Safety Integrity Level (SIL) Explained

Process plants rely on several layers of protection against hazards such as overpressure, overfilling, runaway reactions and toxic releases. One of the most important is the safety instrumented system (SIS): sensors, a safety PLC and final elements such as valves that automatically bring the process to a safe state when a dangerous condition is detected. SIL tells engineers how dependable each of those functions must be.

Safety instrumented functions

A SIF has three parts:

• Sensor(s): pressure, level, temperature or flow transmitters, switches or analysers that detect the hazardous condition. Reliable pressure measurement and level measurement are common SIF inputs.
• Logic solver: a certified safety PLC that evaluates inputs and decides to trip.
• Final element(s): shutdown valves, motor contactors or breakers that act on the process.

Example: “On high-high pressure in the separator (PT-101 above 18 barg), close the inlet shutdown valve XV-101 within 5 seconds.”

Download diagram (WebP)

Safety integrity level bands

For low demand mode (the SIF is called on less than once a year, typical in process plants):

For high demand or continuous mode, such as machinery safety, SIL is defined by the average frequency of dangerous failure per hour (PFH), for example SIL 2 is 10⁻⁷ to below 10⁻⁶ per hour.

$$RRF = \frac{1}{PFD_{avg}}$$

SIL determination

The required SIL comes from hazard and risk analysis, usually after a HAZOP study:

• Layer of protection analysis (LOPA): estimates the frequency of an initiating event, multiplies by the PFD of each independent protection layer (basic control, alarms with operator response, relief valves) and compares the result with a tolerable frequency. The gap is the risk reduction the SIF must provide.
• Risk graphs: qualitative charts using consequence, occupancy, possibility of avoidance and demand rate.
• Risk matrices calibrated for the purpose, as in risk matrix.

$$RRF_\text{required} = \frac{f_\text{unmitigated}}{f_\text{tolerable}}$$

SIL verification

The designed SIF must meet three groups of requirements for the target SIL:

1. Probability of failure: PFDavg calculated from dangerous undetected failure rates (λ_DU), proof test interval and architecture.
2. Architectural constraints (hardware fault tolerance): minimum redundancy depending on SIL and device type, for example a 1oo2 (one out of two) arrangement of transmitters.
3. Systematic capability: design, software and management processes that prevent systematic errors, shown by certification to IEC 61508 or proven in use data.

For a single (1oo1) device tested every T_I hours, a simplified formula is:

$$PFD_{avg} \approx \frac{\lambda_{DU} \times T_I}{2}$$

The safety lifecycle

IEC 61511 defines a lifecycle: hazard and risk assessment, allocation of safety functions to protection layers, safety requirements specification (SRS), design and engineering, installation and commissioning, validation, operation and maintenance including proof testing, management of change and decommissioning. Functional safety assessments at key stages and competent personnel are required throughout. Many SIL failures come not from hardware but from poor specifications, bypasses left active and missed proof tests.

Proof testing and operation

During operation, many dangerous failures stay hidden until the SIF is called on. Proof tests at planned intervals reveal these hidden failures so they can be repaired. A good proof test exercises the whole function from sensor to final element, for example applying a test pressure to the transmitter and confirming that the valve closes fully within the required time. Partial stroke testing of valves between full tests improves PFD. Records of every test, demand, failure and bypass show whether the assumed failure rates are realistic.

Practical tips

• Keep SIFs as simple as possible and independent from the basic process control system.
• Use devices with certified failure data and suitable for the process conditions.
• Plan proof test procedures at design stage and make them practical.
• Track demands, failures and bypasses in operation to confirm assumptions.
• Use MTBF and availability data carefully: functional safety relies on dangerous undetected failure rates, not total failure rates.

A correctly specified and maintained safety integrity level gives a plant a quantified, auditable level of protection, closing the gap between the risk that exists and the risk that is tolerable.