IEC 61511.

IEC 61511 is the international standard for functional safety in process industries, harmonized in the US as ANSI/ISA 84. It governs the full lifecycle of safety instrumented systems, SIS and defines SIL allocation, proof-test discipline, and the BPCS, SIS independence requirement that drives plant control architecture.

Upload a drawing Pricing

Three drawings included on a new account.

Part ofGlossary

What IEC 61511 means.

IEC 61511 was developed specifically for the process sector and builds on the generic functional-safety framework of IEC 61508. Where IEC 61508 defines requirements for the designers of safety-rated components, transmitters, logic solvers, final elements, IEC 61511 addresses the owner-operator and the engineering contractor who apply those components to protect a specific process hazard. The standard breaks the safety lifecycle into three major parts. Design, hazard identification through SIS design verification, implementation, manufacturing, installation, and commissioning of the SIS, and operation, proof testing, maintenance, and modification. Part 3 provides informative guidance on LOPA as the primary method for assigning SIL targets to each safety instrumented function. The standard was first published in 2003. The 2016 revision, IEC 61511. 2016 tightened requirements around cyber security assessments for the SIS and introduced formal requirements around systematic capability of the engineering team. The US harmonized version, ANSI/ISA 84.00.01, was updated in parallel and is the edition cited in OSHA PSM compliance audits. The practical burden of compliance is in documentation. Each safety instrumented function must have a traceable record from the hazard identification through the SIL verification calculation to the as-built hardware configuration and the ongoing proof-test schedule. That record is audited by regulators, insurers, and owner-operator process-safety teams.

What the standard covers

Five lifecycle phases. Hazard and risk assessment, allocation of safety functions to layers, SIS design, SIS installation and commissioning, SIS operation and maintenance. Each phase produces its own documents. SRS, safety requirement specification, SIS design documentation, proof-test procedures, MOC records. Compliance is auditable by the regulator, OSHA PSM in the US, COMAH in the UK, PSR in Canada, equivalent regimes elsewhere.

What IEC 61511 demands of P&ID work

Every SIS-classified instrument must be identifiable on the P&ID. The drawing must show voting hardware, fail-safe direction, and any bypass or maintenance overrides. Revisions to SIS portions of the P&ID trigger MOC review. When extracting I/O lists, teams maintain SIS scope as a separate filter so the SIS scope can be audited independently.

The safety requirement specification

The SRS is the central document IEC 61511 requires before SIS design begins. It records the safety functions, the SIL target for each function, the required response time, the allowed failure modes, the proof-test interval, the maintenance bypass philosophy, and the functional specification. The SRS is written by the process safety engineer and reviewed by the I&C engineer who will design the hardware to meet it. The SRS is a controlled document. Changes after design sign-off require an MOC. The quality of the SRS is the single largest determinant of whether the resulting SIS is fit for purpose, because the logic solver configuration, the I/O list SIS flag, and the proof-test procedure all derive from it.

IEC 61511 clause 9 and the BPCS, SIS separation requirement

Clause 9.5 of IEC 61511 states that the SIS shall be designed so that faults in the BPCS do not prevent the SIS from performing its safety function. In practice this means. Separate certified-safe logic solvers, separate I/O cards and cabinets, and separate field cabling for SIS-classified sensors and final elements. A DCS channel cannot carry both a BPCS monitoring signal and a SIS trip signal on the same wire, even if the source transmitter has separate outputs. This separation requirement directly drives the I/O list structure. SIS rows form their own workbook with their own hardware assignment, and the two workbooks must not share any I/O card reference. BPCS monitoring outputs from SIS-classified transmitters are permitted but must route through an isolated repeater or a separate transmitter output rather than sharing the SIS trip path.

Proof testing and the document trail

Proof testing is the scheduled demonstration that the entire SIF trip path works. Sensor input through logic solver to final element. IEC 61511 requires that proof tests are documented, that the test procedures are formally approved, and that test records are retained as evidence for regulatory audit. The proof-test interval is chosen during SIL verification to keep the average PFD within the SIL target band over the maintenance cycle. Shortening the interval is the most economical way to compensate for a borderline PFD calculation. Lengthening it reduces maintenance burden but may require more redundant hardware to maintain the SIL. The proof-test schedule is published in the plant's instrument maintenance plan, cross-referenced by SIF tag, and updated through MOC whenever the test procedure or interval changes.

The IEC 61511 safety lifecycle, clause by clause

IEC 61511-1 second edition. Each phase has an input, an output and a verification step, and the standard expects the output of one phase to be the input of the next.

