Cybersecurity / Safety Instrumented Systems

How to acquire SIS expertise

Safety instrumented systems are becoming an essential part of everyone’s engineering portfolio.

By William (Bill) L. Mostia, Jr., P.E.

Engineering of safety instrumented systems (SIS) and functional safety systems has become a specialty discipline, and there are some signs that it has started to be a commodity engineering skill for instrument, automation and control system engineers. One only needs to look on some of the online job sites like Indeed and Glassdoor to see job postings for these types of engineers that commonly require or desire working knowledge of SIS.

To be competent in this discipline requires experience, knowledge and skills related to SIS and functional safety, as well as a good working knowledge of process safety and plant operations, as well as chemical, electrical and mechanical engineering. So, while developing knowledge and specific skills in the SIS area is important, one shouldn’t pass up learning activities in these other areas to broaden your horizons. You should plan your training to cover a broad range of knowledge and skills related to process and functional safety.

While it is generally not required for a SIS engineer to be an expert in cybersecurity, they must have a working knowledge of methods of protecting the SIS and other functional safety systems against cyber threats, as the SIS and mechanical protection systems may be the last lines of defense to a cyberattack on an instrument and control system (ICS). They should also be able to work at a technical level with the ICS IT/OT cybersecurity people to help ensure the safety integrity of the SIS from cyberattacks.

It is difficult, though not impossible, for someone without some level training to reach the level of competence required for a functional safety engineer to competently engineer safety-related projects and/or to support plant functional safety activities. Functional safety is not rocket science, but our plants are becoming increasingly more complex, other standards are picking up the SIS philosophy, and there can be a lot of subtleties and twist and turns in applying the standards and achieving an acceptable level of functional safety. The standards are becoming more complex and understanding the technical basis of the standards and functional safety is necessary to properly apply functional safety to achieve the requisite safety for our plants and people in the process industry.

The standard IEC 61511 requires that people who are involved in SIS safety lifecycle activities be competent to carry out the activities for which they are accountable, and provides guidelines for determining competency. One of the key indicators of competency besides experience is training. This article discusses some of the training options available to develop skills in SIS engineering, and to help engineers become competent in this area to meet the requirements of IEC 61511.

Course quality can’t be assumed

The object of this article is to examine a wide range of training activities available to help an engineer enter this field, and to enhance the knowledge and skills of those already in the field. Here, the term SIS engineers refers to people who apply engineering skills and knowledge in implementation of the complete SIS safety lifecycle and related functional safety systems, and the term SIS training refers to training in the areas of SIS, functional safety and related cybersecurity.

SIS training can come from many sources. In recent years, many commercial companies have developed SIS-related training as a profit center. While many of the educational opportunities are in a paid format, there are, surprisingly, a lot of free training opportunities if you look around a bit. A primary difference is that paid training typically leads to an official certificate of completion, and may contribute to an industry-recognized certification in functional safety when combined with experience, other requirements, and passing a test. These certificates and certifications make a good addition to one’s resume, but may not provide all the education you really need to be fully competent or to be a true expert in the area, even of the certification says so. Being competent in this field and retaining the competency requires continuing education.

Of course, all training is not equal and one should select a training supplier that can provide the desired training and that you consider reputable. I make no recommendations regarding any of the training discussed in this article—I’ve heard war stories over the years regarding the poor quality of training from various sources, and have even attended a few of these. While the source of the training is a good indication of the expected training quality, the complaints most commonly revolve around the instructors, so always look at the qualifications of the instructors when comparing courses—don’t assume that because they give the course that they are an expert in the area. Your chances improve if the instructor is a well-recognized expert in this area.

There are far too many educational suppliers of SIS training and courses for all to be mentioned in this short article, but a good cross section is provided of well recognized companies and educational sources. The fact that a company’s training is not mentioned does not reflect on that company’s ability to provide SIS training or the quality of that training.

When choosing a training source, it’s always a good practice to talk to some of your colleagues or friends who have attended the course to see what they say about it. Always do a little research, and you will be less likely to be disappointed in the training.

Formal SIS training courses come in general two formats: in the classroom, and online. These are typically provided by professional societies and by commercial companies, and along with a certificate of completion, also typically provide continuing education credits (CEUs). Other options include university courses and self-study.

