What Is a Safety Integrity Level (SIL)?

A safety integrity level (SIL) is a target. It states how reliably a particular safety function must perform, expressed as one of four discrete levels.

A safety function is a specific protective action, such as closing a valve when a pressure reading exceeds a threshold.

IEC 61508-4 defines a SIL as a:

"discrete level (one out of a possible four), corresponding to a range of safety integrity values, where safety integrity level 4 has the highest level of safety integrity and safety integrity level 1 has the lowest" (IEC 61508-4:2010, clause 3.5.8).

Why SILs exist

Risk cannot be reduced to zero; it can only be reduced to a tolerable level. This is because a process or activity always carries some inherent risk.

Where the remaining risk is still above what an organisation is prepared to accept, an automatic safety function can be added to close the gap. The size of the risk gap to be closed determines how reliable that function has to be, and the SIL is how that reliability requirement is written down.

This guide covers what a safety integrity level (SIL) relates to, how the target is expressed numerically, where a SIL requirement comes from, how failures are classified, the three requirements for achieving a given SIL and the measures used to meet them, how the term differs between standards, and what a SIL does not tell you.

What a SIL relates to

A SIL applies to a safety function, not to a piece of equipment. In the process industries this is referred to as a safety instrumented function (SIF): a specific protective action implemented by a combination of sensors, a logic solver and final elements.

IEC 61508-4 states that "a safety integrity level (SIL) is not a property of a system, subsystem, element or component", and that the correct reading of the phrase "SIL n safety-related system" is that the system is potentially capable of supporting safety functions up to that level (IEC 61508-4:2010, clause 3.5.8, NOTE 3).

There is therefore no such thing as a SIL-rated valve in the sense usually meant.

A device may be certified as suitable for use in a safety function of a given level, which is a claim about the device's own development rigour and failure data. Whether a function built from such devices achieves that level depends on how they are combined, how often they are tested, and what else is in the loop.

How the target is expressed

The numerical target for a SIL depends on how often the safety function is called upon, or the mode of operation.

IEC 61508 distinguishes modes of operation:

• Low demand mode.
  • The function is called on no more than once per year.
  • The target is the average probability of a dangerous failure of the safety function on demand (PFD_avg).
  • It is a dimensionless probability: the chance that the function will fail to act when it is needed.
• High demand or continuous mode.
  • High demand: the function is performed on demand, but demands arrive more than once per year.
  • Continuous mode: the function holds the equipment in a safe state as part of normal operation, so failure of the function is itself the hazardous event.
  • For both, the target is the average frequency of a dangerous failure per hour, written PFH: a rate, not a probability.

A PFD_avg figure and a PFH figure are different kinds of quantity and are not interchangeable, so a SIL target quoted without its mode is incomplete.

The numerical bands

Each SIL spans an order of magnitude in both schemes, from the least demanding at SIL 1 to the most demanding at SIL 4. The bands are given in Tables 2 and 3 of IEC 61508-1.

In low demand mode, SIL 1 corresponds to a PFD_avg between 10⁻² and 10⁻¹, and each subsequent level is ten times more demanding, reaching 10⁻⁵ to 10⁻⁴ at SIL 4.

IEC 61508 also sets a floor: a single electrical, electronic or programmable electronic (E/E/PE) safety-related system may not be credited below 10⁻⁵ PFD_avg in low demand mode, or below 10⁻⁹ per hour in high demand or continuous mode.

Risk reduction factor

For low demand functions the reciprocal of PFD_avg is often used instead, and called the risk reduction factor (RRF).

A PFD_avg of 0.01 is a risk reduction factor of 100: the function is credited with making the hazardous event a hundred times less frequent. The two express the same thing, and risk reduction is frequently the more natural form because it connects directly to the risk gap the function is being added to close.

Where a SIL requirement comes from

The level a particular function needs is set by determining that risk gap. IEC 61508 does not specify what SIL any particular function needs, and does not mandate how that level is determined.

