Determining Safety Integrity Levels for Systems

In this lesson, you will learn how to quantify system risk to map functional requirements to specific Safety Integrity Levels (SIL) or Automotive Safety Integrity Levels (ASIL).

Assessing Risk for Integrity Allocation

When a system performs a safety-critical function, we must determine the "target failure rate"—the maximum allowable frequency of failure per hour. This is derived from a Risk Analysis process where we weigh the Severity of an accident, the Exposure (frequency) of the hazard, and the Controllability (ability of the operator to mitigate the fault).

For example, in IEC 61508 (Industrial) or ISO 26262 (Automotive), we define these factors to calculate the required Risk Reduction Factor (RRF). If a hazard is catastrophic and occurs frequently, the RRF must be massive, pushing the system into the highest integrity level (e.g., ASIL D).

Quantifying the Target Failure Rate

The assignment of a SIL/ASIL level is mathematically bound to the Probability of Failure per Hour (PFH). As you move from SIL 1 to SIL 4, the required PFH becomes exponentially stricter.

Consider a simple braking assist system. We calculate the required failure rate using the following logical abstraction:

/* Pseudocode representation of safety target calculation */
typedef struct {
    float max_allowable_risk;     // Determined by hazard analysis
    float current_risk;           // Baseline hazard frequency
} SafetyTarget;

// Calculate RRF: The factor by which we must reduce risk
float calculate_rrf(SafetyTarget target) {
    return target.current_risk / target.max_allowable_risk;
}

// Logic to map RRF to SIL (SIL 1 = 10^-1 to 10^-2; SIL 4 = 10^-8 to 10^-9)
int assign_sil_level(float rrf) {
    if (rrf > 100000000.0f) return 4;
    if (rrf > 1000000.0f)   return 3;
    // ... and so on
    return 0; 
}

By calculating the PFH—often using the Reliability Block Diagram method or Fault Tree Analysis—you determine if your existing architecture (e.g., hardware watchdogs or memory protection) meets the target. If the architectural failure rate exceeds the target PFH, you must introduce redundancy (like dual-core lockstep processors) to lower the probability of a "dangerous undetected failure."

Key Takeaway: Safety Integrity Levels are not arbitrary labels but mathematical targets derived from risk assessments that dictate exactly how reliable your architecture must be to keep the PFH within acceptable bounds.