Basic Process Control System, BPCS
The basic process control system, BPCS is the regulatory control layer of a plant. The DCS or PLC holding process variables at setpoint during normal operation. Per IEC 61511 and ANSI/ISA 84, the BPCS is structurally separated from the safety instrumented system, SIS. The BPCS owns continuous control. The SIS owns trip and shutdown.
Read one of your own drawings.
Drop a P&ID, instrument index, or schedule. Tagsight reads it to the tag and opens a workspace you keep when you sign in.
PDF · DWG · DXF · TIFF · PNG · XLSX
The BPCS is the system the operator works with every shift. It receives signals from field transmitters, executes PID control algorithms and sequence logic, sends commands to final elements, and presents the process state through the HMI. In a refinery or petrochemical plant this means thousands of control loops running simultaneously. Temperature, pressure, flow, level, and composition loops across dozens of process units. The BPCS also manages alarms, setpoint management, batch recipes, if applicable, and the data historian that records process history. The defining characteristic of the BPCS in the context of IEC 61511 and ANSI/ISA 84 is what it is not. It is not the SIS. The standard requires physical and logical independence between the two systems so that a failure in regulatory control, whether a software bug, a hardware fault, or an incorrect operator action, cannot prevent the SIS from executing its safety functions.
Where does the BPCS sit in the controls hierarchy..
Field instruments feed signals to the BPCS, which runs PID loops, sequence logic, batch recipes, alarms, and HMI graphics. The operator's daily workflow lives entirely in the BPCS. A separate SIS sits alongside it, monitoring the same process variables but only acting when conditions cross a trip threshold. Above the BPCS sits a third tier. Asset management systems, historians, and MES platforms that consume data but do not send control commands. Everything operational runs through the BPCS. The tiers above are read-only consumers of the BPCS output.
BPCS implementations. DCS vs PLC.
A DCS, distributed control system is one implementation of a BPCS, optimized for continuous process control with high loop counts and integrated HMI, historian, and alarm management. Emerson DeltaV, Honeywell Experion, ABB 800xA, Siemens PCS 7, Yokogawa CENTUM, and Foxboro Evo are common DCS platforms used as the BPCS in refineries, chemicals, power, and pharmaceuticals. A PLC-based BPCS is common on smaller facilities, skid packages, and discrete manufacturing. Both serve the same regulatory-control function. The difference is in the scope, integration level, and vendor ecosystem. Rockwell PlantPAx is marketed as a DCS but is built on ControlLogix PLC hardware.
How does BPCS scope appear on a P&ID..
BPCS tags follow ISA 5.1 with no symbology specifically distinguishing them from SIS unless the project house standard adds one. Most teams use the function letter pattern to separate regulatory from safety. Transmitters, T, indicating controllers, IC, and recording controllers, RC typically go to BPCS. High-high or low-low switches, SHH, SLL and safety functions typically go to SIS. The drawing notes section calls out the system split, and some house standards use a different hexagon line style or a prefix letter to mark SIS instruments directly on the symbol. When building the I/O list from P&ID extraction, BPCS versus SIS classification is a downstream filter applied after tags are captured, not a recognition step.
What are the BPCS and SIS separation requirements..
IEC 61511 clause 9.5 requires that the SIS be designed and operated so that a BPCS failure does not impair the SIS. In practice this means separate logic solvers, the BPCS DCS or PLC cannot run SIS logic, separate I/O cards and cabinets, and separate field cabling for SIS-classified instruments. The SIS transmitters and final elements cannot share wiring with BPCS instruments even if they measure the same process point. A BPCS monitoring output from a SIS-classified transmitter is acceptable, the SIS transmitter provides a monitoring signal to the BPCS through a separate output or a galvanically isolated signal conditioner, but the primary SIS trip path must be physically separate.
How does the BPCS handle alarm management..
BPCS alarms are the first line of operator response to abnormal conditions. ANSI/ISA 18.2, Management of the Alarm Systems for Process Industries defines the alarm rationalization and management lifecycle. A well-designed BPCS alarm system presents actionable alarms with appropriate priority and suppresses spurious alarms during startup, shutdown, and known process states. The alarm rationalization output, a master alarm database is a related document that draws on the same tag data as the I/O list, with each alarm point linked to its source instrument tag and P&ID reference.
BPCS vs SIS at a glance.
Regulatory control vs safety protection. Both layers exist on every modern plant. The table covers what differs.
| Aspect | BPCS | SIS |
|---|---|---|
| Purpose | Hold process variables at setpoint during normal operation | Take the process to a safe state on demand |
| Governing standard | IEC 61511, ANSI/ISA 84, independence requirements | IEC 61511, ANSI/ISA 84.00.01, IEC 61508 |
| Independence | Owns continuous control, separated from SIS | Independent from BPCS in hardware, network, and logic |
| Hardware | DCS or general-purpose PLC | SIS-certified controller, Triconex, HIMA, ProSafe-RS, ICS Triplex |
| I/O list flag | Standard signal tag, PIC-101, FT-101 | SIS-prefixed, SDV, XV with SIS interlock, XS, XSV |
| Failure mode | Loss of control, alarm to operator | Trip to safe state, demand on SIF |
| SIL rating | Not SIL-rated, some risk reduction credit allowed up to SIL 1 | SIL 1 to SIL 4 per LOPA, verification |
| Tag color on P&ID | Standard ISA 5.1 bubble | Often heavier outline or diamond per project standard |
Frequently asked.
Is a BPCS always a DCS.
No. Smaller skids and facilities run their BPCS on a PLC. A DCS is one implementation of a BPCS, common in refineries and chemicals where the loop count, continuous-process nature, and HMI scope justify the integrated DCS architecture. Below a few hundred loops, a PLC with third-party HMI software is often more economical.
Why must BPCS and SIS be separate.
IEC 61511 requires it so that a single BPCS failure cannot disable a protective function. A software bug in the BPCS should not freeze the SIS logic solver. A hardware fault on a BPCS I/O card should not cut power to an SIS transmitter. In practice this means separate logic solvers, separate I/O cabinets, and separate field cabling for SIS-classified instruments. Most operating companies translate this into a hard standard. No sharing of any electrical path between BPCS and SIS.
How does the I/O list reflect the BPCS and SIS split.
The I/O list carries a system column that identifies whether each tag terminates in the BPCS or the SIS. Most projects maintain parallel workbooks. A BPCS I/O list for the integrator and a SIS I/O list for the safety system vendor. Tags where a SIS transmitter provides a monitoring signal to the BPCS appear in both workbooks, but the primary SIS-classified signal row must be wired only to SIS I/O.
Can the BPCS initiate a plant shutdown.
The BPCS can initiate a controlled process shutdown as part of normal operations or in response to a non-safety alarm. However, a safety-critical shutdown, one required to prevent a hazardous event, must be initiated by the SIS, not the BPCS. Relying on the BPCS for a safety-critical shutdown is not creditable as a SIS layer of protection under IEC 61511, because the standard requires independence between the two systems.
Where does the BPCS sit in a LOPA.
The BPCS can be credited as an independent protection layer in a LOPA, typically with a risk-reduction factor of 10, probability of failure on demand of 0.1. This credit requires that the BPCS is independent from the initiating event being analyzed and that its control action is a genuine protection against the consequence. Crediting the BPCS as an IPL does not give it a SIL number. It simply counts its risk-reduction contribution toward the tolerable-risk target.