Ask whether instruments of SIL2 level can be combined in a 3-redundancy configuration to achieve SIL3 level

In simple terms: **there is no direct equivalence, but higher security can be achieved under certain conditions; however, this requires systematic evaluation and certification – it’s not as simple as “1+1+1=3”.** ** The manufacturer’s statement is not entirely accurate and can lead to misunderstandings. The following explains it in several points: ### 1. Core principle: The SIL level applies to the \"safety function\" as a whole, not to individual instruments – SIL (Safety Integrity Level) evaluates the probability of failure and the resilience of the **entire safety function circuit** (sensors, logic controllers, actuators) in the event of a hazardous failure. - A single SIL2-certified transmitter means that it can meet the SIL2 requirements **when used alone**. - Improving the reliability of the entire **sensor subsystem** through redundancy (such as triple redundancy) is a **common architectural approach**, but whether the **overall safety function** can reach SIL3 depends on the design and evaluation of the entire system. ### 2. What can redundancy improve? What can’t be improved? - **It can improve:** safety (Safe Failure Fraction, SFF) and the probability of hazardous failures (PFDavg). Through redundancy, the probability of loss of security functions due to random hardware failures can be significantly reduced. Theoretically, with a sensor architecture featuring triple redundancy, the PFDavg value can be **low enough to meet the requirements of SIL3**. - **Cannot be automatically upgraded**: – **Systemic capabilities**: SIL3 imposes **much stricter** requirements for avoiding systemic failures (such as design errors, software defects, common-cause failures) compared to SIL2. Simply combining three SIL2 instruments does not address any potential common design flaws or reasons for failure among them (such as being susceptible to the same type of electromagnetic interference or getting clogged by the same process media). - **Software**: If there is software inside the transmitter, the requirements for software at SIL3 are one order of magnitude higher than those at SIL2. - **Certification**: The fact that an individual instrument has a SIL2 certificate does not mean that the system formed by combining them in a redundant manner automatically obtains a SIL3 certification. ### 3. What is the theoretical basis? The theoretical basis mainly comes from **functional safety standards (such as IEC 61508, IEC 61511)**. These standards allow the level of safety functions to be improved through **Hardware Fault Tolerance (HFT)** and **architectural constraints**. - For the sensor subsystem, to achieve SIL3, it is generally required that **HFT≥2** (i.e., two failures are tolerable). With a triple-redundancy architecture (3 transmitters), if properly designed (for example, using 2oo3 voting logic), its HFT=1; however, through an extremely high diagnostic coverage rate, it **is possible** to meet the requirements of the architectural constraints. - The key is to conduct a **detailed quantitative assessment**, calculating the PFDavg and SFF for the entire redundant sensor subsystem, to determine whether their values **truly fall within the SIL3 range** (with PFDavg between 10^-4 and 10^-3). At the same time, common-cause failure must be strictly evaluated and **mitigated** (usually requiring the introduction of a β factor for corrected calculations). ### 4. So, is what the manufacturer says correct? - **There is some truth to this: under ideal engineering design and evaluation, using three SIL2 transmitters to construct a highly reliable redundant sensor subsystem **may** enable the performance metrics (PFDavg) of such a subsystem to meet the requirements of a SIL3 circuit. - **But it is highly imprecise**: This is by no means as simple as a “equivalent assumption”. It must meet the following conditions: 1. **Overall evaluation**: It must be part of the **entire safety function loop (SIF)**, with comprehensive SIL verification calculations and evaluations carried out by qualified organizations or personnel in accordance with standards. 2. **Protection against common-cause failures**: Special designs must be in place to prevent common-cause failures (such as physical isolation, independent power supply, diversity design, etc.). 3. **System Certification**: Ultimately, it is not the certificate of an individual instrument that matters, but rather whether the **entire Safety Instrumented Function (SIF) or Safety Instrumented System (SIS)** has obtained the corresponding certification or assessment report. ### Conclusions and Recommendations **Do not easily believe the simplified claim that ‘three redundancies with SIL2 instruments equate to SIL3’. ** The correct approach is: 1. **Ask the manufacturer to provide evidence**: Request from them a complete **SIL verification calculation report** based on this configuration, to prove that the PFDavg and architectural constraints of the entire sensor subsystem meet the SIL3 requirements. 2. **Consult independent certification bodies or functional safety experts**: Have a third party review the design plan and assessment report. 3. **Focus on the overall system**: Ensure that logic controllers (such as safety PLCs) and actuators (such as valves) also meet SIL3 requirements, and that the installation, commissioning, and operation and maintenance of the entire system comply with the strict regulations associated with SIL3. **In short: Using three SIL2 transmitters for redundancy is a viable approach to achieving higher safety levels, but to reach SIL3, rigorous systematic evaluation and certification are required; it’s not simply a matter of mathematical addition. ** .

Manufacturers only dare to claim it is “equivalent”; SIL instruments absolutely cannot be compromised.