What is SIL?
SIL (Safety Integrity Level) is one of four discrete levels defined in IEC 61508 that specify how reliably a safety function must work, expressed as the maximum tolerable probability that the function fails at the moment it is needed. The higher the SIL, the lower the permitted probability of failure and the stricter the requirements for design, components, testing and documentation. A SIL belongs to a single safety function, called a Safety Instrumented Function (SIF) within an SIS, such as overfill protection or an emergency stop, not to a whole plant or an individual device. The concept is applied in SIS (Safety Instrumented Systems) in the process industry and in safety-related machine control systems.
SIL determines how much risk a safety function may leave at most.
🎯 Why does SIL classification exist?
Every plant carries residual risks: a tank can overflow, a reactor can overpressurise, a robot arm can strike someone. A safety function reduces such a risk, but only if it works when it matters. SIL makes that reliability measurable and verifiable. The aims of SIL classification are:
- Controlling risks to an acceptable level - the safety function delivers exactly the risk reduction the risk analysis calls for
- Making reliability demonstrable - with failure probability calculations, certificates and test results instead of assumptions
- Choosing proportionate measures - a SIL 1 function needs less redundancy, diagnostics and testing effort than a SIL 3 function
- Preventing injury, environmental damage and process losses - even when the normal process control fails
🔢 What do the four SIL levels mean?
IEC 61508 distinguishes two modes of operation. In low demand mode the function is called upon at most once a year; the measure is then the average probability of failure on demand (PFDavg). In high demand or continuous mode the average frequency of dangerous failure per hour (PFH) applies. Most process safeguards operate in low demand mode, many machine functions in high demand mode.
| SIL | PFDavg (low demand) | Risk reduction factor (RRF) | PFH (high demand, per hour) |
|---|---|---|---|
| SIL 1 | 10⁻² to 10⁻¹ | 10 – 100 | 10⁻⁶ to 10⁻⁵ |
| SIL 2 | 10⁻³ to 10⁻² | 100 – 1,000 | 10⁻⁷ to 10⁻⁶ |
| SIL 3 | 10⁻⁴ to 10⁻³ | 1,000 – 10,000 | 10⁻⁸ to 10⁻⁷ |
| SIL 4 | 10⁻⁵ to 10⁻⁴ | 10,000 – 100,000 | 10⁻⁹ to 10⁻⁸ |
The risk reduction factor is the inverse of the PFDavg: on average, a SIL 2 function fails less than once in every hundred demands. In practice SIL 1 to SIL 3 dominate. SIL 4 is rare; IEC 61511 imposes additional requirements as soon as instrumented safeguards together must deliver a risk reduction of 10,000 or more, and most companies then prefer a safer process design instead.
📏 Which standards use SIL?
SIL is defined in the basic standard IEC 61508 (edition 2 from 2010; edition 3 is expected around 2027). Sector standards translate it into their own practice:
| Standard | Scope | SIL range |
|---|---|---|
| IEC 61508 | Generic basic standard for E/E/PE safety systems and component suppliers | SIL 1–4 |
| IEC 61511 (ed. 2, 2016) | Safety Instrumented Systems in the process industry | SIL 1–4, in practice up to SIL 3 |
| IEC 62061 (ed. 2, 2021) | Safety-related control systems for machinery | SIL 1–3 |
| ISO 26262 | Electronics in road vehicles | Own scale: ASIL A–D |
| ISO 13849-1 (ed. 4, 2023) | Safety-related parts of machine control systems | No SIL but Performance Level a–e |
For machinery, PL and SIL can be compared via the PFHd: PL b and c correspond to SIL 1, PL d to SIL 2 and PL e to SIL 3. PL a has no SIL equivalent.
🔧 How do you determine the required SIL?
The required SIL follows from a risk analysis, not from the industry sector or the type of plant. The usual steps:
- Identify hazards - with a HAZOP, FMEA or bow-tie analysis
- Estimate the risk without the safety function - how often does the hazardous situation arise and how severe is the consequence?
