What is an SIS?
An SIS (Safety Instrumented System) is an independent, automated protection system that brings a process plant to a safe state on its own, for example by closing a valve or stopping a pump, as soon as a measurement shows that the process is about to move outside its safe limits. An SIS consists of sensors, a logic solver and final elements such as shutdown valves, and acts without waiting for an operator. In the process industry its design follows IEC 61511, the sector implementation of the IEC 61508 basic standard for functional safety. Each safety function within the SIS is assigned a SIL (Safety Integrity Level) that states how reliable that function must be.
An SIS intervenes automatically when a process threatens to move outside safe limits.
🧠 What exactly does an SIS do?
An SIS works as an automatic guard rail alongside the normal process control. Every protective loop goes through three steps:
- Detect - a sensor measures a critical process variable, such as pressure, temperature, level or the presence of a flame
- Decide - the logic solver compares the measurement with a defined trip point and determines whether action is needed
- Act - the final element brings the process to the safe state, for example by isolating a feed, stopping a pump or switching off a furnace
So an SIS is not an alarm system: an alarm asks the operator to act, whereas an SIS takes the action itself, regardless of how the operator responds. Most safety functions in the process industry operate in low demand mode: they are called upon no more than once a year and sit waiting the rest of the time. That makes them treacherous, because a hidden defect stays invisible until the moment the function is needed. Diagnostics and periodic testing are therefore just as important as the design. Functions that are demanded more than once a year, or continuously, fall under high demand or continuous mode and are assessed with a different measure.
🔧 What are the components of an SIS?
An SIS is built from three subsystems. Together, for each hazard, they form a SIF (Safety Instrumented Function): one safety function with one trip point and one safe state. An SIS in a large plant can contain tens to hundreds of SIFs.
| Subsystem | Role | Examples |
|---|---|---|
| Sensor | Measures the critical variable | Pressure, temperature and level transmitters, flame detectors, often over a 4-20 mA loop |
| Logic solver | Decides and drives the outputs | Certified Safety PLC or safety controller, sometimes a safety relay for simple functions |
| Final element | Brings the process to the safe state | Shutdown valves with actuator and solenoid valve, motor contactors, relays |
To reach the required reliability, components are often duplicated or triplicated using redundancy. The voting logic determines how many channels must trip before the SIS acts:
| Architecture | Operation | Strength | Weakness |
|---|---|---|---|
| 1oo1 | One channel, one trip | Simple and cheap | A single fault can disable the function |
| 1oo2 | One of two channels is enough to trip | High safety | More spurious trips |
| 2oo2 | Both channels must trip | Few spurious trips | Lower safety |
| 2oo3 | Two of three channels must trip | Balance between safety and availability | More expensive and complex |
The design principle is fail-safe: most SIFs are de-energise to trip, so a broken wire or loss of power drives the process to the safe state rather than away from it.
🏭 Where is an SIS used?
SISs are found wherever a process deviation can lead to an explosion, fire, toxic release or serious injury: chemicals and petrochemicals, oil and gas production, refining, pharmaceuticals, food, power generation and large tank storage.
| Hazardous situation | Typical SIS action |
|---|---|
| Overpressure in a reactor vessel | Stop feed and heating, or open an automated depressurising valve |
| Flame failure in a gas burner | Shut off the gas supply with double block valves (burner management) |
| Excessive temperature in a furnace or reactor | Switch off the heating, possibly start emergency cooling |
| High level in a storage tank | Close the inlet valve or stop the filling pump (overfill protection) |
| Gas leak in a process area | Close emergency shutdown valves and trip the unit via ESD |
| Excessive pressure in a pipeline | Isolate the source with two fast-closing valves (HIPPS) |
A HIPPS (High Integrity Pressure Protection System) is a special SIS application: it isolates the pressure source before overpressure can develop and can therefore supplement or replace mechanical relief or flare capacity. A conventional spring-loaded relief valve, by contrast, is not part of the SIS; it is a separate, mechanical protection layer.
