Glossary · Functional safety
SIL claim limit (SIL CL)
Also known as: SIL CL, SILCL, Claim limit
German: SIL-Anspruchsgrenze (SIL CL)
In functional safety of machinery under IEC 62061, the SIL claim limit (SIL CL) is the maximum safety integrity level that can be claimed for a subsystem, with regard to its architectural constraints and its systematic safety integrity; the SIL of a safety function can't exceed the lowest SIL CL of the subsystems that perform it.
- Functional safety
- Verification
In one sentence
The SIL claim limit (SIL CL) is the highest SIL a subsystem may be used for under IEC 62061, set by its architecture and systematic integrity.
Example
A light curtain has a SIL CL of 3 and a PFH of 1.5 × 10^-8 per hour; combined with a safety relay of SIL CL 2, the safety function can reach at most SIL 2, even if the summed PFH would allow SIL 3.
How it applies
- Two limits: Under IEC 62061, the SIL achieved by a safety function is limited twice: by the sum of the PFH values of its subsystems (sensor, logic, actuator) and by the lowest SIL CL among those subsystems. Both must meet the required SIL.
- Where the value comes from: The SIL CL of a subsystem follows from its Hardware fault tolerance (HFT) and Safe failure fraction (SFF) and from the measures against systematic failures. For subsystems developed under IEC 61508, the systematic capability limits the SIL CL as well. Manufacturers of safety components state it in their data sheets and safety manuals.
- Machinery: SIL CL values go up to 3 in IEC 62061, matching its highest level, SIL 3.
- Documentation: In the design documentation of the Safety-related control system (SCS), list each subsystem with its SIL CL, PFH, source of the data and conditions of use, and show how the achieved SIL was derived. Quote the SIL CL as a property of the subsystem, never as the SIL of the machine or of the safety function.
SIL CL vs. SIL
The SIL CL is a ceiling for a subsystem: it says up to which level the subsystem may be used. The SIL is the integrity required of, or achieved by, a whole safety function. A SIL CL 3 component in a function doesn't make the function SIL 3.