Safety Integrity Levels and SIL Allocation
Safety integrity levels and SIL allocation
This domain tests the SIL scale, the difference between low-demand PFDavg and high-demand/continuous PFH, and the methods used to allocate a target SIL. Expect LOPA, risk graph, risk matrix, and ALARP-based allocation questions.
Core rules
- SIL is a target for a safety function, not a label for a device. A transmitter may be "SIL 2 capable"; the function's achieved SIL depends on the whole loop.
- Low demand: SIL 1 0.01–0.1 PFDavg; SIL 2 0.001–0.01; SIL 3 0.0001–0.001; SIL 4 0.00001–0.0001. High demand/continuous uses PFH: SIL 1 1e-6 to 1e-5/h, SIL 2 1e-7 to 1e-6/h, SIL 3 1e-8 to 1e-7/h.
- Allocation must consider risk reduction already credited to other layers; over-allocating SIL raises cost and can reduce availability without improving safety.
- Systematic capability and architectural constraints must support the target SIL; otherwise the function cannot claim it.
- Document the allocation basis: scenario, initiating frequency, IPL credits, consequence, and tolerated risk.
Worked example
LOPA gives a mitigated frequency of 5e-3/yr before the SIF and a tolerable frequency of 5e-5/yr. Required SIF RRF = 100; PFDavg target = 0.01. The boundary lands exactly on the SIL 1/SIL 2 interface; good practice is to specify SIL 2 or justify SIL 1 with margin, because the estimate is not exact and proof-test degradation will consume margin.
Traps
- Calling a device "SIL 3" and assuming the loop is SIL 3.
- Mixing PFDavg and PFH, or using low-demand bands for continuous mode.
- Allocating SIL from consequence alone without likelihood and IPL credits.
- Ignoring systematic capability and architectural constraints.