A safety instrumented system (SIS) is a set of hardware and software controls that shuts down all or part of a process when it detects a hazardous condition. A basic process control system (BPCS) runs normal operation. They use similar parts, but the SIS must be independent of the control system it protects.
Two jobs, similar parts
Both have sensors, a logic solver and final elements such as valves. The difference is purpose. Every element in a SIS is dedicated to its protective role, while the BPCS handles day to day control, recipes, setpoints and optimisation.
An SIS addresses major accident prevention rather than occupational safety. It contains one or more safety instrumented functions (SIFs), each a specific protective action, such as closing a valve when a pressure passes a limit.
Why independence matters
The sources say an SIS must be independent of all other control systems that control the same equipment. The reasoning is simple. If the control system fails in a way that creates the hazard, the layer meant to catch that must not fail for the same reason.
Sharing a network, a workstation, a power supply or a software component can quietly remove that independence. It is also why engineering workstations and remote access paths deserve attention.
How the required reliability is set
Each SIF gets a required Safety Integrity Level, found through a quantitative process hazard analysis such as layers of protection analysis (LOPA). The SIS is credited with a reliability based on that level, which feeds into the plant's overall risk reduction. Our post on SIL and what it means explains the levels.
Compliance is checked during design, construction, installation and operation, using design reviews, factory and site acceptance testing, and regular functional testing.
The standard
IEC 61511, published in 2003 and based on IEC 61508, guides users in applying an SIS in the process industries. Later editions are said to add a security risk assessment obligation, though we could not confirm the clause text from a primary source. Check the current edition.
What attackers and mistakes do to it
The Triton malware, found in 2017 at a petrochemical plant, targeted a safety system, as covered in our post on the Triton attack. Accidental harm works the same way: a bypass left in place after maintenance turns a protective layer into a decoration.
A short review list
- Is the SIS physically and logically separate from the BPCS?
- Who can change SIS logic, from where, and is that logged?
- Are bypasses controlled, time limited and reviewed?
- When was each function last proof tested?
- Is the engineering workstation treated as part of the safety system?
Quick check
Can the control system and SIS share a controller?
The source reviewed says the SIS must be independent from other control systems for the same equipment. Sharing a controller conflicts with that idea.
Is an SIS the only protection layer?
No. It is one layer within a broader risk reduction strategy.
Sources
Secondary summaries; consult IEC 61511 for requirements.
Last reviewed: 19 October 2026.