Classroom training sets the standard

A number of organizations offer SIS training and cybersecurity in the classroom setting, typically with durations from half a day to five days. The classroom setting has a number of advantages such as person-to-person interaction with the instructor and your classmates, ability to sometimes see what others are doing in this area, and the potential to develop technical contacts. Some of the disadvantages are, the training can be intensive, giving you limited time to digest the information; you may have to travel, which adds to the time away from work; and the costs of the course plus the time away from work. Many of these courses are offered at sites in the United States and around the world, and can be delivered at your company’s site if you have enough students.

These courses are provided by non-profit organizations such as ISA and the Mary Kay O’Conner Safety Center, and by for-profit companies such as exida, Kenexis, aeSolutions, Primatech, and Risknowlogy, to mention a few. Many of the ISA SIS courses are also available through commercial companies.

If you meet the requisite experience and other requirements, some of these courses can result in an industry-recognized certification via a test. A typical advantage of that type of course can be training will tend to be tied to the test, making it easier to pass the test, and there is an expectation that the pass rate will be high.

ISA is an excellent provider of SIS training and has a number of classroom courses in SIS and functional safety. ISA has arranged its functional safety training around three SIS certifications levels: SIS Fundamentals Specialist, SIL Selection Specialist and SIL Verification Specialist. Completing them all allows certification as an ISA/IEC 61511 Expert. Each certification level typically has required prerequisites, ISA course and test. ISA also offers classroom training and certification in the area of ICS cybersecurity, with four levels of certification.

Another well-known training provider, exida, provides a wide range of classroom SIS, alarm management and cybersecurity training that can help prepare you for the Certified Functional Safety Professional (CFSP)/Certified Functional Safety Expert (CFSE) exams and certification if you have the requisite experience level and meet their other requirements. The exida training is not a perquisite for the CFSP/CFSE certifications.

Kenexis and aeSolutions also provide a wide range of classroom training on SIS, process safety management, alarm management and cybersecurity, as well as the ISA SIS training courses. Kenexis and exida also have training courses on fire & gas system engineering.

TUV Rheinland provides classroom SIS training through commercial company partners that can lead to a functional safety engineering certification once you complete the course, pass their test and meet other requirements. Some of the TUV training providers are TUV, Honeywell, Rockwell, ACM and SIS-TECH Solutions. TUV also provides classroom training in cybersecurity.

If you are looking for a certification, discuss with your employers which type they might prefer before you jump into it. While a certification is not necessary for a person to be considered competent in this area, the industry trend appears to be that engineers who work in this field are getting certified.

Online training may lower cost

Online training is somewhat less available than classroom training, but its availability is increasing. While it can reduce the overall cost (e.g. travel time and days away from work), the course costs are typically on the same order of magnitude as the equivalent classroom courses. The online student will typically do it on their own time, which can be a selling point to your company, and the total costs are typically somewhat less.

The courses may not have a live instructor, and you can take the course at your convenience (self-paced/on-demand). Or the course may have a live instructor and will occur at a scheduled time.

ISA also offers its first-level SIS certification course in an eight-week online format. All the cybersecurity certification classes are also offered online in a multiweek or an on-demand format. exida and Kenexis also provide online SIS and cybersecurity training.

As an aside, Udemy is a good source of inexpensive online courses (typically from $10-$20 USD) and has a wide variety of technical topics. There are many courses on instrumentation and electrical controls, computers, programming, artificial intelligence (AI), machine learning, complexity, electrical and chemical engineering, and cybersecurity. Udemy doesn’t currently have courses available specifically on SIS or functional safety, but they do have quite a few on OSHA and safety in general. Some of its available topics are potentially relevant to the future of SIS (e.g., machine learning, AI, etc.).

Universities are joining in

While there aren’t a lot of courses in process safety at the undergraduate level, universities offer some online courses and degrees at the master’s level. Texas A&M University offers a master’s degree in Safety Engineering through the Mary Kay O’Conner Safety Center that can be done the traditional way on campus or online through the Texas A&M distance learning program. The distance-learning program also offers master’s degrees in other engineering disciplines. The University of Aberdeen in the U.K. also offers a master’s in engineering in process safety.

