Safety Instrumented Systems and SIL: What the Terms Mean for Level Instruments

A transmitter may have a certified SIL capability, but buying it does not establish the achieved integrity of a complete safety function. A level SIF includes sensing, logic, the final element and required supporting services. Check the certificate’s scope and safety manual, then verify the complete function against its safety requirements.

The vocabulary, in plain terms

A safety instrumented system implements one or more safety functions designed to achieve or maintain a defined safe state. Its independence from the basic process control system must satisfy the applicable design and risk assessment. It can use diagnostics while continuously monitoring; dormant dangerous failures may still exist until a demand or proof test.

A safety instrumented function (SIF) is one specific protective action: "if the tank level reaches high-high, close the inlet valve." A SIS can implement one or more SIFs.

The required SIL follows hazard and risk assessment, not the instrument catalogue. In process applications IEC 61511 addresses SIL 1–3; IEC 61508 also defines SIL 4. Low-demand functions use average probability of failure on demand (PFDavg); high-demand or continuous functions use a different failure-frequency metric. Do not transfer a low-demand probability claim to another operating mode.

Why a transmitter alone cannot be "SIL 2"

Verify the complete SIF’s quantitative performance, architectural constraints and systematic integrity. A device certificate specifies capability under stated conditions, which may include architecture, diagnostics, proof-test coverage, operating mode and useful life. A non-redundant architecture is not automatically excluded from SIL 2; the applicable constraints and verified performance decide.

Select the architecture and test arrangements from the safety requirements specification. Redundancy and voting may be needed, but also introduce common-cause and maintenance considerations. Document failure data, supporting utilities, repair assumptions, response time and proof-test coverage instead of treating redundancy alone as the route to a SIL.

How an overfill protection loop is actually built

The classic example is overfill protection on a storage tank. A credible design separates the measurement from the protection:

Independent sensor. A dedicated high-high level switch (or a second transmitter) that is separate from the BPCS level transmitter, so a failure of the measurement does not also fail the protection.

Logic solver. A safety PLC or a certified relay logic solver, separate from the control PLC, that takes the trip signal and commands the final element.

Final element. The inlet shut-off valve, with the actuator and positioner specified so the loop achieves the target SIL.

The independence is the point: the level you use to run the tank and the level you use to protect the tank should not be the same instrument, because the failure mode you are protecting against is precisely a failure of that measurement.

Proof testing and why it matters

Proof testing seeks dangerous failures that diagnostics have not revealed. The documented procedure must cover the claimed sensor, process connection, logic and final-element failures, with pass criteria and controlled bypass arrangements. Determine the interval and coverage from the verified safety calculation and safety manuals; neither an annual test nor a forced output alone automatically demonstrates the required integrity.

Questions engineers ask

Q1. What is the difference between SIL 1 and SIL 2 for a level loop?

Roughly an order of magnitude in the required probability of failure on demand, which typically means better device diagnostics, tighter proof-test intervals, and sometimes redundancy. It is a loop property, not a device property.

Q2. Can I use the control transmitter for the safety function too?

Only if the hazard analysis accepts the shared failure mode — which for overfill protection it usually should not. The standard design uses an independent high-high device.

Q3. What does "SIL 2 capable" on a datasheet mean?

It is a conditional capability claim, whose scope must be established from the exact certificate and safety manual. Check hardware and software versions, failure data, systematic capability, architecture and test assumptions before using it in a SIF. It does not certify the completed installation.

Q4. Do I need a safety PLC?

For a single simple trip, a certified relay logic solver can be enough. The choice depends on the number of functions, the voting, and the required diagnostics.

Related technical guides

• Explosion Proof Radar Level Transmitter: Reading the Certificate, Not the Brochure
• Radar Level Transmitter Maintenance: What to Do, and What Not to Bother With

Discuss your measurement application with METRAVON

Technical references

• HSE: functional safety lifecycle