On this page10 sections
Already have the specification? The enquiry checklist is in the last section; send the specification to enquiry@flowsynergy.ae for valve selection and technical support.
What does SIL mean on a valve specification?
On a valve specification, SIL 2 or SIL 3 means the valve and actuator will be the final element of a safety instrumented function that must reach that safety integrity level. The valve has to close, or open, on demand when the safety system trips.
The reference entry on safety integrity level defines SIL as "the relative level of risk-reduction provided by a safety instrumented function (SIF)", and notes that under the standards based on IEC 61508, "four SILs are defined, with SIL4 being the most dependable and SIL1 the least."
A typical safety function, in the reference entry on safety instrumented systems, is a temperature sensor whose signal goes to a controller, which "sends a signal to an emergency on-off valve actuator which stops the flow of heating fluid to the process" if the temperature runs too high. The actuated valve is the part that acts on the process.
What separates SIL 2 from SIL 3?
SIL 3 asks for ten times more risk reduction than SIL 2. For a low-demand safety function, a SIL 2 function must cut the risk by a factor of 100 to 1,000 and a SIL 3 function by 1,000 to 10,000, so a SIL 3 valve package must be less likely to fail when called on.
Those ranges are the risk reduction factors the safety integrity level entry gives for low-demand operation under IEC 61508; the probability that the function fails on demand falls by the same factor of ten at each level. The standard's own tables and calculation rules are not reproduced here.
The doubling-up shows on valve certificates. Ville Kähkönen of Metso Flow Control, writing in Chemical Engineering, gives the example of a valve that is "SIL 3 capable in an HFT 1 (hardware fault tolerance) configuration," which he explains "means there must be two valves in a 'one out of two' (1oo2; duplex) configuration to satisfy the SIL 3 requirement."
Is a SIL rating given to the valve or to the whole safety loop?
The SIL belongs to the safety function, the whole loop, not to the valve on its own. A valve or actuator cannot be "a SIL 3 valve" by itself; it can be certified as capable of use in a SIL 2 or SIL 3 function, and the loop designer uses its failure data to prove the whole function reaches its level.
The safety integrity level entry warns against using SIL out of context, citing labels such as "This is a SIL 3 heat exchanger", and states that "According to IEC 61508, the SIL concept must be related to the dangerous failure rate of a system, not just its failure rate or the failure rate of a component part."
A safety instrumented system includes sensors, "a logic solver which processes this information", and "final elements which receive the output of the logic solver and take necessary action on the process to achieve a safe state", and all of them "must function properly for the SIS to perform its SIF". On a pipeline, the final element is usually the shut-off valve with its actuator, solenoid valve and any switches.
How is the required SIL decided?
The required SIL is set by the plant's risk study, not chosen from a catalogue. The study works out how much the hazard must be reduced to reach a tolerable risk, and each order of magnitude of reduction raises the SIL by one, up to SIL 4. On a valve line, the SIL is a decision already made upstream.
SIL allocation compares the risk of a hazard without the safety function against "a tolerable risk target", and "each order of magnitude of risk reduction that is required correlates with an increase in SIL, up to a maximum of SIL4." Layer of protection analysis is "by far the most commonly used" assignment method in large industrial facilities. In the process industries, the hazard study behind it "is usually a hazard and operability study (HAZOP)".
Which standards govern SIL on process plant?
Two IEC standards govern SIL on process plant. IEC 61508 is the general functional safety standard for electrical, electronic and programmable safety systems; IEC 61511 applies it to safety instrumented systems in the process industry sector, such as refineries, petrochemical and chemical plants, and power.
| Standard | Title | What it covers |
|---|---|---|
| IEC 61508 | Functional safety of electrical/electronic/programmable electronic safety-related systems | The generic framework; defines the four SILs |
| IEC 61511 | Functional safety: safety instrumented systems for the process industry sector | The same requirements in process industry terms, through the whole safety life cycle |
| ANSI/ISA-84.00.01 | Functional safety: safety instrumented systems for the process industry sector | The US standard; its 2004 edition mirrors IEC 61511 in content |
The IEC 61511 reference entry notes that the standard "does apply to equipment using pneumatic or hydraulic systems to manipulate final elements", which covers a pneumatic actuated valve, and that CENELEC has adopted it as EN 61511.
What should a SIL certificate for a valve or actuator show?
A SIL certificate should name the device, the SIL it is capable of and under what condition, who assessed it and by which route, and give failure data: failure rates, the safe failure fraction, the hardware fault tolerance and an example average probability of failure on demand. Under IEC 61508 a device must meet both hardware and systematic requirements.
