Standards explainer

IEC 61508 and IEC 61511 (SIL): what equipment makers must answer in a tender

A plain-English overview of functional safety for bid engineers at valve, actuator and instrument makers: who each standard is for, what SIL means, and what to check before you offer.

By Ademola Afolabi, Founder, New Odyssey Ltd · Last reviewed: 2026-10-23

The short answer

IEC 61508 is the generic functional safety standard device makers design and assess against. IEC 61511 applies functional safety to process-industry safety instrumented systems and is mainly for users and integrators. In a tender, makers answer a SIL requirement with failure data, a safety manual and evidence of suitability for the exact model offered.

Key Takeaways

SIL belongs to a safety instrumented function, not to a single device.
Devices are judged on random hardware failure data and systematic capability (SC 1 to SC 4).
IEC 61511 also allows users to justify a device on documented prior use.
Check which parts of the final-element assembly your data covers, and the proof test assumptions behind it.

Who each standard is for

IEC 61508 and IEC 61511 at a glance (own summary)
	IEC 61508	IEC 61511
Scope	Functional safety of electrical, electronic and programmable electronic safety-related systems, in any sector	Safety instrumented systems for the process industry sector
Main users	Device and system manufacturers	End users, designers and system integrators
Structure	Seven parts: general, hardware, software, definitions, and guidance parts	Three parts: requirements, guidance on applying them, and guidance on setting the required SIL
In a tender	The basis for the maker's failure data, safety manual and assessment	The basis for the buyer's SIL targets and device selection rules

What SIL means for a valve, actuator or instrument

A safety integrity level, SIL 1 to SIL 4, states how much risk reduction a safety instrumented function must provide. The function includes sensors, a logic solver and final elements. A single device is not SIL rated on its own; it is suitable for use in a function up to a given SIL, based on its failure rates, hardware fault tolerance and systematic capability. When a tender asks for a SIL 3 valve, read it as a request for that evidence.

What to check in your offer against a SIL requirement

Any gap becomes a row in your technical deviation list.

Functional safety checks on a final element or instrument offer
Item	Check against	Typical deviation source
Target SIL and function	Specification, data sheet or safety requirements specification	Target SIL stated without the function or safe state
Evidence of suitability	Certificate or assessment report	Covers a different model, option or firmware
Systematic capability	Target SIL	SC lower than the target SIL
Failure data	FMEDA or assessment report	Data covers the actuator only, not the full assembly
Proof test	Buyer's test interval and procedure	Different interval or coverage assumed
Safe state and stroke time	Cause and effect, data sheet	Fail action or stroke time does not match
Partial stroke testing	Specification	No partial-stroke option offered
Documents	VDRL	Safety manual or proof test procedure not listed

Where OdysseyGPT fits

Functional safety requirements are often split between the specification, the data sheets, the safety requirements specification and the VDRL. OdysseyGPT reads the whole package, lists each requirement with a quote and page, and checks it against your own safety manuals and datasheets. It does not calculate PFD or certify devices. See OdysseyGPT for manufacturing.

Buyer questions

20 questions bid engineers, proposal engineers and buyers ask. Last reviewed: 2026-10-23

What is the difference between IEC 61508 and IEC 61511?

IEC 61508 is the generic functional safety standard for electrical, electronic and programmable electronic safety-related systems. Device makers usually design and assess products against it. IEC 61511 applies functional safety to safety instrumented systems in the process industry, and is mainly for end users, designers and integrators. In a tender, makers usually answer with IEC 61508 data used under IEC 61511.

What is a safety integrity level (SIL)?

A SIL is a measure of the risk reduction a safety function must provide, from SIL 1, the lowest, to SIL 4, the highest. For low-demand functions, each level is a band of average probability of failure on demand. For example, SIL 2 sits between one in a hundred and one in a thousand. The process sector rarely uses SIL 4.

Is there such a thing as a SIL 3 valve?

Not strictly. SIL belongs to a whole safety instrumented function, made of sensors, logic solver and final elements, not to one device. A valve or actuator can be suitable for use in a function up to a given SIL, based on its failure data and systematic capability. Tenders that ask for a SIL 3 valve usually mean that, so confirm the wording.

What SIL documents do buyers ask manufacturers for?

Buyers usually ask for a safety manual, failure rate data, often from an FMEDA, and a certificate or assessment report showing suitability up to a stated SIL. They also want the assumed proof test interval, proof test procedure and coverage, and the systematic capability. Check the tender list against what you hold for the exact model and configuration offered.

What is systematic capability in IEC 61508?

Systematic capability, from SC 1 to SC 4, shows how well a device's design and development process guards against systematic faults, such as design or software errors. It is separate from random hardware failure rates. A device generally needs a systematic capability at least equal to the target SIL of the function it serves, unless the system design compensates for it.

What should a device safety manual contain?

A safety manual tells the user how to apply the device safely in a safety function. It typically states the failure modes and rates, the safe state, the assumptions behind the data, the proof test procedure, any diagnostics, and the limits of use. Buyers check that the manual matches the exact model, options and configuration you are offering.

