Safety Integrity Level
Safety Integrity Level (SIL) is a discrete level (1–4) specifying the target safety integrity required of a safety function, defined by quantitative failure measures (probability/frequency of dangerous failure) and qualitative requirements (design, hardware, software, lifecycle processes). SIL 4 provides the highest risk reduction, SIL 1 the lowest. SIL is assigned to a safety instrumented function (SIF) or safety-related system, not to individual components.
On a manufacturing shop floor, SIL applies to safety functions like emergency shutdowns on furnaces, guard-interlocked safety functions on robots/presses, gas detection SIFs, and high-level shutdowns in tanks. SIL is determined through hazard and risk analysis (HazOp/LOPA) to assign a target SIL to each SIF. Design involves selecting SIL-capable devices, meeting hardware fault tolerance and architecture constraints, and verifying PFDavg or failure frequency. Operation requires periodic proof tests, change control, and maintenance to preserve SIL assumptions. In BC/US, SIL practices align with WorkSafeBC/OSHA general duty obligations, where using IEC/CSA-based SIL methods is considered due diligence for complex automated systems.
- Misunderstanding what is 'SIL-rated': Treating individual devices as SIL-rated instead of recognizing that SIL applies to the entire safety function/system, leading to overconfidence and potential non-compliance.
- Assigning SIL without rigorous risk analysis: Choosing SIL levels based on generic rules rather than formal risk assessment (HazOp/LOPA), causing under- or over-specification of safety functions.
- Not maintaining SIL over the lifecycle: Extending proof test intervals, replacing components without re-evaluation, or bypassing interlocks, resulting in actual dangerous failure probability exceeding the target SIL and regulatory non-compliance.
How are SIL 1–4 quantitatively distinguished?
IEC 61508 and IEC 61511 define SIL ranges in terms of PFDavg for low-demand SIFs and dangerous failure frequency for high-demand/continuous SIFs. Each step in SIL represents roughly an order of magnitude reduction in dangerous failure probability or frequency. Designers must ensure the calculated PFDavg or failure frequency for the SIF lies within the range specified for its target SIL.
How does Systematic Capability (SC) constrain achievable SIL?
Each device in a SIF is assigned a Systematic Capability (SC) rating. The achieved SIL is limited by the lowest SC of any device in the SIF. Even if PFDavg calculations are low and architecture meets high fault tolerance, the SIF cannot claim a SIL higher than the lowest SC device.
What role do architecture constraints and hardware fault tolerance (HFT) play?
IEC 61508/61511 set architecture constraints specifying minimum hardware fault tolerance and safe failure fraction for each SIL. For higher SILs, systems usually require redundant architectures (e.g., 1oo2, 2oo3) and enhanced diagnostics. Simply adding redundant devices is not sufficient; architecture must satisfy standard-defined constraints.