Refinery SIS Upgrades: Who Really Specifies And Signs Off

For a refinery safety instrumented system upgrade, there is no single decision maker. The specification usually starts with operations and engineering, is shaped by instrumentation and functional safety specialists, validated by HSE and safety, and finally approved through capital projects, procurement and executive sponsors. Vendors that recognize this full buying chain win the work more often and keep projects moving.

Why refinery SIS upgrades are multi-decision-maker buys

Safety instrumented systems cut across units, disciplines and corporate functions. They touch crude and conversion units, tank farms, utilities and flare systems, and they sit at the intersection of process safety, control systems and capital spending. Treating an SIS upgrade as just a controls purchase misses the internal politics and risk posture that actually drive approvals.

ExecGraph tracking across 19 Gulf Coast refining facilities operated by 10 companies including Valero, Shell, Marathon Petroleum, LyondellBasell, ExxonMobil, Phillips 66, Motiva Enterprises, PEMEX, Citgo and PBF Energy shows SIS decisions span a wide range of functions. Across these operators there are 12104 named contacts distributed across Operations, Engineering, Instrumentation, HSE, Safety, Projects, Procurement and leadership roles, which is the real audience around any significant SIS scope change.

For vendors and project developers, that means two practical realities:

• No single champion is enough. Even a strong instrumentation sponsor will need operations, HSE and capital support to move a major SIS upgrade from concept to purchase order.
• Approval logic follows risk and capital, not hardware. The internal story that wins is about risk reduction, regulatory posture and lifecycle cost, not just the merits of a logic solver or field device.

Core refinery stakeholders that shape SIS upgrade specifications

Operations and process engineering define the problem

In refineries, SIS upgrade conversations usually begin around a process risk, not around a specific control platform. Operations and process engineering teams are closest to that risk, and they are often the first to recognize gaps between existing protection layers and current standards or internal tolerable risk criteria.

• Operations managers and console supervisors. They experience alarms, near misses and operating constraints that reveal when existing interlocks and trips are no longer acceptable.
• Process engineers. They connect incident learning and hazard analysis outcomes to specific safety instrumented functions, trigger reassessments of target risk reduction, and frame the needed changes in process terms.
• Unit leaders. Crude, FCC, delayed coker, reforming and hydroprocessing unit managers translate SIS gaps into production and availability risk, which is critical for capital prioritization.

On the Gulf Coast, large integrated sites highlight why unit leadership matters. For example, Motiva Port Arthur in Texas operates crude distillation, FCC, delayed coker, reformer, hydrotreating, alkylation, sulfur recovery and a hydrogen plant with crude distillation capacity of 640500 barrels per day. Similarly, Marathon Garyville in Louisiana combines crude distillation, FCC, delayed coker, reformer, hydrotreating, alkylation and sulfur recovery with crude distillation capacity of 606000 barrels per day. At this scale, SIS changes around high-hazard units have direct implications for throughput, so unit leaders have strong voices in scoping upgrades.

For vendors, that translates into a few practical tactics:

• Anchor early conversations in process risk. Talk in terms of specific scenarios on crude, FCC, coker and other critical units, not just generic SIS features.
• Equip process engineers with comparison tools. Provide clear documentation that links proposed SIS changes to hazard reduction, trip setpoints and operating envelopes.
• Frame benefits in availability as well as safety. Unit managers respond to arguments that reconcile safety performance with planned throughput and turnaround strategies.

Instrumentation, controls and functional safety engineering define the SIS scope

Across the 10 Gulf Coast operators in the ExecGraph dataset, there are 988 contacts aligned with Engineering functions and 108 aligned with Instrumentation roles. These teams typically own the detailed SIS design, selection and integration work once operations and process engineering have framed the problem.

• Instrumentation and controls engineers. They map process requirements into specific safety instrumented functions, choose sensors, logic solvers and final elements, and resolve integration issues with existing basic process control systems.
• Functional safety specialists. Where present, they lead or validate calculations, functional safety assessments and proof test strategies, and check alignment with corporate standards referencing international functional safety practices.
• Automation and digital engineering. In large complexes that combine refining with chemical units, automation teams ensure SIS architecture can scale across both sides of the fence and that the control room impact is manageable.

