A safety integrity level, or SIL, is a measure of how reliable a safety function has to be. It answers a hard engineering question - when you truly need this shutdown to work, how confident are you that it will - with a number from SIL 1 to SIL 4. This guide explains what those levels mean, how they are expressed as a probability of failure, and how SIL is used in oil and gas safety design.
Safety Integrity Level (SIL) in one line: A safety integrity level (SIL) is a discrete rating, from SIL 1 (lowest) to SIL 4 (highest), that quantifies the required reliability of a safety instrumented function. It is defined by a target average probability of failure on demand (PFD) - roughly one failure in ten demands at SIL 1 down to one in ten thousand at SIL 4 - and comes from the IEC 61508 and IEC 61511 functional safety standards. Higher SIL means more risk reduction and stricter design, testing, and maintenance.
SIL is defined in terms of average probability of failure on demand (PFD-avg) for functions that act only when called, like a shutdown that fires once a year. SIL 1 corresponds to a PFD between 0.1 and 0.01 - a risk reduction factor of 10 to 100. SIL 2 is 0.01 to 0.001 (100 to 1,000). SIL 3 is 0.001 to 0.0001 (1,000 to 10,000). SIL 4 is 0.0001 to 0.00001 (10,000 to 100,000). Each step up is a full order of magnitude more reliable and dramatically harder and more expensive to achieve.
A SIL rating is a property of a whole safety instrumented function - the sensor, logic solver, and final element together - not of a single device. You cannot buy a SIL 2 valve and declare the loop SIL 2; the achieved SIL depends on the failure rates of every element, how they are voted (for example 1oo2 or 2oo3 redundancy), how often the function is proof-tested, and the diagnostic coverage of the equipment. SIL verification is the calculation that proves the assembled loop meets its target PFD.
Two other constraints ride along with the PFD target: hardware fault tolerance (how many dangerous faults the architecture can survive and still work) and the safe failure fraction of the devices. This is why higher SILs push designers toward redundant sensors, redundant valves, and rated safety devices - a single non-redundant channel usually cannot reach SIL 3 no matter how good the component is.
In oil and gas the required SIL for each safety function is not chosen arbitrarily; it is derived from risk analysis, most often a layer-of-protection analysis (LOPA). The team estimates how bad an event would be and how likely it is without protection, subtracts the credit for other independent layers, and the remaining gap sets the SIL the safety instrumented function must deliver. A high-consequence, high-likelihood hazard demands a higher SIL.
Most oil and gas safety functions land at SIL 1 or SIL 2. SIL 3 shows up on genuinely severe hazards such as high-integrity pressure protection (HIPPS) protecting a downstream pipeline rated below wellhead pressure. SIL 4 is rare in the process industries and is generally avoided by redesigning the process or adding layers rather than engineering a single function to that reliability.
SIL is a lifecycle commitment, not a one-time certificate. The achieved SIL degrades over time if the loop is not proof-tested on schedule, because undetected dangerous faults accumulate between tests. Monitoring platforms help here by trending trip frequency, capturing test records, and flagging bypasses; a cloud SCADA such as Merobix can read that status data over Modbus, DNP3, or OPC UA for reporting, while the SIL calculation and the safety function itself remain the domain of the safety system.
Each level is a tenfold jump in required reliability. SIL 1 gives a risk reduction factor of 10 to 100 (PFD 0.1 to 0.01), SIL 2 gives 100 to 1,000, and SIL 3 gives 1,000 to 10,000. Higher SIL demands lower probability of failure on demand, which in practice means redundant sensors and valves, higher diagnostic coverage, and more frequent proof testing.
SIL applies to a complete safety instrumented function - sensor, logic solver, and final element together - not to one component. A device may be certified as suitable for use up to a certain SIL, but the achieved SIL of the function depends on the whole architecture, its redundancy and voting, its diagnostics, and its proof-test interval. SIL verification is the calculation that proves the assembled loop meets its target.
Yes. Between proof tests, undetected dangerous faults can accumulate, so the average probability of failure on demand rises. The proof-test interval is a direct input to the SIL calculation - test less often and the achieved SIL drops. This is why safety functions are on a strict test schedule and why trip and test records are tracked closely, often with help from a monitoring platform for the recordkeeping.
Safety & engineering notice. This article is general educational information, not site-specific engineering, safety, or legal advice, and it does not reflect any particular facility. Standards and regulations (for example OSHA, API, IEC, ISO, NFPA, NIST, and NERC CIP requirements) change and vary by edition, jurisdiction, and application. SCADA and remote monitoring cannot verify physical isolation, atmosphere, lockout/tagout, permit status, or a safe go/no-go decision. Qualified personnel must perform site-specific engineering, hazard analysis, and safety review, and confirm current requirements with the authority having jurisdiction, before acting.
This page references the protocol specifications published by the organizations below. Editions, product capabilities, and documentation change over time - confirm current requirements and specifications directly with the source.
Last reviewed: July 27, 2026. Merobix is not affiliated with, endorsed by, or sponsored by these organizations; their names are used only to identify the standards and products discussed.
Merobix reads your field devices into a cloud SCADA - the real thing behind these terms, live in days from any browser.