## 2 System Safety  
According to ref. [11], safety is defined as the absence of unacceptable risk. To make safety measurable, ref. [11] defines four levels of SIL. SIL 1 represents the lowest level of safety, and SIL 4 represents the highest level. The classification into individual SIL levels depends on the degree of fault tolerance of the system. Ageing-related failures are random failures and can be quantified using a probabilistic approach. Faults that can be inadvertently introduced into the system during the development of the system (so-called systematic failures) are very difficult to quantify because we do not know the probability distribution of these failures. However, we can prevent them using various tools and techniques in system development, or they can be detected by testing the system. To achieve a certain SIL, it is necessary to meet the resistance to both accidental and systematic failures.  
Resistance to accidental failures is expressed by the intensity of dangerous system failures. For continuous operation, the intensity of dangerous system faults in the range from \(10^{-9}\) h\({}^{-1}\) to \(10^{-8}\) h\({}^{-1}\) is required to meet SIL 4, and the intensity of dangerous system failures in the range from \(10^{-8}\) h\({}^{-1}\) to \(10^{-7}\) h\({}^{-1}\) is required to meet SIL 3. To meet SIL 2, the intensity of dangerous system failures ranging from \(10^{-7}\) h\({}^{-1}\) to \(10^{-6}\) h\({}^{-1}\), is required. To meet SIL 1, the intensity of dangerous system failures ranges from \(10^{-6}\) h\({}^{-1}\) to \(10^{-5}\) h\({}^{-1}\).  
Resistance to systematic failures is expressed indirectly through measures to prevent and detect failures. It is true that the higher the SIL we want to achieve, the stronger the measures (or combinations of different measures) that must be used. The specific measures depend on the area of application.  
If the system performs more than one safety function, the SIL is evaluated individually for each safety function. This guarantees the objectivity of the evaluation, as not every safety function uses all hardware parts of the system. Since the systems are implemented modularly today, the manufacturers state the SIL for each modular part of the system. Depending on whether this part applies to the implementation of a specific safety function or not, it does or does not affect its SIL. In this article, we will assume that the system performs only one safety function. The problem related to the implementation of multiple safety functions with different SILs utilizing a modular system is dealt with in more detail in refs. [12; 13].  
The SIL of individual safety functions is determined based on a risk analysis. The risk analysis is a separate problem, which is not the subject of this article. Refs. [14; 15; 16] deal with this in more detail.  
Besides random and systematic failures, security accidents can also significantly affect safety, so it is necessary to consider the type of accidents. sPLC and fPLC have some built-in mechanisms for security management. In general, it can be said that these mechanisms are not currently as strong as the mechanisms used in other information technologies. The problem, for example, is the need for frequent updates, which is not a simple issue at the level of the control process. Therefore, a suitable combination of mechanisms at the PLC level and the enterprise level is necessary to eliminate security accidents (we assume that the PLC is one node of the enterprise network). The issue of security accidents is not part of this article and is dealt with in more detail in refs. [17; 18].