What is SIL: the safety integrity level of a safety function (SIF), SIL 1 to SIL 4, PFD and proof testing

A safety integrity level (SIL) states how reliably a safety function must reduce a process risk. IEC defines four levels, SIL 1 to SIL 4, and SIL 4 asks for the greatest risk reduction. A SIL belongs to a whole safety instrumented function (SIF), from the sensor through the logic solver to the valve, so a certified safety controller does not by itself make a function SIL 3. Where the safety instrumented system (SIS) sits in a plant's automation is covered in What is an ICSS.

1. First the safety function, then its SIL

IEC's overview of IEC 61508 asks two questions about every safety function. The hazard analysis decides what the function must do to prevent a hazardous event or limit its consequences. The risk assessment decides how likely the function must be to succeed, which is its safety integrity. IEC's own example: to stop a pressure vessel from rupturing, a valve must open within 2 seconds when the vessel pressure rises to 2.6 bar, and that function must reach SIL 2.

In a process plant these functions run in the SIS. NIST SP 800-82r3 describes an SIS as one or more SIFs, each typically made of sensors, logic solvers and final control elements, which bring the process to a safe state when set thresholds are crossed. Rockwell's Logix SIS safety reference manual defines the SIL as the relative level of risk reduction that a safety function provides.

IEC's overview states it directly: SIL is a property of a safety function. A Rockwell application technique for a low demand pressure trip shows what that means in practice: the probability of failure on demand is worked out for each subsystem, from the pressure transmitter, input module, controller and output module to the solenoid valve and the valve with its actuator, and the results give the SIL of the function. HSE makes the same point about product ratings. SILs quoted and certified for proprietary subsystems help when checking the architecture, but they do not remove the need to confirm that the function as a whole reaches its required SIL.

2. SIL 1 to SIL 4: what the bands mean

Each SIL has a quantified target failure measure. IEC's overview expresses the four levels as bands of risk reduction:

IEC's worked example stresses that the safety function lowers how often the harmful event happens, while the severity of its consequence stays the same.

How the target is measured depends on how often the function is called on. HSE's guidance describes low demand mode, where the function acts only occasionally, not more than once a year, and high demand or continuous mode, where it acts more often or all the time. For low demand, the measure is the probability of failure on demand (PFD); for high demand and continuous mode, it is a failure rate per hour. Rockwell's manuals use PFH, the average frequency of a dangerous failure per hour. This article gives no PFD or PFH figures for any product. For AADvance, Rockwell publishes PFDavg and PFH data in a separate document, ICSTT-RM449, and those figures belong in the verification of a specific function.

IEC's overview also explains why SILs exist. Early safety design focused on random hardware failures; complex systems need much more attention to systematic failures, such as an incorrect specification, software errors, human error, or maintenance and modification, and that drove the SIL concept. The HSE study IEC cites, of 34 incidents involving control systems, traced 44 % of failures to the specification and found that more than 60 % were built into the systems before they went into service.

3. Where the SIL target comes from

The SIL target is set before any hardware is chosen. HSE describes the steps: identify the hazards and what can start them, estimate how likely each is, evaluate the overall risk from likelihood and consequence, and work out the risk reduction needed to reach a tolerable level. The required safety functions are then allocated to different systems: instrumented systems, other technology and external measures. IEC adds that the SIL follows from the tolerable risk, taking the other risk reduction measures into account.

The method varies. Part 5 of IEC 61508 is titled "Examples of methods for the determination of safety integrity levels". HSE mentions both quantitative failure targets and a qualitative approach based on likelihood, consequence, exposure and the chance of avoiding the hazard. For fuel storage sites, the Buncefield Standards Task Group suggested layers of protection analysis (LOPA) as a consistent way to set SILs, and HSE research report RR716 reviewed how site operators carried out those studies. In HSE's guidance for COMAH sites, the records that link a SIS to its hazard include HAZOP or other risk assessment results and the safety requirements specification (SRS).

