Safety instrumented systems

In short

A safety instrumented system (SIS) is an independent instrumented layer that detects a dangerous process condition and automatically drives the plant to a safe state — typically by tripping a pump, closing a shutdown valve or venting to flare. It is distinct from the basic process control system (BPCS/DCS) that runs the plant day to day: the SIS does nothing until something goes wrong, then it must work. Its performance is specified as a Safety Integrity Level (SIL 1 to SIL 4) under IEC 61508 (generic) and IEC 61511 (process sector, adopted in India as IS/IEC 61511), computed from the average probability of failure on demand. In India this is core knowledge for refineries, petrochemicals, fertilisers, power plants and pharma (IOCL, BPCL, HPCL, ONGC, Reliance, GAIL, NTPC, Tata Chemicals) and for EPC/automation employers (L&T, Honeywell, Yokogawa, Emerson, Siemens, ABB, HIMA, Schneider-Triconex). It appears in Instrumentation GATE papers, PSU recruitment technical interviews and in functional-safety engineer roles that require TÜV certification.

Explained

What an SIS is, and the layers around it

• Safety instrumented function (SIF): one protective loop with a defined SIL — sensor(s) → logic solver → final element(s). A plant's SIS is the collection of its SIFs; the SIL belongs to the *function*, not to a device.
• Three subsystems: sensors (transmitters, switches, gas/flame detectors), logic solver (safety PLC / solid-state logic), final elements (shutdown valve with solenoid, motor contactor/breaker, de-energised relay).
• Layers of protection (onion model), outermost last: process design → BPCS control → alarms and operator action → SIS trip → physical relief (PSV, rupture disc) → containment (dyke, flare) → plant/community emergency response.
• Independence: IEC 61511 requires the SIS to be separate and independent from the BPCS in sensors, logic and final elements as far as practicable; a device credited as a protection layer cannot also be the cause of the demand.
• Common SIS types: ESD (emergency shutdown), BMS (burner management system for fired heaters and boilers, per NFPA 85/86 practice), HIPPS (high-integrity pressure protection system, used to avoid a flare/relief header), F&G (fire and gas) — F&G is usually a *mitigation* system, and often SIL-rated separately.
• De-energise-to-trip is the normal philosophy: loss of power or air trips the plant (fail-safe). Energise-to-trip (used for deluge, F&G outputs) needs line monitoring and a UPS because loss of power means loss of protection.

Safety lifecycle (IEC 61511 Part 1)

1. Hazard and risk assessment — HAZOP/What-if identifies the scenarios; consequence and likelihood estimated.
2. Allocation of protection layers and SIL determination — risk-graph, risk matrix or LOPA (layer of protection analysis) assigns the required SIL to each SIF.
3. Safety requirements specification (SRS) — the key document: each SIF's trip setpoint, process safety time, SIL, trip action, bypass/reset/override rules, response time, spurious-trip tolerance, proof-test interval.
4. Design and engineering — architecture (1oo1, 1oo2, 2oo3), device selection (IEC 61508-certified or proven in use), SIL verification by calculation.
5. Installation, commissioning and validation (FAT/SAT, full-loop trip testing) — proves the SIS meets the SRS, not merely that it was built.
6. Operation and maintenance — proof testing at the designed interval, bypass control, management of change, functional safety assessment (FSA) at defined stages.
7. Modification and decommissioning — any change re-enters the lifecycle at the appropriate step.
8. Functional safety management (FSM) runs across all phases: competence, documentation, audits, FSA stages 1-5.

