An engineered system of sensors, logic solvers, and final elements dedicated to automatically bringing an industrial process to a safe state when hazardous conditions are detected — for example shutting an emergency valve on high pressure; each of its safety instrumented functions is assigned a safety integrity level (SIL 1-4) quantifying required risk reduction, and the system is specified, designed, validated, and maintained under the functional safety lifecycle of IEC 61508 and IEC 61511, independently of the basic process control system.
Semantic Classification
Content
Definition
A safety instrumented system (SIS) is an automated protection layer in industrial plants whose sole purpose is to detect the onset of a hazardous condition and drive the process to a safe state without human intervention. Its canonical architecture is a loop of three subsystems: sensors (pressure, temperature, level, flame, gas transmitters) that measure process variables; a logic solver (a certified safety PLC) that evaluates trip conditions; and final elements (emergency shutdown valves, breakers, pumps) that execute the safe action. A single such protective loop is a safety instrumented function (SIF); an SIS implements one or many SIFs — an emergency shutdown of a reactor on high pressure, closure of a fuel line on flame-out, isolation of a compressor on gas detection.
The defining discipline is quantified risk reduction under Functional Safety. Hazard and risk analysis — HAZOP, LOPA, and techniques such as Failure Mode And Effects Analysis — determines how much risk reduction each SIF must provide, expressed as a Safety Integrity Level from SIL 1 (risk reduction factor 10–100) to SIL 4 (10,000–100,000). The SIL then constrains the design: allowable probability of failure on demand, hardware fault tolerance and redundancy architecture (1oo2, 2oo3 voting), diagnostic coverage, and proof-test intervals. Crucially, the SIS is kept functionally independent of the basic process control system, so a control failure cannot disable the protection against its consequences.
The governing standards are IEC 61508 (the foundational functional-safety standard for E/E/PE systems) and IEC 61511 (its process-sector implementation); IEC 62061 applies the same SIL framework to machinery safety, and the whole edifice mandates a managed Safety Lifecycle from hazard analysis through specification, design, validation, operation, and decommissioning, with functional safety assessment at defined stages.
Technical Details
SIL verification computes the average probability of failure on demand (PFDavg) per SIF from component failure rates (λ, split into safe/dangerous, detected/undetected), redundancy architecture, common-cause factors (β-model), diagnostic coverage, and proof-test interval; SIL 2 demands PFDavg between 10⁻³ and 10⁻², SIL 3 between 10⁻⁴ and 10⁻³. Voting architectures trade spurious-trip rate against dangerous-failure rate — 2oo3 sensor voting is the process-industry staple because it improves both. Certified logic solvers (for example HIMA, Triconex, Siemens S7-F, ABB) carry SIL capability certificates from bodies such as TÜV and exida. Current engineering concerns include cybersecurity of safety systems (IEC 62443 alignment, after incidents such as the 2017 TRITON/TRISIS attack on a Triconex SIS), digital proof-testing and predictive diagnostics from SIS data, and the interaction of SIL-rated protection with increasingly autonomous and robotic process operations.
Current Landscape
-
Cybersecurity is now mandatory in the standard: IEC 61511 Edition 2 (2016) made a security risk assessment of the SIS a mandatory part of hazard and risk analysis (Clause 8), directly reflecting the threat demonstrated by the 2017 TRITON/TRISIS attack; the design must now provide resilience against identified security risks.
-
Consolidated 2026 publication: IEC published IEC 61511:2026 SER (a “System Reference” bundling all parts of the process-sector functional-safety standard) on 13 February 2026, with cyber security, smart manufacturing and Industry 4.0 among its keyword scope.
-
Architectural-constraint change: Edition 2 removed the Safe Failure Fraction (SFF) term, adopting the IEC 61508 “Route 2H” approach with hardware-fault-tolerance tables per SIL, and requires a minimum 60% diagnostic coverage for devices using fixed or limited variability languages.
-
SIL 4 discouraged: the second edition strongly advises avoiding SIL 4 safety instrumented functions where at all possible, favouring additional independent protection layers instead.
-
Data-quality emphasis: Edition 2 mandates credible, traceable, documented reliability data and explicit treatment of uncertainty when computing PFDavg, plus mandatory periodic (stage 4) functional safety assessments.
Sources:
-
https://esc.uk.net/changes-to-iec-61511-the-second-edition-part-two/