Can a device without IEC 61508 assessment be used under IEC 61511?

Often yes. IEC 61511 lets the user justify a device on documented prior use in a similar environment, as an alternative to IEC 61508 assessment. That evidence usually comes from the user's own records, not the maker's. In a tender, if you cannot offer IEC 61508 data, say so plainly and ask whether prior use is acceptable.

Does a SIL certificate for the actuator cover the whole valve assembly?

No. The final element usually includes the valve, actuator, solenoid valve and sometimes a positioner or partial-stroke device. Each part has its own failure data, and the user combines them. A common tender gap is offering data for the actuator only. State which parts of the assembly your data covers and where it comes from.

What are common SIL deviations in valve and actuator tenders?

Common ones are data that covers only part of the assembly, a systematic capability below the target SIL, a different proof test interval from the one the buyer assumed, and a certificate for a model or option other than the one offered. Another is no partial-stroke test option. List each one in your technical deviation list.

Why do buyers ask for the proof test interval and coverage?

The user's SIL calculation depends on how often the device is proof tested and how many dangerous failures that test reveals. If your data assumes a different interval or coverage from the buyer's plan, the result changes. Give the assumptions behind your data clearly, and raise a clarification if they differ from the tender.

What is partial stroke testing and why do tenders ask for it?

Partial stroke testing moves a valve a small part of its travel while the process runs, to show it is not stuck. It can find some dangerous failures between full proof tests. Tenders may ask for a partial-stroke capable positioner or device. Check whether the tender requires it, which device it names, and whether your failure data covers it.

How do I check fail-safe action against a SIL requirement?

Check that the valve's fail action matches the safe state of the safety function in the tender, such as fail closed or fail open. Then check stroke time, spring or accumulator sizing basis, and tight shut-off if required. These are often in the cause and effect or safety requirements specification rather than the valve datasheet, so read both.

What is a safety requirements specification?

Under IEC 61511, the safety requirements specification describes each safety instrumented function: what it must do, its target SIL, safe state, response time and test needs. Final element requirements in a tender often come from it. If the tender refers to an SRS that was not supplied, ask for the relevant extract before you confirm compliance.

How is IEC 61508 structured?

IEC 61508 has seven parts. Part 1 sets general requirements. Parts 2 and 3 cover hardware and software requirements. Part 4 gives definitions. Parts 5 to 7 give examples and guidance, such as methods for setting SIL targets and techniques and measures. Device makers mostly work with Parts 2 and 3. Tenders usually cite the standard as a whole.

How is IEC 61511 structured?

IEC 61511 has three parts. Part 1 sets the framework, definitions and requirements for the system, hardware and application programming. Part 2 gives guidance on applying Part 1. Part 3 gives guidance on determining the required SIL. In the US, it is adopted as ANSI/ISA-61511. Equipment makers mostly meet it through the data and manuals they supply.

How do I check my datasheet against a SIL requirement in a tender?

List the target SIL, the safety function, the safe state, the stroke time and the proof test assumptions in the tender. Then check your safety manual and failure data for the exact model and options offered. Confirm systematic capability, which parts of the assembly are covered, and the documents the buyer wants. Mark any gap as a deviation or clarification.

What do EPCs ask manufacturers to provide for SIL-rated equipment?

EPCs usually ask for a SIL certificate or assessment report, the safety manual, failure rates, the proof test procedure, and a declaration that the offered configuration matches the assessed one. Some also ask for a partial-stroke test report or field data. The list often sits in the VDRL. See the VDRL guide.

How does OdysseyGPT check SIL requirements in a tender?

OdysseyGPT reads the whole tender package and lists each functional safety requirement, with a quote and page, from the specification, data sheets and ITP. It checks each one against your own datasheets, safety manuals and procedures, and gives it a status such as complies, deviates or document requested. Results export to an editable compliance matrix and deviations list.

Can OdysseyGPT do SIL verification calculations?

No. OdysseyGPT does not calculate PFD, does not perform FMEDA or SIL verification, and does not certify devices. It does not hold copies of IEC 61508 or IEC 61511. It compares what the tender asks for with what your documents state, and shows where each came from. A functional safety engineer must judge the result.

Can a control valve also serve as a SIL final element?

Sometimes, but many users prefer a separate shut-off valve for the safety function. If a tender asks one valve to do both, check the safety manual covers that use, and that control and safety requirements do not conflict. See IEC 60534 control valves and actuator manufacturers for the related checks.

Frequently asked questions

Is IEC 61511 the same as ISA 84?

The US adoption of IEC 61511 is ANSI/ISA-61511, which was previously published under the ISA 84 numbering. Check which designation and edition the tender cites.

Does every valve in a plant need SIL data?

No. Only devices that form part of a safety instrumented function need it. Tenders usually flag those tags on the data sheet or in a separate list.

References

IEC 61508 series: Functional safety of electrical/electronic/programmable electronic safety-related systems

International Electrotechnical Commission

Visit source

IEC 61511 series: Functional safety. Safety instrumented systems for the process industry sector