The basic process control system (BPCS) runs the plant, and the safety instrumented system (SIS) is the independent layer that takes it to a safe state when control is not enough. On a well-drawn P&ID the two never share a tag, a logic solver, or a final element.
This is a reference for the engineer reading a P&ID or building an I/O list who has to keep the two layers apart. It covers what each layer does, why IEC 61511 requires them to be independent, how the separation reads on the drawing and on the I/O list, and the failure mode of mixing them. It is not a SIL-verification or safety-management guide.
Key takeaways
- The BPCS controls, the SIS protects. Two layers, two jobs, two integrity requirements.
- IEC 61511 requires the SIS to be independent of the BPCS: a separate logic solver, and separate final elements.
- On the P&ID the SIS appears as its own loops and tags and a distinct logic solver, not as part of the control scheme.
- On the I/O list the safety points sit on separate cards in a separate rack. They are never mixed onto BPCS I/O.
- A sensor or final element shared between control and safety collapses the independence the SIS exists to provide.
What each layer does
The control layer is the working plant. A pressure transmitter PT-101 feeds a controller PIC-202, which modulates a control valve FCV-302 to hold a setpoint. Levels, flows, and temperatures are held the same way, continuously, by LIC-203, FIC-201, and their valves. This is the layer the operator watches and adjusts, and it is designed for availability and control quality.
The safety layer sits still until it is needed. A safety instrumented function watches for a defined hazardous condition, and when that condition arrives it acts once, decisively, to reach a safe state. A high-pressure switch PSHH-401 feeding a logic solver that closes a shutdown valve ESDV-307 is one such function, SIF-101. It does nothing during normal operation. Its value is entirely in what it does on demand, which is why it is held to a higher standard and kept apart.
Why the separation is required
IEC 61511 is the process-sector standard for safety instrumented systems, and independence between the SIS and the BPCS is one of its core requirements. The reasoning is direct: the SIS is credited in the hazard analysis as a layer of protection that acts when the control layer has already failed or is insufficient. That credit is only real if the safety layer can act independently of the thing it is protecting against.
The SIS is the last automated layer before mechanical protection such as relief valves. If it depends on the same equipment as the control layer, a common failure can defeat both at once, and the layered protection the design assumed is not there. Independence is what keeps the layers from failing together.
How the separation reads on the P&ID
The drawing shows the two layers as distinct schemes. Read the control loops with ordinary ISA rules, then look for what marks a function as safety.
| On the drawing | Control layer (BPCS) | Safety layer (SIS) |
|---|---|---|
| Loop and tag | Control loops, e.g. PIC-202, FIC-201 | Safety functions, often a distinct prefix or SIF number |
| Logic | Shared control-system logic | Independent logic solver, drawn as its own element |
| Final element | Modulating control valve FCV-302 | Dedicated shutdown valve ESDV-307 or SDV-306 |
| Sensor | Single transmitter PT-101 | Dedicated safety sensor, sometimes voted PT-101A/B/C |
The tell is the logic solver and the final element. A modulating valve on a control loop and a shutdown valve on a trip are different devices with different tags, and the cause-and-effect chart, not the control narrative, is where the safety function is defined.
How the separation reads on the I/O list
On the I/O list the signal class of a safety input can look identical to a control input. A discrete trip and a discrete alarm are both digital inputs. What separates them is where they land.
| Column | Control point | Safety point |
|---|---|---|
| Rack / system | BPCS controller PLC-1 or the DCS | Safety logic solver SIS-1 |
| Card | Standard I/O card | SIL-rated I/O card, separate power |
| Signal class | AI / AO / DI / DO | AI / DI / DO, same classes, different card |
| Function | Control and monitoring | Trip and safe-state action |
Carrying a rack or system column is what makes the separation visible on the list. Without it, a safety point and a control point look the same and nothing stops the safety point being assigned to a spare control channel. For the safety points themselves, the SIL-rated I/O list and the voting arrangement carry the detail the trip depends on.
The failure mode: sharing
The reason the rule matters is the failure it prevents. Suppose a single transmitter both feeds the control loop and initiates the trip. When that transmitter fails, the control loop loses its measurement and the safety function loses its initiator at the same moment. The layer that was supposed to catch the consequence of a control failure has been removed by the same event.
This is why IEC 61511 constrains sharing rather than banning outright: where a control sensor is used by a safety function, the design has to add measures and account for the reduced independence in the integrity calculation. The straightforward answer, and the one a clean P&ID shows, is a dedicated sensor and a dedicated final element for the safety function.
How it reconciles with the rest of the set
The separation ties together three documents. On the P&ID it is the distinct safety tags and the independent logic solver. On the I/O list it is the rack and card column that keeps safety points off control hardware. And on the cause-and-effect matrix it is the mapping of each safety input to its safe-state output. Reconciling the three is what catches a trip that was drawn on the P&ID but landed on a BPCS card, or a safety function that lost its dedicated sensor somewhere between the drawing and the wiring.
A starting point
If you are separating the layers on a live set, the BPCS reference covers the control-layer term, and IEC 61511 for engineers covers the standard that governs the safety layer. Keep the rack and system column on the I/O list from the first draft: it is the single field that keeps control and safety apart all the way from the P&ID to the marshalling cabinet, and it is far harder to add back once the list is built.