved SIL.
Target SIL comes from the risk assessment: the integrity level the hazard requires. Achieved SIL comes from the verification calculation: what the as-designed loop actually delivers given its components, architecture, proof-test interval and common-cause factor. Verification passes when achieved meets or exceeds target. Both belong in the register side by side, because the gap between them is the finding.
Which inputs dominate the PFDavg result.
The proof-test interval and the final element, in most low-demand loops. PFDavg is roughly proportional to the interval, so doubling the test period roughly doubles the number. The final element, usually a valve, normally carries the largest dangerous undetected failure rate in the loop and dominates the sum. Sensors and logic solvers usually contribute least.
Why does the register carry a common-cause beta column.
Because redundancy is only worth its arithmetic if the channels genuinely fail independently. Two transmitters on the same process tapping, in the same cable tray, calibrated by the same technician on the same day, are not independent. Beta is the fraction of failures that take out more than one channel, and it is what stops a 1oo2 calculation claiming a reduction the installation cannot deliver.
Does a spreadsheet satisfy IEC 61511 for SIL verification.
The standard requires the verification to be documented, justified and auditable. It does not mandate a particular tool. A spreadsheet is acceptable where the failure-rate sources are cited, the architecture is stated per subsystem, and a reviewer can follow the calculation. Certified tools are common on high-integrity work because they carry the failure-rate database and the calculation itself is pre-validated.
What is RRF and why does it sit next to PFDavg.
Risk reduction factor is the reciprocal of PFDavg. A PFDavg of 0.01 is an RRF of 100. Both are carried because different readers think in different units: process safety usually reasons in orders of risk reduction, while the SIL bands are defined on PFDavg. Keeping both in the register avoids a conversion error during review.
Related.
Run it on your drawings.
The template is a manual starting point you fill yourself. Upload the source document instead and the same schema comes back populated.