- Credit existing protection layers - alarms with operator response, mechanical pressure relief, the basic process control system. IEC 61511 allows at most a risk reduction of 10 for a single layer in the basic control system
- Compare with the tolerable risk - the gap between the remaining risk and the acceptable risk is the required risk reduction
- Assign the SIL - the required RRF falls within one SIL band, which is recorded in the Safety Requirements Specification (SRS)
For steps 3 to 5, teams use a risk graph (qualitative, with the parameters consequence, exposure, possibility of avoidance and demand rate) or a LOPA (semi-quantitative). Both methods appear as informative annexes in IEC 61511-3. The risk graph is quick and suitable for screening out low-SIL functions; for functions with severe consequences, LOPA gives a better-substantiated answer.
🧮 What does a SIL calculation look like in practice?
A simplified worked example for the overfill protection of a storage tank:
| Step | Value | Explanation |
|---|---|---|
| Initiating event | 0.1 per year | Failure of the level control loop in the basic control system, a common LOPA value |
| Operator alarm | PFD 0.1 | Independent high-level alarm with sufficient response time |
| Occupancy probability | 0.5 | Probability that someone is in the hazard zone |
| Frequency without SIF | 5 × 10⁻³ per year | 0.1 × 0.1 × 0.5 |
| Tolerable risk | 10⁻⁵ per year | Company criterion for a fatal accident |
| Required PFDavg | 2 × 10⁻³ | RRF 500, so SIL 2 |
Next comes SIL verification: does the design actually achieve that probability? For a single component without redundancy (1oo1), approximately PFDavg ≈ λDU × TI / 2, where λDU is the rate of dangerous undetected failures and TI the proof test interval. A valve with λDU = 2 × 10⁻⁶ per hour and an annual proof test comes out at around 8.8 × 10⁻³. That is too much for this budget. Two valves in a 1oo2 arrangement do bring the final element within the limit, even when you include common cause failures (often with a beta factor of 5 to 10%); additional partial stroke testing lowers the probability of failure further. The example shows that the test interval matters as much as the hardware.
A SIF only achieves its SIL when three conditions are met at the same time:
- Quantitative - the calculated PFDavg or PFH of sensor, logic solver and final element combined falls within the band
- Architecture - sufficient hardware fault tolerance (HFT). Under IEC 61511:2016, SIL 1 and SIL 2 in low demand mode may use a single channel (HFT 0); SIL 3 requires HFT 1. IEC 61508 offers Route 1H (based on the safe failure fraction and component type) and Route 2H (based on field reliability data) for this
- Systematic - every component has the right systematic capability (SC 1–4), demonstrated by an IEC 61508 certificate or documented prior use
🧱 Where is SIL applied?
| Safety function | Example | Typical SIL |
|---|---|---|
| Overpressure protection | HIPPS that isolates a pipeline before the design pressure is exceeded | SIL 2–3 |
| Tank overfill prevention | Independent level measurement that closes the inlet valves | SIL 1–2 |
| Emergency shutdown (ESD) and emergency stop | Shutting down a process unit or machine via a safety PLC | SIL 1–3 |
| Fire and gas detection | Detectors that trigger ventilation, extinguishing or shutdown | SIL 1–2 |
| Machine motion safety | Safety laser scanner for zone monitoring around a robot arm | SIL 2 |
The SIL in the third column is indicative; the outcome of the risk analysis can differ for each plant.
