Safety Integrity Level (SIL)

These levels apply to functions where a failure would result in a low to moderate risk to people or the environment.

• SIL 1: The lowest level of risk reduction. Requires basic documentation, functional testing, and a Probability of Dangerous Failure per Hour (PFH) between ≥10⁻⁶ to <10⁻⁵.
• SIL 2: For more significant hazards. Demands more rigorous design techniques, such as diagnostic coverage, and a PFH between ≥10⁻⁷ to <10⁻⁶.
• Common Applications: Industrial process control, basic machine safety, and commercial automotive systems (e.g., ISO 26262 ASIL A/B equivalents).

These are reserved for safety functions where failure could lead to severe injury, multiple deaths, or catastrophic environmental damage.

• SIL 3: Requires highly robust design with redundancy, independence, and extensive diagnostic coverage. PFH must be between ≥10⁻⁸ to <10⁻⁷.
• SIL 4: The most stringent level. Mandates fault-tolerant design, often with multiple redundant channels and formal methods for verification. PFH must be ≥10⁻⁹ to <10⁻⁸.
• Common Applications: Nuclear reactor protection systems, railway signaling (CENELEC standards), and aviation flight controls.

SIL is not chosen arbitrarily; it is derived from a quantitative or semi-quantitative risk analysis.

• Risk Graph/Matrix: Standards provide tools to map consequence, exposure frequency, and possibility of avoidance to a target SIL.
• Layers of Protection Analysis (LOPA): A semi-quantitative method that evaluates independent protection layers to determine the necessary risk reduction factor, which is then translated to a SIL.
• Key Output: The process defines the Safety Requirement Specification (SRS) for the function, which includes its target SIL, functional requirements, and integrity requirements.

This quantifies the probability of random hardware failures causing a dangerous loss of the safety function.

• Core Metrics:
  • Probability of Dangerous Failure per Hour (PFH): The key probabilistic metric for high-demand/continuous mode systems.
  • Safe Failure Fraction (SFF): The proportion of failures that are either safe or detected as dangerous.
  • Hardware Fault Tolerance (HFT): The number of dangerous hardware faults a system can withstand without losing its safety function.
• Requirements: Each SIL level sets minimum targets for these metrics, driving the need for redundancy, diagnostics, and high-quality components.

Addresses the prevention of systematic failures—errors in specification, design, implementation, or maintenance.

• Rigorous Lifecycle Management: Mandated by standards like IEC 61508, encompassing all phases from concept to decommissioning.
• Verification & Validation (V&V): Requires independent teams and extensive testing to prove requirements are met.
• Techniques by SIL: Higher SILs demand more advanced techniques:
  • SIL 1/2: Code reviews, functional testing.
  • SIL 3/4: Formal specification, semi-formal/formal design methods, and module/unit testing with high coverage (e.g., MC/DC for software).

Applying SIL concepts to AI-driven and simulation-trained systems, like robots, presents unique challenges.

• The Challenge of Probabilistic Systems: Traditional SIL analysis assumes deterministic logic. The aleatoric and epistemic uncertainty of AI models complicates failure rate calculations.
• Simulation as a V&V Tool: High-fidelity digital twins and fault injection in simulation are used to gather evidence on failure modes and rates, supporting a safety case.
• Architectural Patterns: AI components are often placed within a safety cage—using runtime monitoring, control barrier functions, and a safety-rated PLC (SIL 2/3) to override unsafe AI actions, thereby limiting the SIL requirement of the AI subsystem itself.

A systematic, proactive risk assessment methodology used to identify and evaluate potential failure modes within a system, their causes, and their effects. It is a foundational qualitative analysis that often informs the quantitative risk targets required for a specific Safety Integrity Level (SIL).

• Process: Identifies components, potential failure modes, their effects on the system, and assigns severity, occurrence, and detection ratings.
• Output: A risk priority number (RPN) used to prioritize mitigation efforts. FMEA is frequently conducted before a SIL assessment to understand failure scenarios.

The process of using rigorous mathematical methods to prove or disprove the correctness of a system's design with respect to a formal specification. While SIL certification often relies on probabilistic risk assessment, formal verification provides deterministic guarantees for critical components.

• Application: Used to verify that safety-critical software logic (e.g., a shutdown system) adheres to its formal requirements.
• Relationship to SIL: Can be a required or highly recommended technique for achieving higher SIL levels (e.g., SIL 3/4) by eliminating certain classes of design faults.

A subfield of reinforcement learning focused on developing algorithms that learn to maximize performance while satisfying safety constraints. This is the machine learning counterpart to traditional safety engineering, crucial for training agents in simulation for real-world deployment.

• Core Framework: Often formalized using a Constrained Markov Decision Process (CMDP), where constraints represent safety limits (e.g., joint torque, collision avoidance).
• Methods: Include shielding, safety critics, and the use of control barrier functions (CBFs) to guide exploration and policy execution within safe regions.

A safety technique that involves continuously observing a system's execution to detect violations of specified safety properties or constraints in real-time. It acts as an independent layer of protection, often required to meet Safety Integrity Level targets for complex, non-deterministic systems like AI policies.

• Function: Compares observed system states or actions against a pre-defined safety envelope or barrier function.
• Action: Upon detecting an imminent violation, the monitor can trigger a fail-safe mode or execute a recovery policy. This is key for sim-to-real transfer where the real-world may present out-of-distribution scenarios.

A mathematical construct used in control theory to formally guarantee that a dynamical system's state remains within a predefined safe set. It synthesizes a safe control input by solving a real-time optimization problem. This is a pivotal technique for ensuring the safety of learned policies from simulation.

• Mechanism: Defines a scalar function that is positive in the safe set and negative outside. The controller is designed to ensure this function's derivative keeps the system safe.
• Use in Robotics: Integral to providing safety certificates for neural network-based controllers, allowing them to be deployed with verifiable safety guarantees, complementing a SIL approach.

A testing technique that deliberately introduces faults, errors, or failures into a system to evaluate its robustness, fault tolerance, and error-handling capabilities. It is a critical validation method for systems targeting high Safety Integrity Levels.

• Purpose: To stress-test safety mechanisms, fault detection routines, and fail-safe modes.
• Simulation Context: In sim-to-real pipelines, fault injection is performed in the virtual environment to train and test recovery policies and ensure the system can handle sensor failures, actuator faults, or communication dropouts before physical deployment.