A target SIL is only as meaningful as the tolerable frequency it is compared with. That value is a company decision, normally derived from national guidance and company policy.
The ALARP framework
A widely referenced framework is the UK HSE's "Reducing risks, protecting people" (R2P2). It describes three regions of risk:
- Unacceptable: risks so high they must be reduced whatever the cost. For workers the boundary is an individual risk of death of about 1 in 1,000 per year; for the public about 1 in 10,000 per year.
- Tolerable if ALARP: risks accepted only if further reduction would be grossly disproportionate to the benefit.
- Broadly acceptable: below about 1 in a million per year, where further effort is not normally required.
From individual risk to TMEL per scenario
An individual is exposed to many scenarios. Companies therefore set the tolerable frequency for a single scenario well below the individual risk limit, by consequence category. A typical structure (values are company decisions):
| Consequence category | Example | TMEL structure |
|---|---|---|
| Serious injury | lost-time injury | highest TMEL of the safety categories |
| Single fatality | one fatality on site | one order of magnitude lower |
| Multiple fatalities | several fatalities on site | another order lower |
| Off-site effects | public harm | lowest |
Environmental and asset categories often have their own scales.
Practical points
- State the TMEL basis in every LOPA (First Out AI field "Basis of the TMEL").
- Use the same criteria in the risk matrix and risk graph calibration, so the three methods agree.
- When the calculated RRF is near a band boundary, look at the uncertainty before choosing the SIL.
Source: HSE, Reducing risks, protecting people (2001), https://www.hse.gov.uk/managing/theory/r2p2.pdf
Written for First Out AI as engineering guidance. It supports engineering work and does not replace it; check every value against your standards, certificates and company rules with a competent functional safety engineer.