# From risk to SIL: how a protection is sized > SIL is not a label you pick, it is a level you calculate from the risk. Here is the chain of reasoning, from the hazard to the required integrity level — with the numbers. - Source : https://industryhub.site/en/learn/safety/du-risque-au-sil - Track : safety - Level : Practitioner - Reading time : 8 min - Language : English ## In brief The SIL (safety integrity level) is derived from risk: you assess the severity and probability of a hazardous scenario, derive the required risk reduction factor (RRF), and that factor sets the SIL. Each SIL maps to a PFDavg band; reaching that PFD depends on the components and the architecture. ## The SIL is not chosen, it is calculated A common mistake: "let's go with SIL 3 to be on the safe side." The SIL is not a comfort level you buy, it is the result of a **calculation** that starts from the actual risk. Aiming too high is expensive and does not make things safer if the rest does not keep up; aiming too low leaves an unacceptable risk. ## The chain of reasoning **1. Identify the hazard.** What serious event could occur? An overpressure, an overflow, a runaway reaction. We use structured methods such as the HAZOP (hazard and operability study). **2. Assess the risk.** Risk combines two factors: $$\text{Risk} = \text{Severity} \times \text{Frequency}$$ How severe are the consequences (injuries, fatalities, environmental damage)? How often can the scenario occur? You then compare with the **tolerable risk**, whose typical order of magnitude for individual risk is **10⁻⁴ to 10⁻⁵ per year**. **3. Determine the necessary risk reduction.** The gap between the risk **without protection** and the **tolerable** risk is the risk reduction factor (RRF) the safety function must provide. The common method is the LOPA (layer of protection analysis). ## From the reduction factor to the SIL Each reduction factor maps to a SIL, and each SIL maps to a band of average probability of failure on demand ($\mathrm{PFD}_{avg}$), linked by: $$\mathrm{RRF} = \frac{1}{\mathrm{PFD}_{avg}}$$ | SIL | Risk reduction (RRF) | PFDavg (low demand) | |---|---|---| | SIL 1 | 10 – 100 | 10⁻¹ – 10⁻² | | SIL 2 | 100 – 1,000 | 10⁻² – 10⁻³ | | SIL 3 | 1,000 – 10,000 | 10⁻³ – 10⁻⁴ | | SIL 4 | 10,000 – 100,000 | 10⁻⁴ – 10⁻⁵ | These bands apply in **low-demand mode** (the function is called on less than once a year) — the process case. In **high-demand** or continuous mode, you no longer reason in PFDavg but in **PFH** (probability of dangerous failure per hour). The [risk reduction → SIL calculator](/en/tools/safety/rrf-sil) and the [PFD → SIL calculator](/en/tools/safety/pfd-to-sil) perform these conversions directly. ## PFD is built up, not decreed Once the SIL is known, it becomes a **target** for the safety instrumented function (SIF), implemented by a safety instrumented system (SIS). The PFD of a SIF is the **sum** of its subsystems' contributions: $$\mathrm{PFD}_{avg} = \mathrm{PFD}_{sensor} + \mathrm{PFD}_{logic} + \mathrm{PFD}_{final}$$ In this example the final element (the valve) dominates the PFD: it is almost always the weak link of a SIF, being the least reliable mechanical part. Reaching a SIL is therefore not just a number: it also requires the **architecture** (redundancy) and **robustness to failures**. A 1oo2 architecture tolerates one failure (hardware fault tolerance **HFT = 1**); the **SFF** (safe failure fraction) must also reach a minimum threshold imposed by the standard. This point is developed in the article [Functional safety and IEC 61508](/en/articles/securite-fonctionnelle-iec-61508). ## The mistake you must never make Entrusting **protection** to the system that already handles **control**. The control loop that drives the process must not be the one that protects it: if it fails, you lose both at once. The safety system is **independent** of the control system — a fundamental principle, detailed in the [control loop](/en/learn/automation/boucle-de-regulation) and framed by the standards [IEC 61508](/en/standards/iec-61508) and [IEC 61511](/en/standards/iec-61511).