ICSS (Integrated Control and Safety System) is the oil and gas term for the complete automation system of a platform, terminal or plant: the process control system (PCS/BPCS), the safety instrumented system (SIS, including emergency shutdown, ESD), the fire and gas system (F&G), plus shared operator stations and historian. NIST SP 800-82r3 (section 2.3.7) describes an ICSS as a safety system that can communicate with the control system — either an all-in-one device from one vendor or a combination of products from several vendors — while the safety part must still meet IEC 61511. In short: shared interface and data, separate safety functions.
The subsystems of an ICSS
| Subsystem | Job | When it acts | Main components |
|---|---|---|---|
| PCS / BPCS | Process control: PID loops, start-up/shutdown sequences, operating interlocks | Continuously | Process controllers, I/O, control network |
| SIS — ESD, PSD | Brings the process to a safe state when it crosses defined limits | On demand (when the process crosses a limit) | Each safety instrumented function (SIF) is sensors, a logic solver and final elements such as valves |
| F&G | Detects fire and gas leaks, raises alarms and triggers protective action | When fire or gas is detected | Detectors, F&G controller, alarm and suppression outputs |
| Operator and engineering stations | Operator interface; configuration, programming, diagnostics | Continuously | Servers, clients, console screens |
| Historian, SOE | Stores process data and time-stamped sequence of events for post-incident analysis | Continuously | Historian server, OPC server |
NIST lists emergency shutdown (ESD), process safety shutdown (PSS) and fire and gas systems (FGS) as types of safety system, with the SIS the best known (section 2.3.7). The exact names (ESD, PSD, F&G, HIPPS) and which functions belong to the SIS are set for each project by its safety analysis.
Why BPCS and SIS are kept independent
- So that one failure cannot defeat two layers of protection. According to NIST, the SIS is usually independent of the BPCS so that a control system failure does not seriously affect the safety functions. Traditionally the SIS stood fully alone, physically and logically separated, with no direct link to the BPCS.
- Because the standard has its own requirements for the SIS. IEC 61511-1 sets requirements for SIS in the process industry across the whole lifecycle — specification, design, installation, operation and maintenance — and is the process-sector implementation of IEC 61508. In the US, ANSI/ISA-61511-1-2018, part of the ISA-84 series, is the counterpart of IEC 61511-1. An ICSS brings data together, but it does not exempt the safety part from these requirements.
- What this usually means in a design: a separate safety controller; a safety network separated from the control and information networks (Rockwell's ICSS architecture drawing in PROCES-BR003A, p. 10, puts them on different switches); data mostly flowing one way, from SIS to BPCS, for display; and any write into the SIS (reset, bypass) restricted and managed by procedure. The exact degree of separation is decided by the project's safety analysis.
SIL levels and safety values must be determined by a competent engineer per IEC 61511 for each project.
ICSS architecture on Rockwell
| Layer | Rockwell product | Per vendor documents |
|---|---|---|
| Process control | ControlLogix process controllers (1756-L8xEP) in PlantPAx | Default tasking model and PlantPAx process instructions; controller redundancy over EtherNet/IP with the 1756-RM3 module (PROCES-SG001X, pp. 37–39) |
| Safety — distributed, scalable | AADvance | Architectures from fail-safe to fault tolerant and TMR, with different levels of module redundancy for different plant areas; configured with AADvance Workbench; CIP connectivity to PlantPAx |
| Safety — TMR | Trusted | Three control slices with majority voting that identify the source of a fault; up to 40 channels per I/O module; partial stroke testing of valves |
| Operator interface | FactoryTalk View SE in PlantPAx | PASS servers (displays, alarms, data connections) and operator workstations (OWS) licensed per workstation (PROCES-SG001X, pp. 5–7, 21–28) |
| Historian | FactoryTalk Historian | 1756-HIST2G module for under 2,500 tags; above that, FactoryTalk Historian SE on an information management server (PROCES-SG001X, p. 31) |
| Network | EtherNet/IP | PlantPAx reference architectures with redundant PRP and resilient DLR rings (PROCES-SG001X, pp. 16–17) |
Rockwell lists AADvance and Trusted in its safety instrumented systems portfolio, together with Logix SIS and a safety-configured ControlLogix. On applications, Rockwell's process safety brochure (PROCES-BR003A, p. 4) lists emergency shutdown, fire and gas, HIPPS and burner management among typical AADvance applications. The Trusted product profile (PROCES-PP014B) lists ESD, F&G, turbomachinery control, burner management and HIPPS. The certifications the vendor states (TÜV to IEC 61508, plus EN 54-2 and NFPA 72, which relate to fire alarm equipment) are on the product pages; a logic solver's certificate does not replace determining the SIL of each safety function.