SIL, PFD and the two modes of operation

• Low-demand mode (demand rate less than once a year, typical in process plants): performance measured by PFDavg, average probability of failure on demand. RRF = 1/PFDavg.
• High-demand / continuous mode (machinery, interlocks acting continuously): measured by PFH, dangerous failure frequency per hour.
• SIL table (IEC 61508/61511):

• Most process SIFs land in SIL 1 or SIL 2; SIL 3 is uncommon and costly; SIL 4 is practically avoided in process industry — the advice is to reduce risk by design instead.
• Three things must all be satisfied for a claimed SIL: (a) quantitative PFDavg/PFH, (b) architectural constraints — hardware fault tolerance (HFT) with safe failure fraction (SFF), or Route 2H using reliability data, and (c) systematic capability — avoidance of design and software faults.
• Failure categories: λ_S (safe) and λ_D (dangerous), each split detected/undetected by diagnostics. Only λ_DU drives PFDavg for a simplex channel; λ_DD is caught by diagnostics and repaired.
• SFF = (λ_S + λ_DD)/(λ_S + λ_D); diagnostic coverage DC = λ_DD/λ_D.
• Type A devices (simple, well-defined failure modes — e.g. a relay, a solenoid) are allowed a lower SFF than Type B (complex, with microprocessors — a smart transmitter) for the same HFT.

Architectures, voting and redundancy

• 1oo1 (simplex): one channel trips the process. Cheapest; lowest availability both ways.
• 1oo2: either channel trips → highest safety, more spurious trips.
• 2oo2: both must agree to trip → fewer spurious trips, poorer safety than 1oo1.
• 2oo3 (TMR): majority voting — good safety *and* good spurious-trip performance; the standard for SIL 3 logic solvers (Triconex, HIMA, Yokogawa ProSafe-RS, Siemens S7-400FH/1500F).
• 1oo2D: 1oo2 with diagnostics that degrade a failed channel to 1oo1 instead of tripping.
• HFT = number of faults a subsystem can tolerate and still perform: 1oo1 → HFT 0; 1oo2 and 2oo3 → HFT 1.
• Common cause limits redundancy: the beta factor (β) (typically 1-10%) adds a floor to PFDavg that more channels cannot remove. Mitigated by diverse technology, separate cabling and routes, different manufacturers, separate process taps.
• Field devices dominate: typically the final element contributes 50-60% of loop PFD, sensors 20-30%, the logic solver under 10%. A certified SIL 3 PLC does not make a SIL 3 loop.
• Partial stroke testing (PST) of a shutdown valve raises its effective diagnostic coverage (roughly 60-80%) without a shutdown, extending the full proof-test interval.

Setpoints, process safety time and response

• Process safety time (PST_proc): time from the hazardous deviation starting to the hazard occurring if nothing acts. The SIS total response time (sensor + logic scan + valve stroke) should typically be ≤ half the process safety time.
• Trip setpoint sits between the normal operating/alarm range and the safety limit, with allowance for measurement error, dead time and valve closure.
• Bypass/MOS (maintenance override switch): time-limited, logged, with compensating measures and management approval; uncontrolled bypasses are a leading real cause of SIS failure.
• Reset must be manual after a trip; automatic restart after a safety trip is not acceptable.
• Spurious trip rate (STR) and MTTFS matter commercially: a refinery trip can cost crores per day, so architecture must balance safety against nuisance trips.

Indian standards, law and practice

• IS/IEC 61508 (functional safety of E/E/PE safety-related systems, 7 parts) and IS/IEC 61511 (process-sector SIS, 3 parts; the international edition is the 2016 second edition with later amendments) are the governing standards; BIS has adopted them — verify the current adoption year and amendment status on the BIS catalogue before quoting it in a document.
• IEC 61513 for nuclear I&C, IEC 62061 (SIL 1-3) / ISO 13849 (PL a-e) for machinery safety, IEC 61131-3 for PLC programming, IEC 60079 / IS 60079 series and IS/IEC 60079-0 for hazardous-area equipment (Ex d, Ex ia), with PESO (Petroleum and Explosives Safety Organisation) approval needed for such equipment in India.
• Occupational Safety, Health and Working Conditions Code, 2020, in force from 21 November 2025, replaced the Factories Act and governs hazardous process factories, safety committees and on-site emergency plans; the Environment (Protection) Act, 1986 and the MSIHC/chemical-accident rules under it continue to require hazard analysis and safety reports for major accident hazard installations.
• OISD standards (Oil Industry Safety Directorate) — notably the fire-protection standards OISD-STD-116 (refineries and processing plants) and OISD-STD-117 (depots, terminals and pipeline installations), which cover fire and gas detection, and the OISD design/inspection standards — are mandatory for oil and gas installations in India; PNGRB regulations apply to pipelines and city gas.
• API 14C, API 521, API 553, NFPA 85/86 are used alongside, especially in EPC work for international clients.
• Practice in India: SIL determination workshops (LOPA) are normally done with the licensor and an independent facilitator; SIL verification uses tools such as exSILentia/ PHA-Pro with OREDA, exida or manufacturer FMEDA failure-rate data; TÜV Rheinland/TÜV SÜD FS Engineer (TÜV) certification is a common hiring requirement.

