SIL vs Performance Level: Two Safety Rating Systems, One Machine

A sensor datasheet on your desk says PLd. The customer's safety requirement, drafted by a process engineer who learned functional safety at a refinery, says SIL 2. Same cell, two rating systems, and nobody on the project has checked whether the datasheet satisfies the requirement.

It usually does. SIL and Performance Level both measure the probability that a safety function fails when you need it, through different math built for different industries. Confuse them and you either over-spec the machine into a bloated maintenance budget or under-spec it into an audit finding.

TL;DR: SIL (IEC 61508/61511) and Performance Level (ISO 13849-1) both grade a safety function's risk reduction. SIL is a pure probability figure; PL blends probability with structural architecture. IEC 62061 and ISO 13849-1 harmonize their scales: PL b/c maps to SIL 1, PL d maps to SIL 2, PL e maps to SIL 3 (NotebookLM, Functional Safety notebook, 2026). The mapping stops at the two machinery standards and does not reach IEC 61511 process safety SIL.

This piece pairs with the intrinsic safety and IS barriers guide, which covers hazardous-area circuit protection, a separate problem from the functional safety ratings covered here.

What Does SIL Measure?

IEC 61508 defines Safety Integrity Level as a discrete 1-to-4 scale for the risk reduction a safety function must deliver: SIL 4 is the strictest, SIL 1 the loosest (NotebookLM, Functional Safety notebook, 2026). IEC 61511 adapts that scale for process safety instrumented systems.

IEC 61511 governs Safety Instrumented Systems in chemical processing, oil and gas, pharmaceutical, and power generation plants. These loops sit in low demand mode, called on less than once a year, so engineers measure reliability as average probability of failure on demand, PFDavg (NotebookLM, Functional Safety notebook, 2026). A SIL 2 pressure trip loop has to prove its PFDavg falls in the SIL 2 band every time an assessor checks it.

IEC 61511 stops at SIL 3 by design. It excludes SIL 4 because process-grade final elements, heavy mechanical isolation valves in particular, cannot reach the failure probabilities SIL 4 requires under normal process conditions (NotebookLM, Functional Safety notebook, 2026). A process risk assessment that calls for SIL 4 needs additional independent layers of protection, not a single loop stretched past what its hardware can prove.

Each SIL band carries a matching Risk Reduction Factor, the inverse of PFDavg. SIL 1 spans a PFDavg of 10^-2 to under 10^-1, an RRF of 10 to 100. SIL 2 runs 10^-3 to under 10^-2, RRF 100 to 1,000. SIL 3 runs 10^-4 to under 10^-3, RRF 1,000 to 10,000. SIL 4 runs 10^-5 to under 10^-4, RRF 10,000 to 100,000, and shows up rarely outside dedicated equipment manufacturer designs (NotebookLM, Functional Safety notebook, 2026).

Citation capsule: IEC 61511 measures process safety loops by PFDavg in low demand mode: SIL 1 spans 10^-2 to 10^-1, SIL 2 spans 10^-3 to 10^-2, SIL 3 spans 10^-4 to 10^-3, and SIL 4 spans 10^-5 to 10^-4, with IEC 61511 capping process safety functions at SIL 3 (NotebookLM, Functional Safety notebook, 2026).

What Is Performance Level, and How Do You Determine It?

Performance Level grades a machinery safety function on a five-step scale, PL a through PL e: PL e delivers the highest risk reduction, PL a the lowest (NotebookLM, Functional Safety notebook, 2026). PL blends a probability target with the circuit's physical architecture; SIL rests on probability alone.

ISO 13849-1 sets a target average probability of dangerous failure per hour, PFHd, for each level: PL a spans 10^-5 to under 10^-4, PL b spans 3x10^-6 to under 10^-5, PL c spans 10^-6 to under 3x10^-6, PL d spans 10^-7 to under 10^-6, and PL e spans 10^-8 to under 10^-7 (NotebookLM, Functional Safety notebook, 2026). Machinery safety functions run in high demand or continuous mode, so engineers track failures per hour, not per demand.

That PFHd number never stands alone. ISO 13849-1 arrives at PL by combining the circuit's structural Category (B, 1, 2, 3, or 4) with Mean Time to Dangerous Failure (MTTFd), Diagnostic Coverage (DC), and Common Cause Failure (CCF) resistance (NotebookLM, Functional Safety notebook, 2026). The standard covers electrical, hydraulic, pneumatic, and mechanical safety circuits under one framework, so a designer can apply it to a mixed-technology machine.