Integration points between the SIS and the main control system
| Link | Protocol per vendor documents | Used for |
|---|---|---|
| AADvance → ControlLogix / PlantPAx | CIP Produce & Consume over EtherNet/IP (AADvance-Trusted SIS Workstation 2.01 help, "Use CIP over EtherNet/IP") | SIF status, alarms, bypass status on operator screens |
| AADvance → other vendors' DCS/PLC | Modbus TCP slave, port 502 (SIS Workstation 2.01 help, "Network Firewall") | As above, when the main system is not Logix |
| Trusted → main system | Modbus TCP/IP, Modbus RTU, EtherNet/IP (PROCES-PP014B); up to 10 Modbus slaves on the T8151 module, with an SOE over Modbus service (AADvance-Trusted SIS Workstation help) | Status data, sequence of events |
| SIS → HMI, historian | OPC DA and OPC A&E (PD-T8030 Trusted OPC Server; for AADvance: OPC Portal Server, ICSTT-RM407E) | Tags, alarms and time-stamped SOE events |
| SIS ↔ SIS | Peer-to-peer safety network (SIS Workstation 2.01 help, "Network Firewall") | Safety signals between safety controllers |
| Time sync | SNTP (SIS Workstation 2.01 help, "Network Firewall") | Matching SOE time stamps across systems |
Rockwell also describes the safety system either standing alone and talking to major DCS and PLC vendors over serial Modbus, Modbus TCP/IP or EtherNet/IP, or integrated into PlantPAx as an ICSS (PROCES-BR003A, p. 10). When placing firewalls between network zones, see which ports a FactoryTalk system needs and our industrial networks and OT security service; for network redundancy: DLR vs PRP.
What an owner should specify
- Scope and boundaries: which systems are in the ICSS (PCS, ESD, PSD, F&G), which packages have their own PLCs (compressors, turbines, skids) and how they connect.
- Safety inputs: HAZOP results, SIL determination and the safety requirements specification (SRS) — who prepares and who approves them. The integrator works to the SRS and does not set SIL levels itself.
- Cause and effect matrices for ESD and F&G, numbered and revision-controlled.
- Required redundancy for each layer: controllers, I/O, power, network, servers.
- Interface list: for each link, protocol, data direction, tag list and update rate; required SOE resolution and a common time source.
- Operator interface: shared consoles or a separate F&G console; alarm philosophy to ISA-18.2 and style guide to ISA-101 — see the ISA-101 / ISA-18.2 article.
- Security and network zoning: safety, control and information networks; who may write what into the SIS.
- Testing and handover: FAT, SAT, documentation, training, spares, and a hardware lifecycle plan — see lifecycle review.
TDL integrates control and safety systems on Rockwell: ICSS and safety systems, oil and gas automation.
Frequently asked questions
How is an ICSS different from a DCS?
A DCS is a process control system. An ICSS is the DCS (or a PLC-based PCS) plus the SIS and F&G, with shared operator interface and historian. The safety functions in an ICSS are still kept separate and must meet IEC 61511.
Can one controller do both control and safety?
NIST notes that an ICSS can be an all-in-one device from a single vendor, but the safety part must still meet IEC 61511. Whether to combine or separate is decided by the project's safety analysis.
Is F&G part of the SIS?
It depends on the project. NIST lists fire and gas systems as a type of safety system alongside ESD; which F&G functions count as safety instrumented functions is decided by the safety analysis.
Does TDL determine SIL levels for a plant's system?
No. SIL levels and safety values must be determined by a competent engineer per IEC 61511 for each project. TDL designs and integrates to the safety requirements specification provided by the owner or its appointed party.
Which Rockwell products make up an ICSS?
Process control uses ControlLogix process controllers (1756-L8xEP) in PlantPAx, the operator interface is FactoryTalk View SE in PlantPAx, the historian is FactoryTalk Historian, and the network is EtherNet/IP with PRP and DLR reference architectures (PROCES-SG001X). The safety layer uses AADvance (distributed, scalable) or Trusted (TMR), both of which Rockwell lists in its safety instrumented systems portfolio.
Sources
- Rockwell Automation, PROCES-BR003A-EN-P, Process Safety Solutions, 11/2015 — p. 3, 4, 10
- Rockwell Automation, PROCES-SG001X-EN-P, PlantPAx Distributed Control System Selection Guide, System Release 5.50, 08/2026 — p. 5–7, 16–17, 21–31, 37–39
- Rockwell Automation, PROCES-PP014B-EN-E, Trusted Safety System Triple Modular Redundant Controller, 10/2016
- Rockwell Automation, PD-T8030, Trusted OPC Server Package (Issue 24), 06/2016
- Rockwell Automation, ICSTT-RM407E-EN-P, AADvance Controller OPC Portal User Manual, 04/2018
- Rockwell Automation, Safety Instrumented Systems (portfolio page)
- Rockwell Automation, AADvance Control System (product page)
- Rockwell Automation, Trusted fault tolerant SIS (product page)
- Rockwell Automation, AADvance-Trusted SIS Workstation 2.01 help, "Network Firewall"
- Rockwell Automation, AADvance-Trusted SIS Workstation 2.01 help, "Use CIP over EtherNet/IP"
- Rockwell Automation, AADvance-Trusted SIS Workstation 2.01 help, "Configure a Modbus Slave"
- NIST, SP 800-82r3, Guide to Operational Technology (OT) Security, 09/2023 — section 2.3.7 Safety Systems
- IEC, IEC 61511-1:2016, Functional safety — Safety instrumented systems for the process industry sector, Part 1 (IEC Webstore overview page)
- ISA, ISA-84 Series of Standards
- ISA, ANSI/ISA-18.2-2016
- ISA, ISA-101 Series
Read 25 October 2026. This article paraphrases the sources and does not quote them; read the original documents before designing or working on a system. Links open the latest edition in Rockwell's literature library; page numbers refer to the edition cited.