⚙️ What requirements apply to each part of a safety function?
| Part | SIL requirements in practice |
|---|---|
| Sensor (input) | Suitable for the SIL (certificate or prior use), diagnostics for wire break and measuring range, redundant (e.g. 2oo3) where the HFT requires it |
| Logic solver | Safety PLC or safety relay, certified to IEC 61508, usually up to SIL 3 |
| Final element (actuator) | Valve, motor starter or relay that moves to the safe state on failure (fail-safe) |
| Proof test | Periodic test that reveals undetected dangerous failures; the interval is a calculation parameter |
| Documentation | SRS, SIL verification, validation report, records of demands, failures and bypasses |
| Change management | Reassess every change to logic or hardware and revalidate where necessary |
What happens when that management is missing was shown by the disaster at the Buncefield storage terminal in the UK on 11 December 2005: a level gauge stuck and the independent high-level switch was inoperable. A safeguard that is not tested and maintained provides no real risk reduction.
🔐 What does cybersecurity mean for SIL?
The SIL calculation assumes random hardware failures and systematic faults, not deliberate manipulation. Yet modern logic solvers are connected via Industrial Ethernet to the DCS and the engineering station. In 2017 the TRITON malware attempted to reprogram Triconex safety controllers at a petrochemical plant in Saudi Arabia. A hacked safety function no longer achieves its SIL, whatever the calculation says.
That is why IEC 61511 has required a security risk assessment of the SIS in clause 8.2.4 since the 2016 edition. In practice this means a dedicated zone for the SIS in line with IEC 62443, restricted and logged engineering access, and the key switch in the RUN position. Note the difference in terms: a Security Level from IEC 62443 (SL 1–4) measures resistance against attackers, a SIL measures reliability against failure. Both must be right.
In the Netherlands, inspectors of Seveso establishments regard IEC 61511 as the state of the art for instrumented safeguards (see Seveso and Cybersecurity). For machinery, the Machinery Regulation applies from 20 January 2027 and classifies logic units for safety functions as high-risk products.
❓ Frequently asked questions
What is the difference between SIL and SIS?
An SIS (Safety Instrumented System) is the complete safety system with sensors, logic solver and final elements. SIL (Safety Integrity Level) is the measure of how reliable a single safety function within that SIS must be. One SIS often contains several functions, each with its own SIL.
Can a device be SIL 3 certified?
A device can be suitable for use up to SIL 3, but the SIL itself always applies to the complete safety function. A SIL 3-capable safety PLC does not deliver a SIL 3 function if the sensor or the valve only reaches SIL 1. Certificates therefore state the systematic capability and failure data that you use in the SIL verification.
Is SIL 4 higher than SIL 3?
Yes, SIL 4 is the highest Safety Integrity Level and requires a risk reduction of 10,000 to 100,000. SIL 4 hardly occurs in the process industry or machine building, because its design and verification are extremely demanding. Usually the process is changed so that SIL 3 or lower is sufficient.
How often must a SIL function be tested?
The proof test interval of a SIL function follows from the failure probability calculation and is recorded in the Safety Requirements Specification. It is often between one and several years and is aligned with the planned maintenance shutdown. A shorter test cycle lowers the average probability of failure and may therefore be needed to achieve the SIL.
What is the difference between SIL and Performance Level?
SIL comes from IEC 61508, IEC 61511 and IEC 62061 and has four levels; Performance Level comes from ISO 13849-1 and has five levels, from PL a to PL e. For machine control systems the two can be compared via the dangerous failure frequency per hour: PL d corresponds to SIL 2 and PL e to SIL 3.
Does cybersecurity play a role in SIL?
Cybersecurity has been an explicit requirement in the design of SIL functions in the process industry since IEC 61511 edition 2016. Clause 8.2.4 requires a security risk assessment of the SIS, because a manipulated safety function no longer achieves its SIL. The TRITON attack of 2017 showed that this risk is real.
📌 In summary
SIL determines how reliable a safety function must be to reduce a risk to an acceptable level, from SIL 1 (risk reduction 10–100) to SIL 4 (10,000–100,000). The required SIL follows from a risk analysis such as HAZOP and LOPA, and is only achieved when failure probability, architecture, systematic capability, proof testing and security all hold together. That makes SIL an essential tool for the design, auditing and assurance of process safety.