SIL (Safety Integrity Level)
Measure
Topic overview
Quick facts
SIL applies to safety functions, not products or companies. A statement like 'our robot is SIL 2' is technically meaningless; the correct claim is that a specific function, such as safe speed monitoring, achieves SIL 2.
A higher SIL requires lower probability of dangerous failure and stricter development processes: SIL 2 in high-demand mode requires a probability of dangerous failure per hour better than 1E-6, SIL 3 better than 1E-7, with each level also raising expectations for architecture, diagnostics, and systematic techniques.
Each sector adapts the scale. Rail software uses Software SIL 0 to 4 under ; machinery typically targets SIL 1 to 3 under , since SIL 4 is generally reserved for process and rail applications with catastrophic multi-fatality potential.
The automotive analog is (A to D) under , and machinery control systems may instead use Performance Levels (PL a to e) under ISO 13849. Cross-mapping between these scales is approximate and should be done through the standards' published comparison tables, not by intuition.
Achieving a SIL requires satisfying three parallel constraints: the probabilistic hardware target, architectural constraints (hardware fault tolerance and safe failure fraction, or the route 2H alternative), and systematic capability of the development process. Meeting the failure-rate math alone is never sufficient.
SIL targets, high demand mode (PFH)
Why SIL matters to your program
The SIL target set at risk assessment time is the single largest cost driver in a safety program. Each level step roughly translates into more redundancy, more diagnostics, more process rigor, and more independent verification, so an over-assigned SIL wastes budget while an under-assigned one fails assessment or, worse, ships inadequate risk reduction.
Customers and integrators specify SIL in procurement contracts, so the level a component or subsystem can credibly claim directly sets which markets and tenders are accessible.
Working with SIL
How a SIL target is met
The required SIL falls out of the risk assessment: severity, frequency of exposure, and probability parameters feed a risk graph or matrix defined in the sector standard, producing a target for each safety function.
The design team then demonstrates achievement through an for hardware metrics, an architecture meeting the fault-tolerance constraints, and process evidence for systematic capability.
Assessors verify the derivation of the target (was the risk assessment defensible), the hardware calculation inputs (are the failure rates from credible sources, is the proof test interval realistic), and the systematic side (were the required techniques and independence actually applied).
A certificate from a component supplier covers only that component's contribution; the system integrator still owns the loop-level calculation.
Common SIL mistakes
Standards related to SIL
SIL is defined and governed by IEC 61508 - the umbrella functional safety standard defining the safety lifecycle, sil levels, and requirements for electrical, electronic, and programmable systems.
SIL is defined and governed by EN 50128 - software for railway control and protection systems, defining software sil requirements and lifecycle.
Assessors evaluate SIL against IEC 62061, machinery-sector implementation of iec 61508 for safety-related electrical control systems.
Cross-sector integrity alignment (approximate)
| IEC 61508 SIL | ISO 13849 PL | ISO 26262 ASIL | EN 50128 SW-SIL |
|---|---|---|---|
| SIL 1 | PL b / PL c | ASIL A / B | SIL 1 |
| SIL 2 | PL d | ASIL B / C | SIL 2 |
| SIL 3 | PL e | ASIL D | SIL 3 |
| SIL 4 | no equivalent | no equivalent | SIL 4 |
SIL by industry
SIL shapes how industrial machinery teams argue safety - fixed and mobile machinery, packaging lines, and manufacturing equipment.
In rail & transit, SIL comes up in nearly every certification conversation: freight and passenger rail signaling, train control, and transit systems.
Ask our team about SIL
Ben TwomblyFounder & CEOLeads CSA's functional-safety, certification, and engineering programs for safety-critical products and organizations. His assessor-side background informs practical programs that connect standards, engineering work, and credible evidence.
Jeff Twombly, PEExecutive, Rail SafetyProvides executive and technical leadership for rail-safety programs, assessments, and complex transit-system work. His experience spans safety assurance, transportation-safety leadership, signaling, and independent review.
Tom CyrPrincipal Safety Engineer, IFSPSupports industrial and rail functional-safety programs with safety analysis, requirements, lifecycle planning, and certification-readiness guidance.SIL: related terms
How each connects to SIL:
Performance Level is the natural next concept after SIL; assessors expect teams to connect the two.
IEC 61508 connects the two: SIL and Functional Safety are assessed against the same lifecycle.
Safety Function is governed by IEC 61508 as well, which is why the two show up together in audits.
IEC 61508 connects the two: SIL and Safe Torque Off are assessed against the same lifecycle.
FMEA is governed by IEC 61508 as well, which is why the two show up together in audits.
Both SIL and FMEDA sit under IEC 61508, so evidence for one usually references the other.
Both SIL and Fault Tree Analysis sit under IEC 61508, so evidence for one usually references the other.
CENELEC Rail Standards is governed by EN 50128 as well, which is why the two show up together in audits.
Verification and Validation is governed by IEC 61508 as well, which is why the two show up together in audits.
IEC 61508 connects the two: SIL and Safety Management System are assessed against the same lifecycle.