SIL 1, 2, and 3 in Accordance with IEC 61511: Aligning Process Safety Instruments with Actual Risk

[Ahmet Ö.]

### Introduction
Within the scope of the IEC 61511 standard, SIL (Safety Integrity Level) determination is an analysis specifically conducted for each plant and process, and this responsibility lies with the process owner.

### Fundamental Approach to SIL Determination
SIL determination is not a matter of personal judgment or traditional practice; it is the structural output of risk analysis. This analysis links the consequence of a hazardous event, its probability of occurrence, and the necessary risk reduction measures. If done correctly, subsequent processes become much more manageable; otherwise, you will be relying on an unfounded structure.

### Starting with Hazard Analysis
The biggest mistake in SIL implementation is to focus directly on the instrument and work backward. The correct starting point should be a Process Hazard Analysis (PHA) that identifies what can go wrong and its consequences. Subsequently, a Layer of Protection Analysis (LOPA) evaluates the protective layers, measuring the amount of risk reduction provided by independent safety measures such as pressure relief devices, basic process control, and operator intervention.

The remaining risk gap is the difference that the Safety Instrumented Function (SIF) must close. This difference determines the required SIL level: SIL 1 provides one degree of risk reduction; SIL 2, two degrees; and SIL 3, three degrees of improvement. For example, a SIL 1 function preventing chemical overdose in a water treatment plant versus using SIL 3 against the risk of a high-pressure leak on an offshore gas platform presents entirely different engineering challenges.

### SIL and Instrument Selection
Once the required SIL is determined, instrument selection is carried out within the specified constraints. Every device in the SIF loop contributes to situations where the function does not operate as required. The SIL verification process must document that the selected devices meet the function's performance criteria, including failure rate, diagnostic coverage, usage restrictions, and architecture.

IEC 61511 limits the probability of a single component failure causing hidden failures that affect the entire safety function, relying on hardware fault tolerance or redundancy. Devices used in high SIL applications must demonstrate compliance supported by failure data and systematic evaluations. Merely trusting the SIL rating provided by the vendor and not performing application-specific verification can lead to critical errors.

### Industry Context and the Importance of Analysis
In process industries, SIL requirements vary by sector. For instance, SIL 2 is common in the oil and gas sector, while SIL 3 is required for high-risk scenarios. Refineries and petrochemicals mostly apply SIL 1 and SIL 2, while power generation plants typically use SIL 1 and SIL 2 for turbine and boiler protection. Water and wastewater facilities are mostly at SIL 1; however, for certain functions in plants using intensive chemicals, SIL 2 may be required.

Using SIL 2 for all functions without a LOPA analysis poses the risk of over-engineering in some areas and under-engineering in others. Risk-based SIL determination directs safety investments towards actual risks.

### Your SIL Level May Be Outdated
IEC 61511 mandates reassessment of the SIL level in case of changes. For example, increasing operating pressure, adding a new hazardous substance, or changing the SIF function demand can invalidate previous SIL determinations. While process changes are detected early through functional safety reviews, facilities that treat this as merely an administrative task may face problems in the future.

### Conclusion
Your SIL requirement is not determined by the device data sheet. SIL determination under IEC 61511 must be site and process-based and meticulously implemented by the process owner. When done correctly, the selection of safety devices becomes easier, and the application becomes defensible. In the event of an incident, there is an opportunity to prove engineering accuracy, which is far more valuable for process industries than the SIL rating on the device itself.