What Is a Safety Integrity Level (SIL) and How Do You Determine It?

If you design, operate, or maintain safety instrumented systems (SIS), you have likely encountered the term "Safety Integrity Level" or SIL. But what does SIL actually mean, and how do you calculate it correctly? This article explains the concept, the classification table, and the practical steps to determine SIL, based on the international standards IEC 61508 and IEC 61511.

What It Is

A Safety Integrity Level (SIL) is a discrete level (1 to 4) that defines the required reduction of risk provided by a safety function. The higher the SIL, the lower the probability that the safety function will fail to operate when demanded.

SIL is defined in IEC 61508 (Functional safety of electrical/electronic/programmable electronic safety-related systems) and applied in the process industry via IEC 61511 (Safety instrumented systems for the process industry sector). These standards are the authoritative references for SIL determination and verification.

SIL is not a property of a single device. It is a property of a safety function as implemented by the entire safety loop — sensors, logic solver, and final elements.

How It Works / Formula or Steps

SIL is determined by two main quantitative measures:

1. Average Probability of Failure on Demand (PFDavg) — for systems operating in low-demand mode (demanded less than once per year).
2. Risk Reduction Factor (RRF) — the inverse of PFDavg.

The relationship is:

\[
RRF = \frac{1}{PFD_{avg}}
\]

The SIL classification table (from IEC 61508-1, Table 2) is a public standard value:

SIL | PFDavg (low demand) | RRF (approx.)

• 1 | ≥ 10⁻² to < 10⁻¹ | 10 to 100
• 2 | ≥ 10⁻³ to < 10⁻² | 100 to 1,000
• 3 | ≥ 10⁻⁴ to < 10⁻³ | 1,000 to 10,000
• 4 | ≥ 10⁻⁵ to < 10⁻⁴ | 10,000 to 100,000

Steps to determine SIL (simplified):

1. Identify the safety function and its required risk reduction.
2. Perform a risk analysis (e.g., LOPA — Layer of Protection Analysis) to determine the target risk reduction.
3. Select the target SIL from the table above based on the required PFDavg.
4. Design the SIS (sensor, logic solver, final element) to meet the target PFDavg.
5. Verify the achieved PFDavg using reliability data (failure rates) and architecture constraints (redundancy, proof-test interval).

A Worked Illustrative Example

Example data (illustrative only):

A process requires a risk reduction of 200 for a specific hazard. From the table, an RRF of 200 corresponds to a PFDavg between 10⁻³ and 10⁻² — that is SIL 2.

To achieve SIL 2, you might design a single-channel SIS with a proof-test interval of 1 year. Suppose the total loop failure rate (dangerous undetected) is \( \lambda_{DU} = 0.002 \) per year. Then:

\[
PFD_{avg} \approx \frac{\lambda_{DU} \times T}{2} = \frac{0.002 \times 1}{2} = 0.001
\]

This equals 10⁻³, which is the boundary of SIL 2 (≥ 10⁻³ to < 10⁻²). In practice, you would add margin or use redundancy to stay clearly within the SIL 2 range.

Common Pitfalls

• Confusing SIL with device reliability. A SIL rating on a single transmitter does not guarantee the whole loop meets that SIL.
• Ignoring proof-test interval. PFDavg depends directly on how often you test the safety function. Longer intervals increase PFDavg.
• Using only average values. Architectural constraints (hardware fault tolerance) from IEC 61508-2 must also be satisfied.
• Applying SIL 4 casually. SIL 4 is extremely demanding and rarely used; most process applications are SIL 1 to SIL 3.

Closing

Determining the correct SIL is essential for safe and cost-effective SIS design. Use the free SIL tool at https://www.6sq.com/tools/sil/ to quickly calculate PFDavg, RRF, and the corresponding SIL level based on your input data. Always verify your results against IEC 61508 / IEC 61511 and consult a functional safety specialist for critical applications.