Category sets the ceiling before the other three factors enter the calculation. Category B is single-channel with zero fault tolerance and zero diagnostics, capped at PL b. Category 1 is also single-channel but built from well-tried, high-reliability components, capped at PL c. Category 2 adds periodic self-test equipment that checks the safety function at least a hundred times more often than it's demanded, capped at PL d. Categories 3 and 4 are dual-channel and redundant: Category 3 tolerates a single fault without losing the safety function; Category 4 does the same and also blocks an accumulation of undetected faults over time. Both reach PL e (NotebookLM, Functional Safety notebook, 2026).

MTTFd sorts into three bands per channel: low runs 3 to under 10 years, medium runs 10 to under 30 years, high runs 30 up to 100 years. The 2023 revision of ISO 13849-1 raised the ceiling to 2,500 years for dual-channel Category 4 subsystems (NotebookLM, Functional Safety notebook, 2026). Diagnostic Coverage sorts into four bands: none sits under 60 percent, low runs 60 to under 90 percent, medium runs 90 to under 99 percent, high sits at 99 percent or above.

Common Cause Failure resistance becomes mandatory once a design goes multi-channel, at Category 2 and above. ISO 13849-1's Annex F scores CCF resistance on a 100-point checklist covering physical separation, technology diversity, and EMC testing, and a design needs 65 points to claim credit (NotebookLM, Functional Safety notebook, 2026). Skip that check on a redundant design and both channels can fail together from one root cause, which defeats the point of building in redundancy.

Citation capsule: Performance Level combines a structural Category (B through 4, setting the achievable ceiling) with MTTFd, Diagnostic Coverage, and Common Cause Failure resistance to arrive at a PFHd-based rating from PL a to PL e; CCF checks become mandatory once a design goes multi-channel and require at least 65 of 100 points on the ISO 13849-1 Annex F checklist (NotebookLM, Functional Safety notebook, 2026).

How Do You Map SIL to PL, and Where Does the Mapping Break?

IEC 62061 (SIL for machinery) and ISO 13849-1 (PL) harmonize their scales: PL b and PL c both correspond to SIL 1, PL d corresponds to SIL 2, and PL e corresponds to SIL 3 (NotebookLM, Functional Safety notebook, 2026). That mapping lets you combine a pneumatic valve assessed under ISO 13849-1 with a programmable safety controller assessed under IEC 62061 inside the same machine.

The mapping holds only between the two machinery standards. IEC 61511 process safety SIL runs on a different demand mode and a different failure metric, and the harmonization tables never bridge that gap (NotebookLM, Functional Safety notebook, 2026). A PLd-rated pneumatic actuator does not become a SIL 2 process safety device just because the numbers line up on a table.

The two frameworks also derive matching labels through different math. IEC 62061 uses a purely quantitative probabilistic method and assesses the entire control system as one functional unit (NotebookLM, Functional Safety notebook, 2026). ISO 13849-1 layers Category, MTTFd, DC, and CCF into a semi-quantitative calculation. Two systems can both land at SIL 2 / PL d and reach that label through entirely different engineering justifications.

Citation capsule: IEC 62061 and ISO 13849-1 harmonize their scales so PL b/c maps to SIL 1, PL d maps to SIL 2, and PL e maps to SIL 3, letting engineers combine subsystems assessed under either standard in one machine (NotebookLM, Functional Safety notebook, 2026). That mapping applies only between the two machinery standards, never between machinery ratings and IEC 61511 process safety SIL.

Which Standard Applies to Your Machine?

Domain decides the standard, not preference. IEC 61511 governs process safety instrumented systems in chemical, oil and gas, pharmaceutical, and power generation plants operating in low demand mode. ISO 13849-1 and IEC 62061 govern machinery safety functions in robotic cells, packaging lines, and machine tools operating in high demand or continuous mode (NotebookLM, Functional Safety notebook, 2026).

Within machinery, the choice between ISO 13849-1 and IEC 62061 comes down to technology and control complexity. ISO 13849-1 covers electronic, hydraulic, pneumatic, and mechanical safety systems, so it fits mixed-technology circuits like a pneumatic e-stop valve wired to a relay. IEC 62061 covers electrical, electronic, and programmable systems only, and requires the entire safety-related control system to pass assessment as one functional unit. That scope makes it the standard of choice for complex programmable safety controllers, safety PLCs from vendors like Pilz or Rockwell Automation among them (NotebookLM, Functional Safety notebook, 2026).

