SIL calculation has two distinct parts that engineers sometimes conflate. The first is SIL determination: figuring out what SIL level a safety function must achieve, derived from the hazard analysis. The second is SIL verification: proving that the hardware and software architecture you’ve designed actually achieves that SIL.
Both are required. Neither substitutes for the other.
SIL determination tells you the target. SIL verification tells you whether your design meets it.
| SIL determination | SIL verification | |
|---|---|---|
| Question answered | What SIL does this safety function need to achieve? | Does our design achieve that SIL? |
| Input | Hazard and Risk Assessment, risk graph or risk matrix | Architecture, component failure rate data, diagnostic coverage |
| Standard reference | IEC 61508-3 (risk graph) or sector-specific risk matrices | IEC 61508-2 and IEC 61508-4 (PFH, HFT, DC calculations) |
| Output | Required SIL level (SIL 1, 2, 3, or 4) | Achieved PFH — compared against required range |
| When done | During hazard analysis | During and after architecture design |
Understanding the SIL levels
IEC 61508 defines four Safety Integrity Levels for continuous-mode safety functions (expressed as probability of dangerous failure per hour, PFH):
- SIL 1: PFH < 10-5 per hour
- SIL 2: PFH < 10-6 per hour
- SIL 3: PFH < 10-7 per hour
- SIL 4: PFH < 10-8 per hour (rare in robotics and automation contexts)
For demand-mode safety functions (those that are called upon only when a hazardous situation arises), the metric is probability of failure on demand (PFD) rather than PFH. Continuous mode applies to systems like autonomous robots that are always performing their safety function. Demand mode applies to systems like emergency shutdown systems that are activated infrequently.
Part 1: SIL determination from the hazard analysis
The required SIL for a safety function comes from the hazard analysis. IEC 61508 provides a risk graph approach for deriving the required SIL. The risk graph takes four parameters:
C — Severity of consequences. C1: slight (reversible injury); C2: serious (irreversible injury); C3: severe (multiple serious injuries or one death); C4: catastrophic (multiple deaths).
F — Frequency and duration of exposure. F1: rare to frequent exposure; F2: frequent to continuous exposure.
P — Possibility of avoiding the hazard. P1: possible under specific conditions; P2: almost impossible.
W — Probability of the unwanted occurrence in the absence of the safety function. W1: very slight; W2: slight; W3: relatively high.
The risk graph combines these inputs to produce a required risk reduction level. Depending on the input combination, this may be “no special safety requirements,” SIL 1, SIL 2, SIL 3, or “the risk cannot be managed by safety functions alone and architectural changes are required.”
For robotics applications, the most common starting points are C3 (severe consequences from collision or mechanical failure), F2 (frequent or continuous exposure in shared-space environments), and P2 (almost impossible to avoid once the event is in motion). These inputs typically produce SIL 2 or SIL 3 requirements.
Part 2: SIL verification — does your architecture achieve it?
Once the required SIL is determined, the architecture has to be shown to achieve it. This involves three elements defined in IEC 61508 Part 2:
Probability of dangerous failure per hour (PFH)
The quantitative target. Your architecture achieves SIL 2 only if its calculated PFH is below 10-6 per hour. Calculating PFH requires:
- Component failure rates (from manufacturer data, SN 29500, IEC 61709, or other sources)
- Diagnostic coverage (DC) — the fraction of dangerous failures detected by automated diagnostics
- Common cause failure contribution (beta factor)
- Architecture configuration (single-channel, 1oo2, 2oo3, etc.)
The PFH formula depends on the architecture type. IEC 61508 provides formulae for common architectures in Annex B. The critical inputs are the dangerous failure rate of each channel (λD) and the diagnostic coverage (DC).
Hardware fault tolerance (HFT)
IEC 61508 sets a minimum hardware fault tolerance requirement based on the target SIL. For SIL 2 Type B subsystems (complex programmable electronics), the minimum HFT is 1 — the system must continue to perform its safety function in the presence of any single hardware fault.