Advantages and limitations

• Advantages: quantified, auditable risk reduction; independence from control failures; diagnostics and online testability; recognised basis for insurance and statutory safety reports.
• Limitations: cost (a SIL 3 loop can be several times a SIL 1 loop); dependence on failure-rate data of uncertain quality; spurious trips; whole claim collapses if proof testing or bypass discipline lapses; SIL numbers give false precision when LOPA inputs are guessed.
• SIS does not replace relief devices, mechanical integrity or operator training — it is one layer.

Key points

• SIS - independent instrumented layer: sensor + logic solver + final element, driving the process to a safe state.
• SIF - a single safety function with its own SIL; SIL applies to the function, never to a single instrument alone.
• BPCS vs SIS - BPCS controls continuously; SIS is dormant and must act on demand; they must be independent.
• SIL 1-4 - defined by PFDavg bands of 10⁻¹…10⁻⁵; RRF = 1/PFDavg.
• Low demand uses PFDavg; continuous/high demand uses PFH per hour.
• PFDavg ≈ λ_DU × TI/2 for a simplex channel — the basic examinable formula.
• SFF and HFT - architectural constraints; Type B (complex) devices need higher SFF than Type A for the same HFT.
• 2oo3 (TMR) - best balance of safety and availability; standard for SIL 3 logic solvers.
• 1oo2 maximises safety but doubles spurious trips; 2oo2 reduces trips but weakens safety.
• Common cause (β) - sets a floor on PFD that redundancy cannot cross; fought with diversity and separation.
• Final elements dominate loop PFD; the certified PLC is the smallest contributor.
• Proof test interval TI - halving it roughly halves PFDavg; partial stroke testing buys coverage without shutdown.
• De-energise to trip is the default fail-safe design; energise-to-trip needs monitored circuits and UPS.
• Process safety time - SIS response should be about half of it or less.
• Safety lifecycle - risk assessment → SIL determination → SRS → design and verification → validation → O&M → MOC.
• LOPA - semi-quantitative method giving the required SIL from initiating event frequency, IPL credits and tolerable frequency.
• Standards - IS/IEC 61508 generic, IS/IEC 61511 process, IEC 62061/ISO 13849 machinery, OISD and PESO in Indian oil and gas.
• Bypasses and skipped proof tests destroy a validated SIL faster than any hardware weakness.

Formulas and examples

Example 1 — PFDavg and SIL of a simplex loop. A pressure transmitter has λ_DU = 300 FIT, the safety PLC 100 FIT and the shutdown valve assembly 1,200 FIT. Proof test every year (TI = 8,760 h).

• λ_DU total = (300 + 100 + 1,200) × 10⁻⁹ = 1.6 × 10⁻⁶ /h.
• PFDavg = 1.6 × 10⁻⁶ × 8,760/2 = 1.6 × 10⁻⁶ × 4,380 = 7.01 × 10⁻³.
• That is between 10⁻³ and 10⁻², so SIL 2; RRF = 1/7.01 × 10⁻³ ≈ 143.
• Contributions: valve 1,200/1,600 = 75%, transmitter 18.8%, PLC 6.3% — the valve is where improvement pays.