There is also interest by some North American universities in offering SIS training certificate programs as part of their engineering continuing education program, so keep an eye out. In general, distance-learning from universities is becoming more prevalent so check around, as you may be able to find courses in safety engineering and process safety. You may also find instrument technology courses related to SIS at your local junior college.

Self-study opportunities abound

In general, formal training programs provide only part of the necessary education of a SIS engineer and self-study is needed to fill in the rest. Many times, the employer’s training budget is limited and unless there is a specific need, it can be difficult to get the employer to pay for training in this area. That leaves a number of free or inexpensive educational sources:

Webinars, mail lists, newsletters and blogs: Several companies offer free webinars on SIS and related topics. Exida provides a webinar weekly and Kenexis provides them periodically. You can typically sign up for notifications of these webinars at the suppliers’ websites. While webinars are commonly given live, they are many times available in recorded versions at the providing company’s site. Some trade magazines such as Control and Hydrocarbon Processing also offer free webinars on a wide variety of topics related to the process industry and process safety, most of which are available in a recorded format.

ISA has a safety email list where you can see and participate in discussions on SIS. The ISA email list can be found here, along with a lot of other useful information. There is also an interesting System Safety email list in Europe that discusses a broader range of functional safety topics.

An interesting newsletter that can help you keep up with safety incidents, breaking news related to safety and cybersecurity happenings is “The Shield” from ISS Source. Most suppliers of SIS services offer newsletters and blogs on SIS and functional safety. Some interesting and informative blogs can be found at the SIS Engineer website and eFunctionalSafety.

YouTube: While many people poke fun at YouTube videos, there is a surprising number available on SIS, functional safety and instrumentation from manufacturers of SIS equipment, SIS consultants and SIS engineers. There is a good ISA introduction to SIS by Paul Gruhn and one from exida on the importance of the safety requirements specification (SRS) based on one of their webinars. These videos typically vary from a few minutes to an hour. Like all YouTube videos, you must consider the source of the information on a “caveat emptor” basis.

Papers: There is a tremendous amount of information about SIS on the Internet. It’s common for the suppliers of SIS services to publish white papers on SIS topics and to provide access at their websites to papers published at technical symposiums by their employees. ISA also provides limited access to safety papers published at its symposiums.

Collecting and reading these papers and attending symposiums where these types of papers are given can give an engineer wider perspective and access to technical information on SIS and functional safety.

A good website originating in Australia and providing a concentration of papers on SIS and functional safety topics is ICEweb. Another source of good papers is the 61508 Association, as is ISA.

Books: A number of good books on SIS are listed in Table 1. Many of the industry trade magazines have free article archives. Control magazine has many articles on SIS and cybersecurity in its archive.

As an ISA member, you can have access to collections of papers regarding safety and related topics, ISA standards, and the ISA TR84 technical reports on SIS topics. Unfortunately, since the main standard ISA/IEC 61511 is now an IEC standard, you can no longer access the main standard for free.

Join a standard committee

If you’re a member of ISA, you can join the S84 standards committee, and participate in the ISA SIS standard’s activities and in development of the SIS technical reports. If you join as informational member, you get all the committee documents, which you can review and comment on, attend meetings when you are able to, and generally be kept up to date on the ISA standard development in this area. Voting members have stricter requirements. Contact Charlie Robinson at ISA crobinson@ISA.org.

Developing expertise and/or becoming a functional safety engineer is not really a destination, but more of a journey of formal training, on-the-job training and experience. The need for training and expanding your knowledge in functional safety doesn’t go away once you have completed a class, or even if you are certified as an expert. The area of SIS and functional safety engineering is growing more complex with the evolving SIS standards (about every five years), new SIS technology development, and the continuing cyber threat environment. In recent years, SIS standards have started impacting other standards (e.g. API 2350, API 553, API 556, NFPA 85, ISA 18, ISA 99/IEC 62443, etc.). The concentration of the standard’s development (on SIS for the past 30 years) has also started to shift to other functional safety areas. This all leads to the need for functional safety practitioners to have a continuing education process to help ensure that they’re up to date and remain competent in process and functional safety, to help ensure our plants and people operate in a safe environment.

About the author:

William (Bill) L. Mostia, Jr., P.E., and ISA Fellow, WLM Engineering Co., can be reached at wlmostia@msn.com.