Safety-Instrumented Systems
A safety-instrumented system is an independent layer that detects dangerous conditions and forces the process to a safe state, separate from normal control.
A Layer Apart from Control
A safety-instrumented system (SIS) is a dedicated system whose sole job is to bring a process to a safe state when a hazardous condition is detected. It is deliberately independent of the normal control system, because a controller that can cause a hazard cannot be trusted to also protect against it. The SIS watches for defined dangerous conditions and acts through its own sensors, logic, and actuators.
The Safety Function
Each protective action is defined as a safety function: a specific hazardous condition, the way it is detected, and the action that mitigates it. For example, if a measured quantity exceeds a safe limit, the SIS de-energizes a power supply and puts actuators into their safe state. Safety functions are specified precisely, including the time within which they must act, because a protective action that is too slow does not protect.
Independence and Diversity
- Separate sensors, logic solver, and final elements from the control system
- Simple, well-understood logic that is easier to verify than complex control
- Diverse technology where a common fault could defeat identical channels
- De-energize-to-trip design so loss of power drives the safe state
Fail-Safe Design
A well-designed safety system fails toward safety. Where possible, the safe state corresponds to the absence of energy or signal, so that a broken wire, lost power, or failed component causes the protective action rather than defeating it. This principle, de-energize to trip, means that many failure modes automatically produce the safe outcome instead of a dangerous one.
Verification and Layers
Safety systems are verified against a required integrity, expressed as a safety integrity level, and are one of several protection layers. They complement, rather than replace, inherently safe design, alarms, and physical protection. In a facility such as a fusion plant, still at the design and simulation stage, the safety-instrumented layer and hardwired interlocks are engineered to act independently of the plasma-control computers so that a control fault cannot disable protection.