Safety Integrity Level (SIL): Essential for functional safety
Whether cars, airplanes or trains: wherever a fault can cost a lot of money or lives, there are safety requirement levels, or Safety Integrity Levels. Every systems engineer should at least know the basics of SIL. This is what the following is about.
IEC 61508
The IEC 61508 standard is one of the most important standards in systems engineering and defines the term "Safety Integrity Level". The standard is the basis for a number of standards for specific areas of application of functional safety (FuSi). One of the better known, due to its catchy name, is the ISO 26262 from vehicle development. The following image provides an overview:
Safety Integrity Level (SIL)
In safety-critical development, a safety integrity level is now assigned to each relevant function or requirement. The aim is to achieve this level. ISO 61508 works with four numerical levels (SIL 1-4), with level 4 being the highest. Non-safety-critical functions are assigned the fifth level QM.
Not all specific standards stick to these designations. The railroad industry, for example, uses levels A-D (EN 5012x). The automotive industry, on the other hand, sticks to levels 1-4, but calls them ASIL (ISO 26262, Automotive Safety Integrity Level).
There are different evaluation criteria for this. For example, we can work with failure probabilities. For example, for SIL4 and continuous operation, the probability of a failure with catastrophic consequences must be less than 10-8 per hour. (Footnote: Which FuSi expert will correct me now because I have formulated something incorrectly?)
Acceptable risk
In some areas of application, we are more willing to accept risk than in others. Especially in the development of medical devices (ISO 14971), we are often prepared to take risks. This is because the alternative (illness and its consequences) is often worse. This is why we typically work with a risk acceptance matrix here.
This matrix shows very clearly that risk analysis is multidimensional: In the medical field, we cannot rule out risks. But smaller risks are acceptable. For larger risks, appropriate countermeasures must be taken (mitigations).
We also know such probabilities from the Package inserts in medicines.
Decomposition of the Safety Integrity Level
One of the major challenges in systems engineering is the decomposition of system descriptions and the correct handling of SIL levels. Here, too, there are various complex techniques, some of which are prescribed by industry-specific standards. A well-known one is the Fault tree analysisin which the failure probabilities of individual components are logically linked in order to determine the overall failure probability. The technology originates from the nuclear industry, but is also used in the aviation and railroad industries.
In the automotive environment, where a lot of work is done with natural language specifications, rules are also used that set the ASIL levels of the different levels in relation to each other. For example, a requirement that is classified as ASIL 4 cannot be broken down into requirements with a lower level. However, this is a simplified representation. Jörg Schacht has an extremely good blog entry written on this topic.
The mathematics of decomposition according to ISO 26262:
Jörg Schacht
ASIL A(D) ≠ ASIL D
Systematic problems
As is so often the case in systems engineering, we have to take the functional safety factor into account. Human must be taken into account. The standards also address this. For example, it is important that for certain reviews Author and reviewer are not the same person.
And we also have to be able to deal with conflicts and power hierarchies. As with testing, management sometimes has a bad habit of cutting corners in the event of delays where there is nothing "tangible". I have also heard anecdotes where the manager tried to "convince" the engineer that a function in the control unit was more for infotainment and should therefore be classified as "ASIL QM" and not "ASIL C"...
Conclusion
Sooner or later, every systems engineer will come into contact with the topic of Safety Integrity Level, or SIL. The topic is also becoming increasingly important as more and more complex devices penetrate our living space (keyword IoT).
I have a great deal of respect for experienced FuSi experts. This short article cannot even begin to introduce the topic. But that is precisely why it is important that we at least know the basics so that functional safety is not neglected and we give the FuSi experts the freedom they need for their work.