Instead, it provides a risk-based framework and example techniques, and leaves the determination to the organisation. Several methods are in common use:

• Layer of protection analysis (LOPA): a semi-quantitative method. An initiating event is given a frequency, credit is taken for each independent protection layer already present, and the residual frequency is compared with the organisation's tolerable frequency. The shortfall is the risk reduction the new function must provide, which maps to a SIL.
• Risk graph: a qualitative decision tree using factors such as consequence severity, how often people are exposed, whether the hazard can be avoided, and how likely the unwanted occurrence is.
• Risk matrix: assignment based on a qualitative ranking of likelihood against consequence.

A protection layer may only be credited if it is independent of the initiating event and of the other layers. A safety function sharing a sensor, a logic solver or a utility with the control system whose failure starts the scenario is not independent, and crediting it twice overstates the protection actually present.

These methods differ in rigour and can give different answers, which is why the determination method and its calibration are themselves part of what is documented.

What a tolerable level of risk remains is an organisational judgement.

How failures are classified

Once a target is set, the function's performance is assessed against it. That assessment depends on classification of failures, because only some failures count against the target.

• Failures can be safe or dangerous:
  • a failure is dangerous if it tends to prevent the safety function acting when required, and
  • a failure is safe if it does not.
• Dangerous failures are then split by whether the system's own diagnostics reveal them.
  • A dangerous detected failure is announced, so it can be repaired, and the exposure lasts only as long as the repair takes.
  • A dangerous undetected failure is silent: the function appears healthy and is not, and it stays that way until the next proof test, a periodic test of the function, reveals it.

Dangerous undetected failures dominate PFD_avg in low demand functions.

What it takes to achieve a given SIL

With failures classified, the requirements for achieving a level can be stated. There are three separate sets. They are not alternatives, and compliance is not achieved by satisfying whichever is most convenient. All must be satisfied.

1. Systematic capability

Systematic failures are those built in by a deficiency in specification, design, manufacture, operating procedure or documentation. They cannot be removed by adding redundancy, because a second identical unit would simply repeat the same design error.

They are addressed by the development process itself: the rigour required of development and management activities increases with each level.

The standard gives the element-level property its own name and scale: systematic capability, expressed SC 1 to SC 4, defined as a measure of confidence that an element's systematic safety integrity meets the requirements of a specified SIL.

"SIL 2 capable" on a third-party certificate is a systematic capability claim, assessed by auditing the development and quality management system against the standard's requirements. It is not a guarantee that the device delivers SIL 2 in every loop it is placed in.

2. Architectural constraints

Architectural constraints impose a minimum hardware fault tolerance (HFT): in effect, a floor on redundancy, independent of the calculated failure probability.

A hardware fault tolerance of zero means a single set of equipment performs the function. A fault tolerance of one means one additional set is present, as in a 1oo2 or 2oo3 arrangement. In this MooN notation, M of N channels must agree before the safety action is taken: 1oo2 acts if either of two channels demands it, and 2oo3 requires two of three.

IEC 61508 offers two routes for architectural constraints:

• Route 1_H uses the safe failure fraction (SFF), the proportion of an element's failures that are safe rather than dangerous undetected, combined with the element's type.
• Route 2_H, introduced in the 2010 edition, relies instead on field reliability data for the element.

3. Target failure measure

The calculated PFD_avg or PFH for the function must fall within the band for the given SIL. The calculation considers:

• the dangerous failure rates of each element;
• the proportion of dangerous failures the diagnostics detect;
• the proof test interval;
• how thoroughly the proof test covers the failure modes;
• the time to repair;
• the intended mission time.

For the simplest case, a single channel (1oo1) in low demand mode, IEC 61508-6 gives:

PFD_avg ≈ λ_DU × (T₁/2 + MRT) + λ_DD × MTTR

• λ_DU is the rate of dangerous undetected failures, and λ_DD the rate of dangerous detected failures.
• T₁ is the proof test interval. On average an undetected failure goes unnoticed for half of it.
• MRT is the mean repair time, and MTTR the mean time to restoration after a failure is detected.

