Three Misconceptions about the Safety Integrity Level (SIL)

The SIL rating required depends on the initial risk inherent to the plant's systems or processes. The following applies: The residual risk remaining after risk reduction must be lower than the tolerable risk. If this is achievable with SIL 2, then the installation of a SIL 3 protective device could, in some circumstances, be too much of a good thing.

The over-fulfillment of a SIL can result in unnecessary effort and avoidable cost, much the same as over-insurance in the private sector is unnecessarily expensive and a waste of money. The aim is to design the protective device so that the risk reduction it achieves corresponds as closely as possible to the required SIL.

Quantifying the failure probability of a protective device is not sufficient to fulfill a Safety Integrity Level. Primary measures for the prevention and control of faults must be implemented to this end. The relevant standard requires, first and foremost, the application of a special quality management system (Functional Safety Management System).

In addition, failure control by means such as redundancy, fail-safe behavior, and fault detection (diagnostics) are mandatory. The extent to which these measures need to be applied depends on the targeted SIL.