Example 2 — effect of test interval. Same loop, proof test every 6 months (TI = 4,380 h).

• PFDavg = 1.6 × 10⁻⁶ × 2,190 = 3.50 × 10⁻³, RRF ≈ 285. Still SIL 2, but twice the margin — testing frequency is a design variable, not a maintenance detail.

Example 3 — redundancy and common cause. Duplicate the valve (1oo2 on trip) with λ_DU = 1,200 FIT each, TI = 8,760 h, β = 5%.

• λ_DU × TI = 1,200 × 10⁻⁹ × 8,760 = 1.0512 × 10⁻².
• Independent term = (1.0512 × 10⁻²)²/3 = 1.105 × 10⁻⁴/3 = 3.68 × 10⁻⁵.
• Common-cause term = 0.05 × 1.0512 × 10⁻²/2 = 2.63 × 10⁻⁴.
• PFD_valves ≈ 3.00 × 10⁻⁴ — against 5.26 × 10⁻³ for one valve: a 17-fold improvement, and 88% of what remains is common cause.
• New loop PFD = 3.00 × 10⁻⁴ + transmitter 1.31 × 10⁻³ + PLC 4.38 × 10⁻⁴ ≈ 2.05 × 10⁻³ → still SIL 2: now the *transmitter* is the weak link. This is why you redo the apportionment after every change.

Example 4 — SIL determination by LOPA. A reactor overpressure scenario: initiating event (cooling-water failure) frequency 0.1 /yr; consequence is a fatality; tolerable frequency for this consequence 10⁻⁵ /yr. Existing IPLs: operator response to alarm (PFD 0.1) and a relief valve (PFD 0.01).

• Frequency with existing IPLs = 0.1 × 0.1 × 0.01 = 10⁻⁴ /yr.
• Required PFD of the SIF = 10⁻⁵/10⁻⁴ = 0.1 → the gap needs SIL 1 (PFD 10⁻² to 10⁻¹), sitting at its boundary, so SIL 1 with design margin or SIL 2 if the data is uncertain.

Example 5 — SFF, HFT and architectural constraint. A smart level transmitter (Type B) has λ_S = 400 FIT, λ_DD = 500 FIT, λ_DU = 100 FIT.

• λ_D = 500 + 100 = 600 FIT; DC = 500/600 = 83.3%.
• SFF = (400 + 500)/(400 + 600) = 900/1,000 = 90%.
• For a Type B element with 90% ≤ SFF < 99% and HFT = 0, IEC 61508-2 Route 1H permits a maximum of SIL 2; SIL 3 with this device would need HFT = 1 (i.e. a redundant transmitter). Note the quantitative result alone would not have revealed this limit.

Where it is used

• Refineries and petrochemicals: ESD and HIPPS on crude units, hydrocrackers and compressors — IOCL Panipat/Paradip, BPCL Kochi, RIL Jamnagar, HPCL; OISD compliance audited.
• Fertiliser, chemicals and fine chemicals: ammonia and urea plant interlocks, reactor runaway protection — RCF, GSFC, Tata Chemicals, Deepak Nitrite; MSIHC safety reports cite the SIFs.
• Power and boilers: burner management systems and turbine protection in NTPC, Adani Power and captive plants; furnace purge and flame-failure interlocks.
• Pharma and bulk drugs: solvent handling, reactor interlocks, F&G in Hyderabad/Vizag clusters, under GMP plus functional-safety documentation.
• Job roles: functional safety engineer (FS Engineer TÜV certified), SIS/ESD design engineer, HAZOP-LOPA facilitator, C&I commissioning engineer, proof-test and maintenance engineer — hiring at L&T, Honeywell, Yokogawa, Emerson, Siemens, ABB, Jacobs, Toyo, EIL.
• Products: Triconex, HIMA H51q/HIMax, Yokogawa ProSafe-RS, Siemens S7-1500F/400FH, ABB AC800M HI, SIL-rated solenoids, ESD valves and partial-stroke kits.