HFT 1 typically means redundancy: two independent channels that must both fail before the safety function fails. The architecture must be designed to this minimum, regardless of whether the PFH calculation alone would be satisfied by a simpler architecture.
Architectural constraints: SFF and HFT
The safe failure fraction (SFF) of a subsystem is the fraction of all failures that are safe or detected. IEC 61508 Annex C defines minimum SFF requirements depending on the SIL and the hardware fault tolerance. For SIL 2 with HFT 1, Type B subsystems need SFF ≥ 90%.
These architectural constraints are sometimes overlooked in favor of the PFH calculation alone. Both are required. A design that achieves the right PFH but doesn’t meet the minimum HFT doesn’t achieve the target SIL.
Performance Level and SIL: the mapping
ISO 13849 uses Performance Level (PL) rather than SIL for machinery safety. PLd corresponds roughly to SIL 2. PLe corresponds roughly to SIL 3. But the methodology differs: ISO 13849 uses designated architectures (Categories B, 1, 2, 3, 4) and calculates the achievable PL based on Mean Time to Dangerous Failure (MTTFd), diagnostic coverage, and common cause failure susceptibility.
Teams working with systems that require both IEC 61508 (system level) and ISO 13849 (safety function level) need to manage the mapping carefully. PLd doesn’t equal SIL 2 in every situation — it’s an approximation that needs to be verified for the specific architecture.
ASAP’s reliability modeling module handles both PL calculations per ISO 13849 and SIL calculations per IEC 61508. The web-based tool maintains the calculation linked to the safety function it supports, so when the architecture changes, the impact on the achieved SIL or PL is immediately visible.
FAQ: How to Calculate SIL
What is a SIL calculation in IEC 61508?
A SIL calculation in IEC 61508 involves two parts: determining the required SIL from a risk assessment (using the risk graph or a risk matrix), and verifying that the architecture achieves that SIL through quantitative analysis (PFH calculation, HFT requirements, SFF requirements). Both parts are required. Determining the required SIL without verifying achievement doesn’t demonstrate that the safety function meets its target.
How do you determine the required SIL for a safety function?
The required SIL comes from the hazard and risk assessment. IEC 61508 provides a risk graph with four parameters: severity of consequences (C), frequency of exposure (F), possibility of avoidance (P), and probability of unwanted occurrence without the safety function (W). The risk graph combines these to derive the required SIL level. This is a judgment-based assessment that requires documentation of the reasoning, not just the result.
What is the difference between PFH and PFD in SIL calculation?
PFH (probability of dangerous failure per hour) applies to continuous-mode safety functions that are always active — like a speed monitoring function on a robot that operates continuously. PFD (probability of failure on demand) applies to demand-mode safety functions that are called upon only when a hazardous event occurs — like an emergency shutdown function. Most robotics and automation safety functions are continuous mode and use PFH.
What are hardware fault tolerance requirements for SIL 2?
For SIL 2 Type B subsystems (complex programmable electronics), IEC 61508 requires a minimum hardware fault tolerance (HFT) of 1. This means the safety function must continue to operate correctly in the presence of any single hardware fault. HFT 1 typically requires redundant architecture — two independent channels whose combined failure is required to disable the safety function. Achieving the required PFH without meeting the minimum HFT doesn’t satisfy SIL 2.
What tools are used for SIL calculation?
Historically, SIL calculations have been done in spreadsheets or dedicated desktop tools. Web-based alternatives now exist that connect the reliability calculation to the hazard analysis and safety requirements it supports. ASAP’s reliability modeling module handles both PL calculations (ISO 13849) and SIL calculations (IEC 61508), linked to the safety functions they verify, so the calculation stays current as the architecture evolves.
This post covers general functional safety engineering principles and is for educational purposes only. It is not engineering advice. Consult a qualified functional safety professional and your applicable standards body before making safety-critical design decisions.
ASAP’s reliability modeling module handles SIL calculations per IEC 61508 and PL calculations per ISO 13849 in a connected, web-based platform. The calculation links to the hazard that required it and updates when the architecture changes. See the platform.