🔢 How do SIS, SIF and SIL relate to each other?
The SIL is determined per SIF, not per SIS. A HAZOP identifies the hazards, after which a LOPA or risk graph calculates how much additional risk reduction the SIF must deliver. That risk reduction sets the SIL:
| SIL | Average probability of failure on demand (PFDavg, low demand) | Risk reduction factor | Dangerous failure frequency per hour (PFH, high demand) | Minimum hardware fault tolerance (IEC 61511:2016) |
|---|---|---|---|---|
| SIL 1 | 10⁻² to 10⁻¹ | 10–100 | 10⁻⁶ to 10⁻⁵ | 0 |
| SIL 2 | 10⁻³ to 10⁻² | 100–1,000 | 10⁻⁷ to 10⁻⁶ | 0 (low demand), 1 (high demand) |
| SIL 3 | 10⁻⁴ to 10⁻³ | 1,000–10,000 | 10⁻⁸ to 10⁻⁷ | 1 |
| SIL 4 | 10⁻⁵ to 10⁻⁴ | 10,000–100,000 | 10⁻⁹ to 10⁻⁸ | 2 |
A SIF only achieves its SIL when three conditions hold at the same time: the calculated failure probability falls within the band, the architecture has sufficient hardware fault tolerance, and every component has the right systematic capability. SIL 4 is barely used in the process industry; IEC 61511 imposes additional requirements on it, and in practice engineers prefer to change the process design or add other protection layers.
🧱 Where does an SIS fit among the other protection layers?
A process plant is protected by several independent layers, an application of defence in depth to process safety. The SIS is the last automatic instrumented layer before physical damage:
- Inherently safe process design
- Basic process control system (BPCS) in a DCS or PLC
- Alarms with operator intervention, backed by alarm management
- The SIS
- Mechanical relief such as safety valves and bursting discs
- Physical containment, such as bunds, and the emergency response organisation
IEC 61511 requires the SIS to be sufficiently independent of the basic control system, so that a single fault cannot disable both layers at once. A protection layer within the basic control system may moreover claim a risk reduction of no more than 10.
| System | Goal | Takes action? |
|---|---|---|
| SCADA / DCS | Process monitoring and operation | Manually or through control loops |
| SIS | Functional safety | ✅ Automatically, to a safe state |
| ESD (Emergency Shutdown) | Shutting down (parts of) a plant | ✅ A subset or application of an SIS |
| Interlock in the basic control | Blocking undesired actions | ✅ Automatically, but not SIL-rated |
| Alarm system | Warning the operator | ❌ Notification only |
Machine builders do not speak of an SIS; there, IEC 62061 and ISO 13849-1 govern safety functions such as an emergency stop.
🔁 How do you design and maintain an SIS in practice?
IEC 61511 describes a complete lifecycle. For an owner-operator it comes down to these steps:
- Hazard analysis - identify scenarios with a HAZOP or bow-tie, including a security risk assessment of the SIS
- SIL determination - use LOPA to allocate risk reduction to protection layers and record the SIL for each SIF
- Safety Requirements Specification (SRS) - define for each SIF the trip point, safe state, response time, test interval and acceptable spurious trip rate
- Design and verification - select certified components, determine the voting logic and calculate the PFDavg
- Testing and validation - carry out a Factory Acceptance Test, a site test and full validation before start-up
- Operation and maintenance - perform periodic proof tests, record every demand and every failure, and manage bypasses strictly
- Modification - route every change to trip points, logic or hardware through Management of Change
Some rules of thumb from practice: a SIF’s response time must stay well within the process safety time, the time between the onset of the deviation and the hazardous event. Proof tests are often aligned with the planned turnaround, while valves can be checked in between with a partial stroke test. A bypass is only permitted with a written procedure, compensating measures and a time limit.
