Advanced Functional Safety Engineering
Safety Integrity Levels
What is a Safety Integrity Level?
A Safety Integrity Level (SIL) is a way to measure the performance required for a safety function. Think of it as a rating for how reliable a safety system needs to be. The higher the risk of a potential accident, the higher the SIL required for the safety system designed to prevent it.
This concept is a cornerstone of functional safety standards like IEC 61508, which applies across many industries. The goal is to quantify the necessary risk reduction. If a process has an inherent risk, a safety function is put in place to lower that risk to an acceptable level. The SIL tells you how much that risk needs to be lowered.
In short, SIL measures the reliability of a safety instrumented function (SIF) in carrying out its job.
The Four Levels
SIL is classified into four distinct levels, from SIL 1 to SIL 4. SIL 1 is the lowest level of integrity, and SIL 4 is the highest. A higher SIL means a greater required level of safety performance and a lower probability that the system will fail to perform its safety function when needed.
To assign these levels, we look at the probability of failure. The specific metric depends on how often the safety function is expected to work.
For systems that operate on-demand (low-demand mode), we use the average Probability of Failure on Demand (PFDavg).
For systems that operate continuously or frequently (high-demand or continuous mode), we use the average Probability of a dangerous Failure per Hour (PFH).
| SIL | PFDavg (Low-Demand Mode) | PFH (High-Demand/Continuous Mode) |
|---|---|---|
| 4 | ≥10⁻⁵ to <10⁻⁴ | ≥10⁻⁹ to <10⁻⁸ |
| 3 | ≥10⁻⁴ to <10⁻³ | ≥10⁻⁸ to <10⁻⁷ |
| 2 | ≥10⁻³ to <10⁻² | ≥10⁻⁷ to <10⁻⁶ |
| 1 | ≥10⁻² to <10⁻¹ | ≥10⁻⁶ to <10⁻⁵ |
As you can see, a system requiring SIL 4 has an extremely low probability of failure. These are reserved for the most critical applications where failure could have catastrophic consequences, such as in nuclear power plants or chemical processing.
How to Determine a SIL
Determining the required SIL for a safety function isn't guesswork. It's the result of a formal hazard and risk analysis. The general idea is to assess the risk of a hazardous event without the safety function in place. The difference between that inherent risk and the target tolerable risk level tells you how much risk reduction you need. This required risk reduction then maps to a SIL.
Several methods exist for this analysis. A common one is the Risk Graph method. It provides a qualitative way to determine SIL by considering a few key parameters:
- Consequence (C): How severe are the potential consequences of the hazard?
- Frequency and Exposure Time (F): How often and for how long are people exposed to the hazard?
- Possibility of Avoiding Hazard (P): How likely is it that the hazard can be avoided if the safety function fails?
- Probability of the Unwanted Occurrence (W): How likely is the hazardous event to happen in the first place?
By answering questions about these parameters, you can follow a path on a graph that leads to a required SIL.
Other more quantitative methods like Layer of Protection Analysis (LOPA) are also widely used, especially in the process industries. LOPA analyzes the different independent layers of protection that stand between a hazard and a potential accident.
SIL vs. Performance Level
You may also hear the term Performance Level, or PL. Both SIL and PL are used to specify the required reliability of a safety function, but they originate from different standards and are used in different contexts.
- SIL comes from IEC 61508 and is primarily used in the process industries (like chemical plants, oil and gas).
- PL comes from ISO 13849-1 and is used for the safety-related parts of machine control systems.
While they have different calculation methods and underlying parameters, their goals are the same: ensuring a safety function is reliable enough for the risk it controls. PL is specified in levels from 'a' to 'e' (PLa to PLe).
There's an approximate correspondence between the two rating systems, which is helpful when working across different types of equipment.
| Performance Level (PL) | Probability of dangerous Failure per Hour (PFH) | Approximate SIL Equivalent |
|---|---|---|
| a | ≥10⁻⁵ to <3x10⁻⁵ | None |
| b | ≥3x10⁻⁶ to <10⁻⁵ | SIL 1 |
| c | ≥10⁻⁶ to <3x10⁻⁶ | SIL 1 / SIL 2 |
| d | ≥10⁻⁷ to <10⁻⁶ | SIL 2 |
| e | ≥10⁻⁸ to <10⁻⁷ | SIL 3 |
Notice that PL doesn't go as high as SIL 4. The highest PL, 'PLe', is roughly equivalent to SIL 3. This reflects the different risk profiles of the industries they serve; machinery applications typically do not require the extreme level of risk reduction associated with SIL 4.
What is the primary purpose of a Safety Integrity Level (SIL)?
As the Safety Integrity Level (SIL) increases from SIL 1 to SIL 4, what happens to the required performance of the safety function?
Understanding SILs and PLs is crucial for designing and implementing effective safety systems that match the level of risk.