Safety instrumented systems and SIL — the layer that acts on its own

Every topic on this site has mentioned trips, interlocks and SIL in passing. This is the page that explains them.

Control and protection are different jobs

The basic process control system (BPCS) keeps the plant at setpoint. It acts continuously, it is adjusted regularly, and operators interact with it all day.

The safety instrumented system (SIS) does nothing at all — until a defined limit is breached, at which point it acts on its own to bring the plant to a safe state. It is not tuned, it is not adjusted casually, and its changes are controlled.

They are kept as separate systems for one reason:

Layers of protection

Two observations worth making about that stack:

Control is not protection. The BPCS appears as a layer, but it is the layer whose failure creates the demand in the first place. It cannot also be the defence against itself.

The layers below the SIS are mechanical. Relief devices and containment have nothing to fail electrically and nothing to bypass, which is exactly why they sit underneath — the point made in vessels and relief.

What a safety instrumented function is

A SIF is one complete protective action, end to end:

sensor  →  logic solver  →  final element

For example: if vessel pressure exceeds 12 bar, close the inlet valve. That is one SIF, with its own pressure transmitter, its own logic in the safety PLC, and its own shutdown valve.

A SIS is simply the collection of all the SIFs on a plant. Which ones exist, and what each must achieve, comes out of the HAZOP and the subsequent risk assessment.

SIL measures the function, not the device

SIL	PFD on demand	Risk reduction factor	Typically applied to	Note
SIL 1	10⁻² to 10⁻¹	10 – 100	Equipment damage, minor release, most common trips	Usually achievable with a single well-chosen loop
SIL 2	10⁻³ to 10⁻²	100 – 1 000	Serious injury potential, significant release	Often needs redundancy somewhere in the loop
SIL 3	10⁻⁴ to 10⁻³	1 000 – 10 000	Multiple fatality potential, major loss	Redundant sensors and final elements, and rigorous testing
SIL 4	10⁻⁵ to 10⁻⁴	10 000 – 100 000	Almost never used in process industry	If the answer is SIL 4, redesign the process instead

PFD is the probability that the function fails when it is called on. Risk reduction factor is simply its reciprocal — a SIL 2 function is expected to reduce the risk by somewhere between 100 and 1000 times. SIL is a property of the whole function, sensor to final element, not of any one device in it.

PFD is the probability the function fails when called upon. Risk reduction factor is its reciprocal — a SIL 2 function reduces the risk by between 100 and 1000 times.

Note the last row of that table. If the analysis demands SIL 4, the answer is to redesign the process, not to build it. Reducing the inventory, lowering the pressure or changing the chemistry removes the need — which is the top layer of the protection stack doing its job.

Voting: trading one failure against the other

Voting	Trips when	Missed trip risk	Spurious trip risk	Used for
1oo1	The single device says so	Highest — one failure and there is no protection	Low	SIL 1 duties where a single reliable loop suffices
1oo2	Either of two devices says so	Low — either one can save you	High — either one can also trip you unnecessarily	Where a missed trip is far worse than an unnecessary one
2oo2	Both devices agree	High — one failure disables the trip	Low — both must fail the same way to trip you	Where spurious trips are themselves hazardous
2oo3	Any two of three agree	Low	Low	SIL 2 and 3 duties — the usual answer when both matter
1oo2D	Either says so, with diagnostics deciding which to trust	Low	Low	Where diagnostics can reliably identify the failed device

Every arrangement trades two failures against each other. A SAFE failure is a trip that was not needed — production lost, nothing hurt. A DANGEROUS failure is not tripping when you should have. Adding devices in parallel reduces one and increases the other, which is why 2oo3 exists.

Two kinds of failure matter, and they pull in opposite directions:

• A dangerous failure is not tripping when you should have.
• A safe (spurious) failure is tripping when you did not need to.

Adding devices in parallel — 1oo2 — makes a missed trip less likely and a spurious trip more likely. Requiring agreement — 2oo2 — does the reverse. 2oo3 gets both low, which is why it is the usual answer for SIL 2 and 3 duties.

Proof testing is what keeps the SIL real

A SIF may sit untouched for years. Its calculated PFD assumes it is proof tested at a stated interval, and that number is part of the SIL claim.

Miss the tests and the actual PFD drifts upward. The certificate on the wall still says SIL 2; the function no longer is.

Testing the sensor and logic is straightforward. The final element is the hard part, because full-stroke testing a shutdown valve means shutting the plant down. That is what partial stroke testing exists for — it proves the valve is not seized without interrupting production, though it does not prove the valve will seal.

Bypasses

Sometimes a trip genuinely must be inhibited — during start-up, or to replace a transmitter.

Bypasses are therefore built into the system deliberately, and controlled: authorised at a defined level, time limited, alarmed while active, displayed on the operator screen, logged, and formally signed back in.

The cause and effect chart

The SIS is documented in a cause and effect diagram: a grid with initiating causes down one side and actions across the top, and a mark in each cell where that cause triggers that action.

It is the most readable safety document on a plant. One glance tells you what a given trip does, and what will shut down if a particular transmitter goes high. It is used in the HAZOP, in commissioning, in testing, and by operators trying to understand why the plant just stopped.

What to take away

• Control keeps the plant at setpoint; the SIS does nothing until it must act. They are separate systems and must not share elements.
• A protection layer that shares a transmitter or valve with the layer above is not a layer.
• SIL is a property of the whole function, not of any device in it. The final element is usually the weak part.
• If the answer is SIL 4, redesign the process.
• Voting trades missed trips against spurious ones. 2oo3 keeps both low.
• Spurious trips are a safety issue too — a trip system nobody trusts gets bypassed.
• Proof testing at the stated interval is what keeps a SIL claim true.
• A bypass left in place gives no symptom at all. Time-limit them, alarm them, sign them back in.