How things go wrong was shown by the disaster at the British Buncefield storage terminal on 11 December 2005. A level gauge stuck, while the independent high-level switch was inoperable because the padlock needed to hold it in its working position had never been fitted. Around 250,000 litres of petrol overflowed, followed by a massive explosion. A protection that is not tested and managed delivers no risk reduction.
🔐 Why does SIS cybersecurity matter?
For a long time an SIS was an isolated system, but modern logic solvers communicate over Industrial Ethernet with the DCS, the engineering station and the historian. That makes the SIS reachable for attackers. In 2017 TRITON proved this is not theoretical: malware attempted to reprogram Schneider Electric Triconex safety controllers at a petrochemical plant in Saudi Arabia.
Since the 2016 edition, IEC 61511 clause 8.2.4 requires a security risk assessment of the SIS, and clause 11.2.12 requires the design to be resilient against the risks identified. In practice this means:
- Own zone - place the SIS in a separate zone with controlled conduits in line with IEC 62443
- Separation or assured integration - choose between a fully separate, an interfaced or an integrated SIS, and justify independence from the basic control system when integrating
- Restrict engineering access - use a key switch or write protection on the controller, and program only from a trusted engineering station
- Safety and security together - use guidance such as ISA-TR84.00.09 to link the security lifecycle to the safety lifecycle
In the Netherlands, regulators of Seveso establishments treat IEC 61511 as the state of the art for instrumented protection; see Seveso and Cybersecurity. Since 15 August 2026 the Dutch Cybersecurity Act also applies, putting OT security on a statutory footing for many chemical and energy companies.
❓ Frequently asked questions
What is the difference between an SIS and a SIF?
An SIS (Safety Instrumented System) is the complete protection system with all sensors, logic solvers and final elements. A SIF (Safety Instrumented Function) is one safety function within that SIS, aimed at one hazard, such as the overfill protection of a single tank. The SIL is determined per SIF, not for the SIS as a whole.
Can an SIS run on the same system as the DCS?
IEC 61511 does not forbid integrating the SIS and DCS, but it requires the SIS to be sufficiently independent of the basic control system. A fault or attack in the DCS must not be able to disable the safety function. Vendors therefore offer integrated platforms with separate, certified safety controllers and strict separation of engineering access.
How often must an SIS be tested?
The test interval of an SIS follows from the SIL calculation and is recorded per SIF in the Safety Requirements Specification. A shorter test interval lowers the average probability of failure, so proof tests are often scheduled during the regular turnaround. Valves can be checked in between with a partial stroke test.
Is an emergency stop the same as an SIS?
An emergency stop is a manually operated safety function, best known from machinery, whereas an SIS acts automatically on process measurements. An emergency stop button can, however, trigger an SIS or ESD system. Machinery falls under IEC 62061 and ISO 13849-1, while SISs in the process industry fall under IEC 61511.
Which vendors make SIS logic solvers?
Well-known SIS platforms include Triconex from Schneider Electric, HIMax from HIMA, ProSafe-RS from Yokogawa, Safety Manager from Honeywell, DeltaV SIS from Emerson and the safety variants from Siemens. These logic solvers are certified to IEC 61508 by an independent body such as TÜV, usually up to SIL 3.
Is an SIS mandatory?
No law literally prescribes an SIS, but Seveso establishments must demonstrably control major-accident hazards in line with the state of the art. Regulators treat IEC 61511 as the reference for instrumented protection. Wherever a risk analysis calls for instrumented risk reduction, an SIS designed to IEC 61511 is therefore indispensable in practice.
📌 In summary
An SIS is an independent, automated protection system that brings a process to a safe state without operator intervention whenever it threatens to move outside its safe limits.
It consists of sensors, a logic solver and final elements with actuators, and is built from SIFs that are each assigned a SIL based on a HAZOP and LOPA. IEC 61511 governs the whole lifecycle, from risk analysis to proof testing and management of change. Since TRITON it has been clear that an SIS must also be protected digitally: in its own zone, with restricted engineering access and a security risk assessment as a fixed part of the safety design.