How IEC 61508 Determines a Device SIL
A datasheet says a transmitter is SIL 2 capable, but where does that number come from? IEC 61508 does not assign a SIL from a single figure; it combines several distinct inputs, and each can cap the result. This page explains how the standard arrives at a device's SIL capability, so you understand what a SIL claim on a certificate actually rests on. It is an explainer of the determination logic, not a full functional-safety course.
IEC 61508 SIL determination in one line: IEC 61508 determines a device's SIL capability by combining three independent inputs, each of which can limit the result: the hardware fault tolerance and safe failure fraction together cap the architectural SIL through defined tables, the random hardware failure rate sets the achievable probability of failure, and the systematic capability caps the SIL from the development process. The lowest limit governs the claimed SIL.
Three Inputs, Any One of Which Can Cap the Result
The key idea is that a SIL claim is a ceiling set by the weakest of several factors, not a score you add up. IEC 61508 looks at the device from three angles, and each angle imposes a maximum SIL. The final claimed SIL is the lowest of those maxima, which is why a device with excellent failure rates can still be capped at a modest SIL by a weakness elsewhere.
The three inputs are architectural constraints (from hardware fault tolerance and safe failure fraction), random hardware failure (the quantified probability of failure), and systematic capability (a rating of the development rigor). Understanding that any one can be the binding constraint is the whole point, because it stops you from reading a single good number as the answer. The related site page on Route 1H vs Route 2H covers the two accepted ways to satisfy the architectural constraint.
The Architectural Constraint: HFT and SFF
The first cap comes from the architecture. IEC 61508 uses hardware fault tolerance (HFT), the number of faults a subsystem can tolerate and still perform the safety function, together with safe failure fraction (SFF), the proportion of failures that are safe or detected, to look up a maximum SIL in defined tables. Higher HFT and higher SFF permit a higher architectural SIL.
The table below sketches the shape of that relationship for the Route 1H approach; the actual tables in the standard are the authority.
| SFF band | HFT 0 | HFT 1 | HFT 2 |
|---|---|---|---|
| Under 60% | Not allowed for higher SIL | SIL 1 | SIL 2 |
| 60% to 90% | SIL 1 | SIL 2 | SIL 3 |
| 90% to 99% | SIL 2 | SIL 3 | SIL 4 |
| Over 99% | SIL 3 | SIL 4 | SIL 4 |
Read this as an architectural ceiling only. Meeting a cell in the table lets the architecture reach that SIL, but the device still has to satisfy the random-failure and systematic-capability limits before it can claim it. This is exactly why a device can be architecturally capable of SIL 3 yet certified only to SIL 2.
Random Failure and Systematic Capability
The second cap is the quantified probability of dangerous failure, computed from the device's random hardware failure rate and, in a full loop, its diagnostic coverage and test interval. This is the number that a loop-level SIL verification combines across sensor, logic solver, and final element to confirm the whole function meets its target.
The third cap is systematic capability, a rating of how rigorously the device was developed and how well systematic faults, such as design and software errors, were avoided and controlled. A device with weak development evidence is capped regardless of how good its hardware numbers look, because systematic failures are not covered by the probabilistic calculation.
So a certificate's SIL claim is the minimum of the architectural cap, the random-failure cap, and the systematic-capability cap. When you read SIL 2 capable on a datasheet, it means all three inputs support at least SIL 2 and at least one holds it there. Reading the claim this way tells you what to ask for: not just the SIL number but the HFT, SFF, failure rates, and systematic capability behind it.
Frequently Asked Questions
Why is a device SIL 2 capable and not SIL 3?
Because the lowest of its three limiting inputs holds it at SIL 2. IEC 61508 caps the SIL by the architecture (hardware fault tolerance and safe failure fraction), by the quantified random-failure probability, and by the systematic capability of its development. If any one of these supports only SIL 2, the device is SIL 2 capable even if the others could reach SIL 3. To understand a specific cap, ask which of the three inputs is the binding constraint.
Is SIL capability the same as the SIL of my loop?
No. A device's SIL capability is a ceiling set by IEC 61508 for that component. The SIL your safety loop actually achieves comes from a loop-level SIL verification that combines the sensor, logic solver, and final element with their failure rates, diagnostic coverage, and proof-test interval. A loop built entirely from SIL 3 capable devices can still fall short of SIL 3 if the combined probability of failure does not meet the target, which is why loop verification is required.
Sources and verification
This page references the standards, specifications, and official documentation published by the organizations below. Editions, product capabilities, and documentation change over time - confirm current requirements and specifications directly with the source.
- IEC 61508, Functional safety of E/E/PE safety-related systems - International Electrotechnical Commission
Merobix is not affiliated with, endorsed by, or sponsored by these organizations; their names are used only to identify the standards and products discussed.
Automation services
Need help turning this into a working system?
Merobix integrates SCADA, programs Allen-Bradley and Siemens PLCs, and designs and fabricates industrial control panels.
Meeting requests are reviewed before confirmation.