A Safety Integrity Level, or SIL, is a measure of the risk reduction a safety function provides, from SIL 1 (least) to SIL 4 (most). IEC 61508 defines four levels. A SIL belongs to a safety function or system, not to a single component or a piece of software.
How a SIL is set
SIL allocation is a risk exercise. You estimate risk without the safety function, compare it with a tolerable target, and the gap sets the risk reduction needed. Each order of magnitude of reduction raises the level, up to SIL 4. Common methods are risk matrices, risk graphs and layer of protection analysis (LOPA), the last being widely used in large industrial facilities.
If SIL 4 would still not be enough, other safeguards, including non instrumented ones, have to be designed in.
The numbers
For functions used rarely (low demand), the measure is the average probability of failure on demand, PFD:
- SIL 1: PFD 0.1 to 0.01, risk reduction factor 10 to 100
- SIL 2: PFD 0.01 to 0.001, factor 100 to 1,000
- SIL 3: PFD 0.001 to 0.0001, factor 1,000 to 10,000
- SIL 4: PFD 0.0001 to 0.00001, factor 10,000 to 100,000
For high demand or continuous operation the measure is the probability of dangerous failure per hour. IEC 61508 gives a matching band for each level.
What it takes to claim a level
The achieved SIL rests on three things: systematic capability (quality of the design process), architecture constraints (minimum redundancy) and the probability of dangerous failure. Requirements are grouped into hardware safety integrity and systematic safety integrity, and both must be met.
Common mistakes
Labelling components. Statements like this software is SIL 2 or this valve is SIL 3 misuse the idea. A SIL has to relate to the dangerous failure rate of a system doing a defined function.
Circular justification. Saying a system is SIL N because it followed the process for SIL N proves nothing on its own.
Mixing up failure types. SIL depends on dangerous failures, so you need a safety analysis that says which failures are dangerous.
Using reliability alone. General reliability estimates are a weak basis for a SIL, and software complexity makes numerical estimation especially hard.
Assuming definitions match. Standards bodies do not define SIL identically, so say which standard you mean.
What a buyer should ask
When a supplier quotes a SIL, ask: for which safety function, under which standard and edition, with what assumptions about proof testing and demand rate, and what evidence supports it. A label without that context is marketing.
Quick check
Is SIL 4 always the goal?
No. The target comes from the risk analysis. Higher levels cost more and demand more rigour, so you aim for what the hazard requires.
Can a library be SIL certified?
A component can be assessed as suitable for use in systems at a given SIL, but the SIL itself is a property of the whole safety function. Read the assumptions carefully.
Sources
Secondary summaries; check the standard for exact definitions and bands.
Last reviewed: 19 October 2026.
