Safety Integrity Level (SIL)

The quantitative target for dangerous undetected failures, defining the Probability of Failure on Demand (PFDavg) for low-demand systems or Probability of Dangerous Failure per Hour (PFH) for high-demand/continuous systems. This metric is the primary numerical boundary for hardware reliability.

• SIL 1: PFDavg ≥ 10⁻² to < 10⁻¹
• SIL 2: PFDavg ≥ 10⁻³ to < 10⁻²
• SIL 3: PFDavg ≥ 10⁻⁴ to < 10⁻³
• SIL 4: PFDavg ≥ 10⁻⁵ to < 10⁻⁴

A mandatory set of rules that limit the maximum SIL claimable based on a subsystem's Hardware Fault Tolerance (HFT) and Safe Failure Fraction (SFF). This prevents a single-channel system with low diagnostics from claiming a high integrity level, regardless of its calculated failure probability.

• Type A subsystems: Simple components with well-defined failure modes.
• Type B subsystems: Complex components like microprocessors with unknown failure modes.
• The standard tables in IEC 61508-2 dictate the required redundancy based on SFF.

A measure of confidence that the systematic design integrity of a component meets the requirements of a specific SIL. This addresses non-random failures caused by human error during specification, design, or modification. A component with SC3 is proven to have rigorous development processes.

• SC1: Basic quality management.
• SC2: Formal specification and testing.
• SC3: Formal methods and semi-formal design.
• SC4: Exhaustive formal verification.

The fraction of dangerous failures detected by automatic diagnostic tests, expressed as a ratio. High DC is critical for reducing the Safe Failure Fraction (SFF) and achieving higher SILs without excessive hardware redundancy.

• Low DC: < 60% (Basic channel comparison)
• Medium DC: 60% to 90% (Plausibility checks, analog range monitoring)
• High DC: 90% to 99% (Full data packet verification, dynamic memory tests)
• Example: A safety relay with forced-guided contacts achieves high DC by detecting welded contacts.

The time between periodic manual tests designed to reveal undetected dangerous failures that diagnostics cannot catch. The proof test interval directly impacts the PFDavg calculation. A shorter T1 lowers the probability of a failure coinciding with a demand.

• Formula: PFDavg ≈ λ_DU * T1 / 2 (for a 1oo1 architecture)
• Strategy: Extending T1 requires higher inherent reliability or redundancy.
• Reality: A SIL 3 safety function with a 10-year proof test interval requires significantly more robust hardware than one tested annually.

The overarching lifecycle process mandated by IEC 61508, governing planning, execution, verification, and assessment. FSM ensures that safety is managed from concept through decommissioning, with defined roles, documentation, and audit trails.

• Phase 1: Hazard and risk analysis.
• Phase 2: Allocation of safety functions to protection layers.
• Phase 3: Realization of safety-related systems.
• Phase 4: Installation, commissioning, and operation.
• Phase 5: Modification and retrofit management.

A guaranteed maximum time window within which a computation or data transfer must complete. In SIL-rated systems, missing a deadline is not a performance degradation—it is a hazardous failure. Deterministic latency ensures that safety functions execute within their specified process safety time, the interval between a hazardous event's onset and the point at which it becomes unavoidable.

• Hard real-time requirement: A late response is a wrong response
• Bounded jitter: Variability in execution time must be quantified and minimized
• Typical targets: SIL 3 safety loops often require sub-10ms deterministic response

An operating system designed to process data and respond to events within strictly deterministic time constraints. Unlike general-purpose OSes, an RTOS provides priority-based preemptive scheduling with bounded interrupt latency, ensuring that safety-critical tasks always execute before non-critical ones.

• Priority inversion control: Prevents low-priority tasks from blocking safety functions
• Temporal isolation: Guarantees CPU time budgets per task
• Certification support: RTOSes like QNX and VxWorks offer pre-certified safety packages for IEC 61508

A hardware or software timer that triggers a system reset if the primary safety application fails to periodically signal its health. In SIL architectures, watchdogs serve as the last line of defense against silent failures, ensuring that a crashed safety controller defaults to a safe state rather than leaving outputs in an indeterminate condition.

• Windowed watchdog: Requires the kick signal within a precise time window, catching both too-fast and too-slow execution
• Independent clock source: Must operate on a separate oscillator from the main processor
• Diagnostic coverage: Contributes to the Safe Failure Fraction (SFF) calculation required for SIL determination

A risk-mitigation strategy where a new or updated safety function runs in parallel with the existing certified system, processing live inputs and logging outputs without affecting physical actuators. This allows validation of SIL-rated software changes against real production data before formal commissioning.

• Zero-risk validation: Outputs are compared but not actuated
• Statistical equivalence testing: Requires thousands of hours of shadow operation to prove behavioral identity
• Change management: Essential for maintaining SIL certification through software updates without full recertification

A technique enabling a safety-related AI model to recognize input data that differs fundamentally from its training distribution. In SIL contexts, this is critical because neural networks can produce confidently wrong predictions on novel inputs. The system must flag uncertainty and fall back to a safe state rather than acting on unreliable inference.

• Epistemic uncertainty quantification: Distinguishes between model ignorance and data noise
• Safe fallback: Triggers pre-defined conservative behavior or human intervention
• IEC 61508 compliance: Addresses the challenge of justifying ML behavior in safety cases where exhaustive testing is impossible

The continuous monitoring process that statistically compares a deployed model's live predictions against its training baseline to identify degradation. For SIL-rated AI functions, undetected drift can silently erode the risk reduction factor that the safety integrity level was designed to guarantee.

• Data drift: Changes in input sensor distributions due to equipment aging or environmental shifts
• Concept drift: Changes in the fundamental relationship between inputs and the safety-critical output
• Automated response: Drift beyond thresholds must trigger alarms, safe-state fallback, or automatic model rollback