Not everything with a safety consequence needs a SIL

There is a reflex on safety-critical programmes to treat every function with a safety consequence as a candidate for a full functional-safety determination. It feels rigorous. Often it is just expensive.

A worked example

On a station fire alarm system, there was pressure to run a full Safety Integrity Level (SIL) determination across the entire fire scope. I took a different position: fire detection and alarm signalling is governed by the fire code, using listed, tested equipment to recognised standards. Dragging that scope into a SIL framework produces a great deal of expensive evidence answering a question the code has already answered. It is effort spent demonstrating something that is already demonstrated.

But I then isolated the one function that genuinely was a SIL candidate — the automatic clean-agent discharge. That function makes a decision and acts on it: detect, decide, actuate, releasing a suppressant into an occupied space. It closes a control loop with real consequences, and the existing analysis did not cover it. That is where the functional-safety rigour belonged.

Assurance that gold-plates everything is not rigour. It is cost.

Why proportionality is the skill

Applying every framework to every function is easy to defend on paper and ruinous in practice: it burns budget, slows the programme, and buries the genuinely safety-critical functions under a mountain of evidence about ones that were never in question. The skill — and the judgement clients are actually paying an experienced assessor for — is knowing precisely where a standard bites and where another regime already governs the risk.

Proportionate assurance concentrates effort where it changes the safety outcome and accepts, deliberately and on the record, where existing codes and standards already do the job. That is the difference between an assurance function that adds certainty and one that just adds spend.