The first term usually dominates, which is why dangerous undetected failures dominate PFD_avg. The equation assumes every proof test reveals every undetected failure; where proof test coverage is incomplete, the uncovered failures stay hidden for longer and the true figure is higher. Redundant arrangements such as 1oo2 and 2oo3 have their own, longer equations in the same annex (IEC 61508-6:2010, Annex B, B.3.1 and B.3.2.2.1).

The weakest contributor sets the level

The achieved SIL of a function is limited by the weakest contributor to each of the three requirements. A function whose sensor and logic solver satisfy SIL 3 but whose final element satisfies only SIL 2 achieves SIL 2. The levels do not average.

Meeting the target: diagnostics, proof testing and redundancy

The following aspects support meeting a given SIL target:

• Diagnostic coverage converts dangerous undetected failures into dangerous detected ones.
• Proof testing bounds how long an undetected failure can persist. Testing more often reduces the average exposure, at the cost of more maintenance. Proof test coverage matters alongside the interval, since a test that exercises only part of the function leaves the remainder undetected however frequently it is run.
• Redundancy and voting address a different problem. Redundancy improves the probability that the function acts when needed, and the choice of voting arrangement also trades this against spurious trips, which have their own cost and their own safety consequences. However, redundancy is subject to common cause failure: a shared stress such as vibration, a shared power supply, a shared calibration error or a common manufacturing defect can disable several channels at once.

The same three letters across different standards

The description above follows IEC 61508. It is the parent standard, and a family of sector standards build upon it, for example:

• IEC 61511 for the process industries,
• IEC 61513 for nuclear,
• IEC 62061 for machinery,
• and EN 50128 and EN 50129 for railway software and signalling.

Within that family the same general principles apply.

Other standards define SIL numbers differently, and the automotive standard ISO 26262 uses a separate scale altogether: the automotive safety integrity level (ASIL), running A to D rather than 1 to 4, and derived from severity, exposure and controllability rather than from a target failure measure in the IEC form.

What a SIL does not tell you

• Whether it was the right function for the job. A SIL describes how likely a safety function is to perform the function it was specified to perform. It says nothing about whether that was the right function to specify. An instrument unsuitable for the hazard, measuring the wrong variable or measuring too slowly to intervene, can be highly reliable and still fail to prevent the event, and its integrity will not have been misreported. Integrity and suitability are separate questions, and SIL measures only the first.
• Anything about a plant as a whole. The level belongs to a function; a plant contains many functions with different targets.
• That higher is better. Each step up demands more rigour, more redundancy, more frequent testing and more cost, and brings greater exposure to spurious operation. The target is determined by the risk gap; specifying above it is not a free improvement.

In the process industries SIL 4 is rare to the point of near-absence, and a determination that arrives at SIL 4 is usually treated as a signal to revisit the design rather than a specification to build to. Most process safety work sits in the range SIL 1 to SIL 3. Higher levels appear more often in sectors such as rail.

Summary

A SIL is a target integrity for a safety function, not a property of a device.

It consists of one of four discrete levels, each spanning an order of magnitude of PFD_avg in low demand mode or PFH in high demand and continuous mode.

The level is set by the gap between the risk as it stands and the risk the organisation will tolerate, using a method such as LOPA.

Achieving it requires systematic capability, architectural constraints and the target failure measure all to be met, and the weakest contributor to each sets the level achieved.

A SIL only defines how reliably the specified function performs, not whether it was the right function to specify.

Sources

• IEC 61508-1:2010, Functional safety of electrical/electronic/programmable electronic safety-related systems, Part 1: General requirements, Tables 2 and 3.
• IEC 61508-4:2010, Part 4: Definitions and abbreviations, clauses 3.5.8, 3.5.9, 3.5.16 and 3.5.17.
• IEC 61508-6:2010, Part 6: Guidelines on the application of IEC 61508-2 and IEC 61508-3, Annex B, B.3.1 and B.3.2.2.1.