SIS & SIL Basics

This is an introduction. Real SIS design and changes follow IEC 61511 (and IEC 61508 for the equipment), your company's procedures and a competent, qualified team.

Layers of protection

No single safeguard is trusted on its own. Risk is reduced by independent layers, each able to stop the incident if the one before it fails:

Each ring is an independent protection layer. The SIS acts automatically when control and operator action were not enough.

SIS vs BPCS, and the SIF

The BPCS (basic process control system, the DCS) keeps the process on target. It is not trusted for safety.
The SIS is a separate, independent system: its own sensors, its own logic solver (a safety PLC) and its own final elements.
A SIF (safety instrumented function) is one specific protection, for example "on high-high pressure in V-101 (PT-301A/B/C, 2oo3), close the inlet shutdown valve SDV-301 within 3 seconds." A SIS contains many SIFs, and each has its own SIL target.

SIL levels

A hazard study (HAZOP, then LOPA) decides how much risk reduction each SIF must give. That target is its Safety Integrity Level. For a function that is only asked to act occasionally (low demand), it is expressed as the average probability of failing when needed, PFDavg:

SIL	PFDavg (low demand)	Risk reduction factor	Means roughly
SIL 1	0.1 to 0.01	10 – 100	works at least 90 % of the time when demanded
SIL 2	0.01 to 0.001	100 – 1 000	at least 99 %
SIL 3	0.001 to 0.0001	1 000 – 10 000	at least 99.9 %
SIL 4	0.0001 to 0.00001	10 000 – 100 000	rare in the process industry

The PFDavg depends on the equipment failure rates, the architecture (voting), the diagnostics, and very much on how often the function is proof-tested.

Voting: 1oo1, 1oo2, 2oo3

"MooN" means M out of N channels must see the trip to act.

Voting	Trips when	Safety (fails to trip?)	Spurious trips
1oo1	the one sensor trips	one failure can block the trip	one failure can trip the plant
1oo2	either of two trips	very good: both must fail to block it	more spurious trips
2oo2	both must trip	poorer	very few spurious trips
2oo3	any two of three trip	good	few: one faulty sensor can't trip alone, and one can be maintained

Try the 2oo3 logic yourself in the Logic Gate Simulator.

Proof testing

Some failures are dangerous and undetected: a stuck valve or a frozen transmitter looks healthy until it is needed. A proof test finds them by testing the whole function at a fixed interval (for example every 12 or 24 months):

Follow the written proof-test procedure for that SIF; get the permit and bypass approval.
Apply a real or simulated trip condition at the sensor.
Confirm the logic solver votes and acts, and the final element reaches its safe state within the required time.
Check the valve closes fully (and, if required, its leakage) and that feedback and alarms are correct.
Restore, remove the bypass, and record results, as-found and as-left, and any failures.

Partial stroke testing of valves (a small movement while running) can find some valve failures between full proof tests, but does not replace them.

Bypasses and overrides

A bypassed SIF gives no protection. Bypasses need authorisation, a time limit, compensating measures (such as an operator watching the variable), and must be shown clearly on the HMI.
Never use jumpers or forced inputs on a safety system outside the approved bypass procedure.
Any change to a SIF (setpoint, voting, device type) is a management of change item, not a routine edit.

The safety lifecycle (IEC 61511) in one line each

Hazard & risk assessment: HAZOP, then LOPA, identify SIFs and their SIL targets.
Safety requirements specification (SRS): what each SIF does, trip points, response time, SIL, proof-test interval.
Design & verification: choose devices and voting, calculate PFDavg, check it meets the SIL.
Install, commission & validate: full functional test (FAT/SAT) against the SRS.
Operate & maintain: proof tests, bypass control, record demands and failures.
Modify or decommission: under management of change, going back to the right step.