Clause	Phase	What it produces	Who normally owns it
5	Management of functional safety	The functional safety management plan, competence records and the assessment schedule	Functional safety management
6	Safety lifecycle requirements	The agreed lifecycle for this project, and what each phase must hand over	Functional safety management
7	Verification	A verification record at each phase boundary	The discipline owning that phase
8	Process hazard and risk assessment	The hazard list, with consequence, likelihood and the risk reduction required	Process safety, usually from HAZOP
9	Allocation of safety functions to protection layers	The list of safety instrumented functions with a target SIL for each, usually from LOPA	Process safety with the safety system engineer
10	Safety requirements specification	The SRS: inputs, trip points, voting, outputs, safe state, response time, proof-test interval, bypass rules	The safety system engineer
11	Design and engineering of the SIS	Architecture, the SIL verification calculation and the hardware design	The safety system engineer with the vendor
12	Application program development	The logic solver program, reviewed against the SRS	The safety system engineer
13	Factory acceptance test	A tested system, with the FAT punch list closed	Vendor and the project
14	Installation and commissioning	An installed, loop checked system	Commissioning
15	Safety validation	A validation record showing each function performs as the SRS states	Commissioning with functional safety
16	Operation and maintenance	Proof-test records, bypass records, and the demand and failure history	Operations
17	Modification	The change record and a re-verification of every function it touched	Operations with engineering
18	Decommissioning	The authorised removal of a function, with the hazard assessment revisited	Operations
19	Information and documentation	The document set that has to exist and stay current for the life of the plant	Document control

SIL bands for a low demand safety instrumented function

Low demand mode means the function is called on less than once per year. PFDavg is the average probability of failing on demand, and the risk reduction factor is its reciprocal.

SIL	PFDavg range	Risk reduction factor	Typical meaning in a process plant
SIL 1	0.1 to 0.01	10 to 100	The most common target; a single well engineered loop often meets it
SIL 2	0.01 to 0.001	100 to 1,000	Usually needs redundancy somewhere, most often on the sensor
SIL 3	0.001 to 0.0001	1,000 to 10,000	Redundancy through the whole function, and a short proof-test interval
SIL 4	0.0001 to 0.00001	10,000 to 100,000	IEC 61511 states this is not normally achievable in the process sector; the hazard is designed out instead

Common questions

Is IEC 61511 the same as IEC 61508.

61508 is the broader framework for electrical, electronic, programmable electronic safety systems. 61511 is the process-industries-specific implementation of 61508. Process plants comply with 61511. The underlying components, logic solvers, certified transmitters are certified to 61508.

Does IEC 61511 require separate field cabling for SIS.

It strongly recommends physical separation of SIS field paths from BPCS, with the rationale that a common-mode cable failure should not disable both layers. Most operating companies translate this recommendation into a hard internal standard.

When does IEC 61511 compliance become a regulatory obligation.

In jurisdictions where OSHA PSM, 29 CFR 1910.119 or equivalent process-safety regulations apply, the owner-operator must use a recognized and generally accepted good engineering practice, RAGAGEP for SIS design. IEC 61511, ANSI ISA 84 is the accepted RAGAGEP for process-industries SIS, making compliance effectively mandatory in regulated facilities handling covered highly hazardous chemicals.

What is the functional safety assessment required by IEC 61511.

IEC 61511 clause 5.2 requires that a functional safety assessment, FSA is performed at defined points in the safety lifecycle. After the hazard assessment, after the SIS design, and after commissioning. The FSA is an independent review that verifies the work performed at that lifecycle stage is consistent with the standard's requirements. In practice an FSA is typically conducted by an independent process safety expert or a qualified third party, and the findings must be addressed before proceeding to the next lifecycle stage.

Does IEC 61511 address cyber security.

The 2016 edition added a requirement, clause 8.2.4 for a security risk assessment of the SIS before design. The assessment must identify threats, vulnerabilities, and countermeasures for the SIS hardware, network, and software. IEC 62443 is referenced as the applicable cyber security standard for industrial automation and control systems. In practice most operating companies implement this as a formal threat-and-vulnerability assessment at the time of SIS design and again when the SIS is connected to a corporate or industrial network.

How does IEC 61511 scope affect the I/O list structure.

Every SIS-classified instrument tag must appear on the I/O list with its SIL allocation flagged. Most projects maintain a parallel SIS I/O list workbook. The SIS workbook feeds the logic-solver vendor with the hardware specification, and the proof-test team with the field-loop identification. A tag that appears in the BPCS workbook and not in the SIS workbook cannot be credited as a safety instrumented function, regardless of what the P&ID symbol shows.

Written byTagsight Functional Safety DeskUpdated 20 September 2026

Get the SIL verification workbook.

PFDavg by voting arrangement, with proof-test interval and the architectural constraint on the same sheet. Plain .xlsx.

Download the SIL workbook Upload a drawing