Both the European Machinery Directive and the current Machinery Regulation (EU) 2023/1230 grant presumption of conformity to a machinery control system that complies with either ISO 13849-1 or IEC 62061 (NotebookLM, Functional Safety notebook, 2026). The technology mix in your loop picks the standard; neither one wins by default.

How Do You Set the Required Level in the First Place?

ISO 13849-1 sets the required Performance Level (PLr) through a qualitative risk graph built on three parameters: Severity of injury (S1 slight and reversible, S2 serious and irreversible or fatal), Frequency and exposure to the hazard (F1 seldom or short exposure, F2 frequent or long exposure), and Possibility of avoidance (P1 avoidance possible, P2 avoidance scarcely possible or impossible) (NotebookLM, Functional Safety notebook, 2026). A hazard rated S2, F2, P2, serious injury, frequent exposure, no realistic escape, lands at the top of the graph: PLr e.

The 2023 edition tightened the P parameter with a structured five-factor scoring system, since it had been the softest judgment call on the graph. Hazard speed, physical escape room, and hazard perceptibility can each alone justify choosing P2 when unfavorable; operator skill and task complexity push toward P2 only in combination with another unfavorable factor (NotebookLM, Functional Safety notebook, 2026). Process safety SIL targets come from a separate exercise, usually Layer of Protection Analysis (LOPA), which is why this risk graph has no direct process safety equivalent.

What Does This Mean for Sensor and Device Selection?

A SIL or PL figure on a datasheet describes what a component can contribute to a loop. It says nothing about the device on its own. SIL and PL targets apply to the complete safety loop, sensor, logic solver, and final element, evaluated together, and the loop performs only as well as its weakest link (NotebookLM, Functional Safety notebook, 2026). Pair a PLe-rated light curtain with a single-channel relay that carries no monitoring, and the whole function drops to PLb or PLc.

That weak-link rule plays out differently across device families. E-stops and mechanical guard switches are passive, volt-free contacts with no self-diagnostics. A downstream safety relay has to send out-of-phase test pulses and catch wiring faults on their behalf. Wired correctly in a dual-channel configuration to a suitable relay, they support loops up to SIL 3 / PL e. Wire several in series, though, and you introduce fault masking: a fault on one door hides behind an open second door, capping the achievable rating at PL c or lower (NotebookLM, Functional Safety notebook, 2026).

Safety light curtains and laser scanners carry their diagnostics onboard through OSSD solid-state outputs, so wiring them in series avoids fault masking. Type 4 curtains support SIL 3 / PL e work. Type 2 curtains, with far less internal diagnostic depth, cap out at SIL 1 / PL c (NotebookLM, Functional Safety notebook, 2026). Check the type on the nameplate before you assume a curtain's ceiling.

Safety relays and safety PLCs typically carry an "up to SIL 3 / PL e" rating, but reaching that ceiling takes a dual-channel architecture, External Device Monitoring to catch welded contactors, and a monitored reset. None of it happens automatically because the datasheet says PLe (NotebookLM, Functional Safety notebook, 2026). Inductive proximity sensors with OSSD interfaces reach SIL 2 / PL d natively on a single channel and scale to SIL 3 / PL e in a redundant dual-channel setup; rotary and position sensors for mobile hydraulics and robotics generally target SIL 2 / PL d (NotebookLM, Functional Safety notebook, 2026).

For process transmitters, pressure and temperature, SIL is nearly always the reference framework, and manufacturers rate specialized limiters and transmitters from SIL 2 up to SIL 3 with a Safety Manual specifying required test intervals and the exact PFDavg calculation (NotebookLM, Functional Safety notebook, 2026). Anyone speccing a 4-20mA loop into a SIF should pull that Safety Manual before assuming the transmitter's headline SIL claim applies out of the box.

Citation capsule: SIL and PL ratings belong to the complete safety loop, not a single device. A Type 4 light curtain rated PL e drops to PL b or c if paired with an unmonitored single-channel relay, and multiple dry-contact e-stops wired in series cap out around PL c due to fault masking (NotebookLM, Functional Safety notebook, 2026).

Where Do Engineers and Auditors Get This Wrong?

The most common mistake treats SIL or PL as a property of a single component: assuming a valve or an encoder "is SIL 3" rather than "suits a loop rated up to SIL 3" (NotebookLM, Functional Safety notebook, 2026). An encoder specified for a PLd safety function carries no PLd rating of its own; the rating belongs to the function it serves.