IEC 61508 groups its requirements into "hardware safety integrity and systematic safety integrity", and "A device or system must meet the requirements for both categories to achieve a given SIL." For hardware, "the device must meet targets for the maximum probability of dangerous failure and a minimum safe failure fraction."
A published example shows what this looks like. Kinetrol's March 2022 SIL certificate for its actuators was assessed under the CASS methodology "using the Route 1H approach", lists failure rates from a failure mode and effect analysis, and tabulates each model's safe failure fraction, hardware fault tolerance and PFDavg, noting that the PFDavg figures "are for illustration only assuming a proof test interval of 8,760 hours". The level a real loop reaches depends on its own test interval.
Certification can come from a third party, such as Bureau Veritas, CSA Group, TÜV Rheinland, TÜV SÜD or UL, and "Self-certification is also possible." Kähkönen adds that "Usually, certificates speak only to SIL capability, such as a valve being 'SIL 3 capable.'" Ask which route, which conditions and which parts of the package the certificate covers: valve, actuator and solenoid valve may each carry their own.
What is partial stroke testing, and does it replace the proof test?
Partial stroke testing moves a shut-down valve a short way and back while the line keeps running, to show it is not stuck and to find part of its possible faults. It does not replace the full proof test: the valve must still be fully stroked at the interval the safety design sets.
The partial stroke testing reference entry describes it as a way "to test a percentage of the possible failure modes of a shut down valve without the need to physically close the valve", and is clear on the limit: "Partial stroke testing is not a replacement for the need to fully stroke valves as proof testing is still a mandatory requirement."
Kähkönen makes the same point from the valve side: "proof testing cannot be avoided by conducting the partial-stroke test alone, but the testing interval can be changed." If a SIL line asks for partial stroke testing, the actuator and its controls have to allow it, so say so at enquiry.
What should you send with a SIL valve enquiry?
Send the safety function's details with the valve line, not just "SIL 2": the SIL and the standard, the safe action, the valve and actuator types, the certificate you need and the test regime. That lets the valve package be matched to the safety study rather than guessed.
- The required SIL and the standard named (IEC 61508 or IEC 61511), and any fault tolerance condition such as two valves in 1oo2.
- The safe action: close or open on trip, and the required closing time if one is set.
- Valve type, size, pressure class and materials, and the actuator type (spring return or double acting) and how it reaches the safe position on loss of air or power.
- The certificate you need: SIL capability for valve, actuator or the assembly, third-party or maker's own.
- Whether partial stroke testing is required, and the proof test interval if known.
- Area classification and ingress protection for the actuator and its accessories. Our guides to explosion-proof actuators, actuator IP ratings and NAMUR mounting cover those, and the fail-close actuated ball valve guide shows a fail-safe package.
Send the line to enquiry@flowsynergy.ae for valve selection and technical support, see our valve selection guide, or our actuators, dampers and fittings page.
Frequently asked questions
Can a valve be SIL 3 certified on its own?
Not in the sense of making the whole safety function SIL 3. A valve or actuator can be certified as SIL 3 capable, sometimes only in a fault tolerant arrangement such as two valves in 1oo2, but the SIL belongs to the full loop of sensor, logic solver and final element.
Is a higher SIL always better to ask for?
Not by itself. Each SIL step stands for about ten times more risk reduction, and the level on the line should match the plant's risk study. Ask the safety engineer which SIL the function needs before setting it on a valve enquiry.
Does partial stroke testing count as the proof test?
No. Partial stroke testing finds part of a valve's possible faults without closing the line, but the full stroke proof test is still mandatory. In Kähkönen's words, the proof test cannot be avoided by the partial stroke test alone, "but the testing interval can be changed."
Is ANSI/ISA-84 different from IEC 61511?
Its 2004 edition largely mirrors IEC 61511 in content, with a clause for existing systems built to earlier practice, which the owner must show are designed, maintained, inspected, tested and operated safely. A line may name either, depending on where the plant's practice comes from.
Sources quoted on this page
Read 14 November 2026. Confirm every detail against the current edition of any standard named and the certificate for the exact valve and actuator.
- Ville Kähkönen, Metso Flow Control, Emergency shutdown valves: a functional safety approach to selection, Chemical Engineering: SIL capability, HFT and 1oo2, proof and partial stroke testing.
- Kinetrol, SIL certificate for spring return and double acting actuators, March 2022: a published example of what a certificate contains.
- Wikipedia, Safety integrity level, Safety instrumented system, IEC 61511 and Partial stroke testing.
No clause or table from IEC 61508, IEC 61511 or ANSI/ISA-84 is reproduced here; the standards are summarised from published reference pages. Products and makers named are published examples, not a statement of what Flowsynergy supplies or certifies.