IEC 61511 · SIL determination
Turn hazard judgment into a defensible SIL decision
Stop debating required SIL in slides and emails. Capture the scenario, credit existing protection, and lock the risk-reduction basis before verification starts.
- Decide if a SIF is required — and at what SIL
- Keep C, F, P, W or LOPA credits with the record
- Hand a clean target to verification and SRS
- 1Hazard and risk assessment (outside SILProof scope)Cl. 8
- 2Allocation to protection layersSIL determination · Risk AnalysisCl. 9You are here
- Hazard scenario from your HAZOP
- Risk Graph / LOPA / company matrix
Required SILwith the RRF and its basis - 3SIS safety requirements specificationSRS BuilderCl. 10
- 4SIS design and engineeringSIL Verification · issued reportCl. 11
- 5Installation, commissioning and validation (outside SILProof scope)Cl. 14–15
- 6Operation and maintenance (outside SILProof scope)Cl. 16
- 7Modification (outside SILProof scope)Cl. 17
- 8Decommissioning (outside SILProof scope)Cl. 18
Risk Graph · LOPA · Company matrix — same workspace, same SIF register.
How it works
Five steps from hazard to required SIL
- HazardScenario under review
- ConsequenceSeverity of outcome
- Existing protectionLayers already credited
- Risk reductionGap that remains
- SILRequired SIL / RRF
Choose a method
Risk Graph, LOPA or company matrix
All three answer the same question — is a Safety Instrumented Function needed, and how much risk reduction must it deliver? They differ in how much numerical evidence they ask for.
- Risk GraphConsequence, occupancy, avoidance and demand rate (C → F → P → W) lead to a required SIL. Fast and consistent for screening many functions with qualitative judgement.
- LOPAInitiating event frequency, credited independent protection layers and a tolerable frequency give a precise required risk reduction. Use it when the scenario needs numbers you can defend.
- Company matrixYour own consequence and likelihood categories set the required SIL per cell, with exposure and avoidance recorded as criteria. Use it when your procedures already define the matrix.
Inputs and outputs
What you enter and what you get
You enter
- The hazardous scenario, its causes and consequence, from the HAZOP or hazard review
- For a Risk Graph: consequence, occupancy, possibility of avoidance and demand rate
- For LOPA: initiating event frequency, each independent protection layer with its PFD, and the tolerable frequency
- For a company matrix: consequence and likelihood categories with the SIL each cell requires
You get
- Whether a SIF is required and the required SIL
- From LOPA, the precise required risk reduction factor and the maximum PFDavg
- The basis stored on the SIF record, with method and inputs, for the SRS and verification
- A traceable record you can take into the LOPA or HAZOP review
Worked LOPA example
High-high separator level: required RRF 250
Scenario L-101-HH: high level in separator V-101 carries liquid over to downstream equipment. The initiating cause is inlet flow beyond the separator’s capacity, for example a level control valve failing open. Two independent layers are credited before the SIF.
| Step | Basis | Value |
|---|---|---|
| Initiating event frequency | Inlet flow exceeds separation capacity | 2.5 × 10⁻² /yr |
| Protection layer 1 | Independent high-level alarm with operator response | PFD 0.1 |
| Protection layer 2 | Second independent protection layer | PFD 0.1 |
| Mitigated frequency without the SIF | 2.5 × 10⁻² × 0.1 × 0.1 | 2.5 × 10⁻⁴ /yr |
| Tolerable frequency | Company criterion for this consequence | 1 × 10⁻⁶ /yr |
| Required risk reduction | 2.5 × 10⁻⁴ ÷ 1 × 10⁻⁶ | RRF 250 |
Required SIL 2, PFDavg no higher than 4 × 10⁻³. An RRF of 250 sits between 100 and 1,000, so the SIF needs SIL 2. Because LOPA gives the precise figure, verification checks the design against RRF 250, not only the SIL 2 band.
One SIF record
How the result feeds the rest of the lifecycle
- The required SIL, the precise RRF from LOPA and the method are saved on the SIF in the SIF register.
- The SRS Builder imports the hazard and SIL basis into the Safety Requirements Specification.
- SIL Verification uses the same target: in the example, the designed SIF reaches PFDavg 9.509e-5 (RRF ≈ 10,516), well inside the RRF 250 requirement, with architecture setting the claimed SIL 2.
- Change the risk basis later and the linked records show which target they were checked against.
Basis and limits
Transparent judgement, independent review
- Risk Graph and LOPA follow the methods described in IEC 61511-3 for determining the required SIL; the calibration is yours.
- LOPA credits only layers you mark as independent; their PFDs, the initiating frequency and the tolerable frequency are your inputs.
- Required SIL bands follow the RRF thresholds of 10, 100, 1,000 and 10,000.
- SILProof is engineering support, not an approval. The scenario, credited layers and tolerable risk criteria need review by a competent team under your procedures.
Read the engineering basis and review guide for the full scope.
Questions
Frequently asked questions
Which method should I use: Risk Graph, LOPA or a company matrix?
Use a Risk Graph for a quick, consistent screening of many functions with qualitative judgement. Use LOPA when the scenario needs numbers: an initiating event frequency, credited independent protection layers and a tolerable frequency, which give a precise required risk reduction. Use your company risk matrix when your procedures already define consequence and likelihood categories and the SIL each cell requires.
How does LOPA give a required SIL?
The initiating event frequency is multiplied by the probability of failure on demand of each independent protection layer to give the mitigated frequency without the SIF. Dividing that by the tolerable frequency gives the required risk reduction factor (RRF). An RRF above 10, 100, 1,000 or 10,000 needs SIL 1, 2, 3 or 4, and the SIF must then reach a PFDavg no higher than 1/RRF.
What counts as an independent protection layer?
A layer that on its own prevents the consequence, is independent of the initiating cause and of the other credited layers, and can be audited. Typical examples are an alarm with a defined operator response and enough time to act, a relief device or a separate instrumented function. The BPCS loop that causes the event cannot also be credited as its protection.
Can I use my own company risk matrix?
Yes. The company matrix uses consequence and likelihood categories to set the required SIL per cell, with optional exposure and avoidance criteria recorded alongside. The calibration keeps the matrix consistent: a lower consequence never needs a higher SIL than a worse one in the same likelihood column.
Where is the result stored?
On the SIF record in the register. The required SIL, the precise required RRF from LOPA and the method used travel with the SIF into the SRS and SIL verification, so verification checks the design against the same target.
Is the result an approved SIL determination?
No. SILProof records and calculates the basis; the hazard scenario, frequencies, credited layers and tolerable risk criteria need review by a competent team, typically in a HAZOP and LOPA workshop under your project procedures.
Related
Read more and related tools
Learn
- What is SIL?
- The three gates to SIL
- Knowledge Hub — fundamentals, demand modes and formulas
- Engineering basis and review guide
Tools
- SIF register — all functions in one place
- SRS Builder — specify the SIF
- SIL Verification — prove the design meets the target
- PFD calculator — 1oo1 screening estimate
Next step
Make the SIL call with evidence behind it
Open the workspace, select a SIF, and leave a traceable required SIL for verification — not a hallway agreement.