SIS, instrumented function and SIL
The SIS is the system implementing one or more safety instrumented functions, known as SIFs. Each function must link a detected condition with a defined action and safe state.
The safety integrity level, SIL, expresses an integrity requirement associated with the function. It is not an overall installation score. One system may perform functions with different needs, which must be identified and justified separately.
Start with the risk scenario
Assessment identifies hazardous events, consequences and available risk reduction measures. It then allocates the portion of reduction attributable to each function and defines its specification.
HAZOP and layer of protection analysis can contribute to this process. They do not replace subsequent design or justify assigning levels by copying another apparently similar plant.
Normal control, alarms and protection
Basic control maintains ordinary operation. An alarm provides information and requires an effective response; an instrumented function performs the intended action. Not every production automation function should be assumed to provide independent protection.
Shared failures, power, sensors, communications and maintenance must be analysed. If one failure initiates an accident and disables protection, counting both functions as independent barriers may overestimate risk reduction.
Manage the entire lifecycle
The official scope of IEC 61511-1:2016+A1:2017 covers specification, design, installation, operation and maintenance of SIS in the process industry.
HSE guidance on functional safety also highlights validation, periodic testing, modification management and controlled decommissioning. Responsibilities and competence must be defined at each stage; initial documentation loses value if the system changes without review.
Tests, failures and unavailable protection
Tests must be capable of revealing the dangerous failures considered in the design. Their scope and interval require technical justification: checking a signal on a screen does not necessarily verify sensors, logic and final elements.
Results, failures found and actual demands must inform monitoring. Temporary bypasses and maintenance require specific management assessing the protection lost and the conditions for continuing or stopping activity.
Which documentation to review
Relevant information includes the protected scenario, each function’s specification, the required level, design verification, validation results and operating and testing procedures. HSE technical guidance connects this evidence with system management.
This British technical reference does not replace applicable Spanish legislation. Process SIL and machinery PL should not automatically be treated as equivalent either: they concern frameworks and applications requiring selection of the appropriate method.
Hypothetical example: replacing a final element
A facility replaces a valve belonging to a protective function. Although the physical connection is compatible, the technical team reviews response, failure conditions and testing before accepting the change.
Management is not limited to comparing dimensions or price. The complete function is checked to ensure it retains the intended performance, and documentation and maintenance are updated.