A second mistake stops at the math. IEC 61511 SIL compliance requires three barriers to pass at once: the probabilistic PFDavg calculation, minimum hardware fault tolerance, and systematic capability from a documented functional safety management process (NotebookLM, Functional Safety notebook, 2026). A team can produce a flawless PFDavg number and still fail an audit if the functional safety management plan behind it doesn't exist.

A third mistake conflates safety with uptime. Functional safety metrics count only dangerous failures, not spurious safe trips, so a highly reliable SIL 3 loop can trip constantly and still pass every safety check (NotebookLM, Functional Safety notebook, 2026). Engineers who expect SIL to buy plant reliability are solving a different problem than the one SIL addresses. A related error applies high-demand failure rate data to a low-demand SIF, which produces an optimistic PFDavg for a device that sits dormant most of the year.

Audits fail on documentation as often as on hardware. Auditors assess evidence, not equipment, and a missing Functional Safety Management plan is an immediate non-conformance regardless of how well the field devices are calibrated (NotebookLM, Functional Safety notebook, 2026). Common findings include a Safety Requirements Specification that never defines the actual safe state, Factory Acceptance Tests that verify only the logic solver instead of the end-to-end loop, proof tests that skip the diagnostic circuitry, and "proven-in-use" claims backed by no systematic failure log (NotebookLM, Functional Safety notebook, 2026).

Nearly every failure mode above traces back to the same habit: engineers stop at a number, PFDavg, PFHd, RRF, when the standards require documented process alongside it. A SIL 2 calculation with no traceable Layer of Protection Analysis behind it produces a compliant-looking spreadsheet and a system an auditor will reject.

Frequently Asked Questions

Is SIL 2 the same as PL d?

Close, but not identical. IEC 62061 and ISO 13849-1 map PL d to SIL 2 for harmonization, but PL comes from a Category-plus-MTTFd-plus-DC calculation while SIL comes from a pure PFH probability. The mapping holds between machinery standards only, not IEC 61511 process safety SIL (NotebookLM, Functional Safety notebook, 2026).

Can I use a PLd-rated device to meet a SIL 2 process safety requirement?

Not directly. IEC 61511 process SIL and ISO 13849-1 PL cover different domains, and the mapping table applies only between the two machinery standards, IEC 62061 and ISO 13849-1. A PLd machinery component needs its own SIL-relevant failure data before it belongs in a process safety loop (NotebookLM, Functional Safety notebook, 2026).

Does a higher SIL or PL always mean a safer or better system?

No. A higher rating reflects a more severe hazard, not superior engineering. Specifying SIL 3 where SIL 2 suffices adds cost and maintenance burden without adding safety value (NotebookLM, Functional Safety notebook, 2026).

Is a safety sensor itself SIL or PL rated?

Only the complete safety loop, sensor, logic solver, and final element, earns a SIL or PL rating. A sensor datasheet states it suits a loop up to a given level; the sensor alone carries no rating (NotebookLM, Functional Safety notebook, 2026).

Why does IEC 61511 stop at SIL 3 while ISO 13849-1 goes up to PL e?

IEC 61511 excludes SIL 4 because process-grade final elements, like heavy isolation valves, cannot reach the failure probabilities SIL 4 demands. ISO 13849-1 tops out at PL e, which the mapping tables treat as equivalent to SIL 3, not a step beyond it (NotebookLM, Functional Safety notebook, 2026).

Conclusion

SIL and PL both answer one question: how likely is this safety function to fail when called on. IEC 61511 SIL applies to process safety loops in low demand mode, graded by PFDavg. ISO 13849-1 PL and IEC 62061 SIL apply to machinery, graded by PFHd and, for PL, by structural Category plus MTTFd, DC, and CCF. The PL-to-SIL mapping bridges only the two machinery standards, never process safety.

Every mismatch I've traced on a project came from the same root cause: someone read a device rating in isolation instead of asking what loop, what demand mode, and what standard it belonged to. Before that PLd sensor touches a SIL 2 requirement, confirm the domain, confirm the loop, and confirm the calculation. The label alone proves nothing.

For the wiring practices these safety loops share with standard instrument loops, see 4-20mA scaling in the PLC and NAMUR NE 43 fault currents. If you're deciding which controller platform will host the safety logic itself, PLC vs PAC vs RTU is the place to start, and sensor calibration and drift covers what happens to those same instruments between proof tests.