4. What makes a SIF reach its SIL

• The whole loop. HSE counts every element needed to perform the safety function, utilities included, as part of the safety related system. A certified logic solver cannot make up for a transmitter or a shutdown valve that fails to do its part.
• Architecture and hardware fault tolerance. A hardware fault tolerance of n means that n+1 faults could cause the loss of the safety function. According to HSE, IEC 61508 Part 2 sets architectural constraints, a minimum fault tolerance and diagnostic coverage for each element or subsystem. AADvance supports 1oo1D, 1oo2D and 2oo3D topologies, and fault tolerance comes from configuring dual or triplicated modules, and Rockwell states that the AADvance system and its safety manual are certified by an independent certification body to the requirements of IEC 61508 SIL 3. Which module counts each SIL needs is covered in AADvance vs Trusted.
• Systematic capability. Rockwell's Logix SIS safety reference manual gives the IEC 61508-4 definition: systematic capability is the confidence that the systematic safety integrity meets the requirements of the specified SIL. Rockwell states that AADvance meets the systematic capability requirements for SIL 3 (SC 3). On the plant side, HSE names a properly managed safety lifecycle, independence and diversity as the protection against systematic and common mode failures.
• Proof testing. HSE notes that where diagnostic coverage is low, integrity depends critically on the proof test interval, and it expects written proof test procedures that reveal undetected faults. The AADvance safety manual requires the operation and maintenance plan to include the periodic test procedures and the maximum intervals between tests. Rockwell's Logix SIS manual leaves the proof test interval to the specific application.

5. SIL is not an IEC 62443 security level

The IEC 62443 security levels, SL 1 to SL 4, describe the attacker a zone, conduit or product should resist; see IEC 62443 explained. A SIL describes the risk reduction a safety function provides against a process hazard. Both scales have four steps and both start from a risk assessment, but they come from different standards and answer different questions: a SIL 3 function says nothing about the security level of the network it sits on. NIST notes that safety assessments deal with the physical world and security risk assessments with the digital one, that the two overlap in OT, and that combining control and safety functions or networks could give an attacker access to both.

6. SIS and BPCS stay independent

NIST describes the SIS as often independent of the other control systems, so that a failure of the basic process control system (BPCS) does not harm the safety functions. HSE asks for protective systems to be sufficiently independent of the control system; where they share an interface or utilities, the way independence is achieved should be defined and common cause failures considered. Architecture and integration points are in the ICSS article and the DCS article.

What TDL checks first

The SIL target comes from the plant's hazard and risk assessment and is written into the safety requirements specification; TDL implements and tests the SIS against it. Before we program, modify or test a SIS, we check:

• the SRS: every SIF has its tag, the SIL target and the safe state, and the revision matches what we were sent;
• the cause and effect matrices for ESD and fire and gas: numbered, revision-controlled and consistent with the SRS;
• the bypass philosophy: which inputs may be bypassed, who authorises a bypass, how it shows on operator screens and how it is removed;
• that a proof test procedure exists for each SIF, with the test interval the design assumed;
• on an existing AADvance or Trusted system, the safety manual edition and the module architecture against the SIL each function needs;
• the plant's management of change procedure for safety logic, before any change is made.

How TDL works on safety systems

TDL builds safety instrumented systems for SIL 2 and SIL 3 functions on AADvance and Trusted, including ESD and fire and gas; see ICSS and safety systems and oil and gas automation. For Vietsovpetro's Central Compressor Platform in the Bach Ho field (2016), the project used an AADvance process safety system rated SIL 3 for the fire and gas functions; TDL supplied the main materials and engineering consulting. At the Golden Pass LNG terminal in Texas (2025), a TDL engineer carried out the functional testing of the BMS/SIS for SIL 2 safety functions while commissioning the auxiliary boiler control system. How a cause and effect matrix becomes SIS logic and how it is tested: cause and effect matrix and SIS testing.