Interview questions

• Q: How does an SIS differ from a DCS? A: The DCS controls the process continuously; the SIS is a dormant, independent layer that acts only when a dangerous condition occurs and must be designed, verified and tested to a SIL.
• Q: What does SIL 2 mean numerically? A: PFDavg between 10⁻³ and 10⁻² in low-demand mode, i.e. a risk reduction factor of 100 to 1,000; in continuous mode, PFH between 10⁻⁷ and 10⁻⁶ per hour.
• Q: Can you buy a SIL 3 loop by buying a SIL 3 PLC? A: No. SIL applies to the whole function; the final element usually dominates PFD, so sensors and valves must also meet the apportioned targets.
• Q: What is the formula for PFDavg of a simplex channel and what does it tell you? A: PFDavg ≈ λ_DU × TI/2 — it says only undetected dangerous failures matter and that PFD is proportional to the proof-test interval.
• Q: Why does adding a second channel not reduce PFD indefinitely? A: Common-cause failures (β factor) add a term independent of redundancy, so PFD floors out at roughly β × λ_DU × TI/2.
• Q: What are the three requirements for claiming a SIL? A: The quantitative PFDavg/PFH target, the architectural constraints (HFT with SFF, or reliability-data Route 2H), and systematic capability for avoiding design and software faults.
• Q: Why de-energise to trip? A: A power, cable or air failure then produces a trip rather than a loss of protection, so most failures are safe rather than dangerous.
• Q: What is partial stroke testing and why use it? A: Moving a shutdown valve a short distance online to detect sticking; it adds diagnostic coverage and lets the full proof-test interval be extended without a shutdown.
• Q: Why is 2oo3 preferred for safety PLCs over 1oo2? A: It gives HFT 1 with good safety while a single channel failure does not trip the plant, so spurious trip rate stays low.
• Q: What is process safety time and how does it constrain design? A: The time available from deviation to hazard; the total SIS response — detection, logic scan and final element stroke — should typically be no more than half of it.
• Q: How is the required SIL decided? A: By risk graph, calibrated risk matrix or LOPA — comparing the unmitigated scenario frequency with the tolerable frequency and crediting existing independent protection layers.
• Q: What happens to the SIL claim if proof tests are skipped or a bypass is left in? A: The claim is void — PFD grows with the elapsed interval and a bypassed SIF has a PFD of 1 for that period; both are management-of-change and audit findings.
• Q: Is a relief valve an independent protection layer? A: Yes, if it is independent of the initiating cause, effective for that scenario and auditable (inspected and tested) — typically credited a PFD of 0.01.

Common mistakes

• Calling a device "SIL 3" — certification states a device's *capability* (and SFF/HFT limits), while SIL belongs to the function.
• Using λ_D or total λ instead of λ_DU in PFDavg, giving a pessimistic or meaningless number.
• Mixing units: λ in FIT (per 10⁹ h) with TI in years; always convert TI to hours (1 year = 8,760 h).
• Forgetting the common-cause term in redundant architectures, so the calculated PFD is optimistic by an order of magnitude.
• Crediting the BPCS, its sensors or the operator twice as independent protection layers in LOPA.
• Confusing 1oo2 and 2oo2 — "1 out of 2" means one channel is enough to trip (safer, more nuisance trips).
• Treating validation as FAT: validation means proving each SIF against the SRS by full-loop testing, including trip setpoints and response times.
• Assuming higher SIL is always better — spurious trips, cost and complexity rise, and IEC 61511 favours reducing risk by design over chasing SIL 3.

Related topics

PLC and SCADA basics · Distributed control systems · Process hazard analysis: HAZOP and LOPA · Control valves and final control elements · Hazardous area classification and intrinsic safety · Reliability engineering and availability