When to use: Use this during a process hazard analysis to determine the Safety Integrity Level a Safety Instrumented Function (SIF) must achieve. The calibrated IEC 61511 risk graph combines consequence severity (C), exposure/occupancy (F), possibility of avoidance (P), and demand rate (W) to yield the required risk reduction. The resulting SIL fixes the target average probability of failure on demand (PFDavg) for the safety loop. Confirm critical functions with a quantitative LOPA where required.
Safety Integrity Level (SIL) determination is the central output of a Safety Instrumented Function (SIF) design process: it specifies the required risk reduction that the safety system must achieve, expressed as an average probability of failure on demand (PFDavg). This estimator applies the calibrated IEC 61511 risk graph method — evaluating consequence severity, personnel exposure, avoidability, and demand rate — to determine whether a SIF is needed and at what SIL.
The IEC 61511 risk graph is a qualitative tool for SIL determination when a full quantitative Layer of Protection Analysis (LOPA) is not warranted. Four parameters are evaluated: C (consequence severity: A = minor, B = serious injury/one death, C = several deaths, D = catastrophic/many deaths), F (exposure/occupancy: A = rare to frequent <10% of time, B = frequent to continuous >10%), P (possibility of avoiding the hazard: A = possible, B = almost impossible), and W (demand rate of the unwanted event: W1 = very low ≤ once per 30 years, W2 = low once per 10 years, W3 = relatively high > once per 10 years).
The risk graph navigation yields a required SIL: SIL 1 (PFDavg 10⁻¹ to 10⁻², RRF 10–100), SIL 2 (PFDavg 10⁻² to 10⁻³, RRF 100–1000), SIL 3 (PFDavg 10⁻³ to 10⁻⁴, RRF 1000–10000), or SIL 4 (PFDavg 10⁻⁴ to 10⁻⁵, RRF 10000–100000). A result of "no SIL required" means other protection layers (e.g., BPCS controls, operator response) are sufficient; "beyond SIL 4" means a single SIF cannot provide sufficient risk reduction and the process design must be changed.
IEC 61511 (Functional Safety: Safety Instrumented Systems for the Process Industry) is the primary standard for SIS design in the process industry (oil & gas, chemical, pharmaceutical, food & beverage, water). IEC 61508 (Functional Safety of E/E/PE Safety-Related Systems) is the underlying generic standard. ANSI/ISA-84 (equivalent to IEC 61511) is the North American version. The risk graph method is defined in IEC 61511-3 Annex A. LOPA (Layer of Protection Analysis) per CCPS guidelines provides the quantitative alternative to the risk graph when more precision is needed. For machinery safety, IEC 62061 (Safety of Machinery) and ISO 13849 use different risk estimation methods (Performance Level, PL).
The SIL determines the required architecture and testing interval for the Safety Instrumented System (SIS). SIL 1 can typically be achieved with a single-channel (1oo1) architecture and a proof-test interval of 1 year. SIL 2 usually requires a redundant architecture (1oo2 or 2oo3) or a very short proof-test interval on a 1oo1 architecture. SIL 3 almost always requires 2oo3 redundancy with 3-month or shorter proof-test intervals and certified SIL 3 components (sensors, logic solver, final elements).
The SIF must achieve the SIL target through the combination of all components: initiator (sensor), logic solver (SIS PLC), and final element (valve/breaker). The PFDavg of each component is combined per IEC 61511-1 Clause 11 (series calculation for 1oo1, parallel reduction for redundant architectures). Common-cause failure (beta factor, typically 2–10%) limits the achievable SIL in redundant architectures.
Select the consequence severity (C), frequency of exposure (F), possibility of avoidance (P), and demand rate (W) from the dropdown menus. Each parameter has a brief description to guide the selection. The calculator applies the IEC 61511 risk graph algorithm and displays the required SIL, the associated PFDavg range, and the Risk Reduction Factor (RRF = 1/PFDavg). Use the result as input to the SIS conceptual design — it tells you the minimum performance requirement for the safety loop, which drives architecture, component selection, and proof-test interval decisions.
SIL (Safety Integrity Level) is a qualitative classification (SIL 1 through SIL 4) that specifies a range of required risk reduction. PFDavg (Average Probability of Failure on Demand) is the quantitative measure of the safety system's unreliability: the probability that the system fails to perform its safety function when a demand occurs. SIL 1 = PFDavg 10⁻¹ to 10⁻² (fails 1 in 10 to 1 in 100 demands). SIL 2 = 10⁻² to 10⁻³. SIL 3 = 10⁻³ to 10⁻⁴. The RRF (Risk Reduction Factor) = 1/PFDavg and is the factor by which the SIF reduces the risk.
LOPA (Layer of Protection Analysis) is required when: the risk graph gives a result that appears inconsistent with engineering judgment (too high or too low), the consequence is catastrophic and SIL 3 or 4 is indicated (LOPA provides better defensibility), multiple independent protection layers exist and their combined risk reduction must be quantified, or the client or regulatory body requires quantitative risk assessment. The risk graph is appropriate for initial SIL screening and for well-understood hazard scenarios with clear parameter selections.
The demand rate (W) is the frequency at which the process reaches the hazardous condition that requires the SIF to act. W1 = very rare, once per 30 years or less (highly reliable upstream controls, well-maintained equipment). W2 = low, approximately once per 10 years. W3 = relatively high, more often than once per 10 years. Demand rate is estimated from process history, reliability data for upstream equipment (pumps, valves, control loops), and HAZOP findings. The Basic Process Control System (BPCS) is the first layer of protection that reduces the initiating cause frequency.
The maximum SIL achievable with a 1oo1 (one-out-of-one, simplex) architecture is SIL 2 in most practical implementations, because the PFDavg is limited by the dangerous failure rate of the individual components and the proof-test interval. SIL 3 requires low enough component failure rates (or short enough proof-test intervals) that are rarely achievable with 1oo1 field devices. SIL 3 almost always requires redundant initiators (2oo3 voting) and a redundant logic solver. SIL 4 is very rare and requires the highest-grade certified components with frequent testing.
Common-cause failure (CCF) is a failure mode where a single root cause defeats multiple redundant channels simultaneously — for example, the same instrument calibration error affecting two transmitters, or a shared power supply failure taking out both channels of a redundant SIS. The beta factor (β) represents the fraction of failures that are common-cause: β = 2–10% for well-designed redundant systems with diversified components. CCF limits the achievable PFDavg of redundant architectures: even a perfect 2oo3 system cannot achieve better than PFDavg = β × λ_D × T_proof due to common-cause failures.
Try our SCADA Studio
More calculators, simulators, and guides for this discipline.