These groups are usually the most technically demanding stakeholders for SIS vendors. They will probe architectures, diagnostic coverage, proof testing approaches, cybersecurity hardening and lifecycle support terms.

• Expect deep design reviews. Internal engineering will typically require detailed cause and effect, architecture drawings and device lists early in the specification process.
• Support brownfield realities. Many Gulf Coast refineries combine legacy SIS and control platforms with newer systems, so an upgrade proposal that assumes a clean slate will struggle to pass engineering review.
• Be explicit on lifecycle responsibilities. Clarify who owns programming, FAT, commissioning, proof testing and periodic functional safety verification in your proposals.

Maintenance, reliability and turnaround teams frame implementation risk

In the same 10-operator data set, there are 514 contacts in Maintenance roles and 99 in Manufacturing and Reliability roles. These groups influence how and when an SIS upgrade can actually be executed, and they often provide a reality check on ambitious scope.

• Maintenance supervisors and planners. They assess field device accessibility, wiring route constraints and testability, and they bring historical failure data into the conversation.
• Reliability engineers. They scrutinize the impact of new SIS elements on reliability, spare parts strategy and maintainability over time.
• Turnaround and outage planners. They determine whether SIS work can fit within existing turnaround windows or requires a separate outage, which affects both risk and capital timing.

Vendors that surface installation, commissioning and testing implications early tend to gain credibility with these teams and avoid later objections that can stall approvals.

Who actually approves refinery SIS upgrades

HSE and safety leadership validate risk reduction

Across the 10 operators, there are 189 contacts tagged to HSE and 64 aligned to Safety functions. These leaders do not usually write the SIS specification, but they do validate whether a proposed upgrade delivers acceptable risk reduction and regulatory posture.

• Corporate and site HSE leaders. They look for alignment with internal process safety objectives, recent incident learnings and corporate risk criteria.
• Process safety engineers. They compare proposed SIS changes to hazard analysis recommendations, layer of protection analysis outcomes and corporate practices.
• Compliance and audit teams. They evaluate whether the SIS upgrade addresses specific regulatory findings or external audit observations.

In practical terms, HSE and safety leaders tend to ask three questions of any SIS upgrade:

• Does this materially reduce credible high-consequence events? They prioritize upgrades that clearly cut the likelihood or consequences of major process safety scenarios.
• Does it address explicit recommendations or gaps? Proposals that close out documented action items have a clearer path to approval.
• Is the ongoing testing and competency model realistic? Programs that require overly complex proof testing or highly specialized skills can be seen as fragile.

Capital projects, procurement and executive sponsors provide final sign-off

From the Gulf Coast data, there are 97 contacts in Projects and Construction roles, 90 in Procurement and 251 in Executive Leadership. These functions handle the formal approval steps that convert a scoped SIS upgrade into an approved, funded project with purchase orders issued.

• Capital projects and turnaround managers. They package SIS upgrades into stand-alone projects or fold them into major turnarounds, secure capital allocation, and coordinate competing priorities across units.
• Procurement specialists. They manage sourcing strategies, vendor qualification, bid evaluation, frame agreements and negotiation of commercial terms.
• Executive sponsors and business unit leaders. They approve larger capital envelopes, balance SIS spend against other investments, and arbitrate when operational, safety and financial priorities conflict.

For SIS vendors, success at this stage depends less on detailed device capabilities and more on how well the solution plugs into the refinery's capital and sourcing logic.

• Provide clear total cost of ownership views. Capital approvers respond to lifecycle cost, including hardware, engineering, testing, training and obsolescence management.
• Offer contracting flexibility. Refiners value options that accommodate frame agreements, master service agreements or alliance structures.
• Support cross-site standardization. Multi-site operators are more likely to approve SIS upgrades that enable common platforms and practices across refineries and integrated chemical plants.

Mapping the SIS buying chain at Gulf Coast refineries

The Gulf Coast refining corridor illustrates how complex SIS decision chains become at large integrated sites. Facilities such as the ExxonMobil Baytown Complex and ExxonMobil Baton Rouge Complex combine refining units like crude distillation, FCC, delayed coker, reformers, hydrotreaters, alkylation and sulfur recovery with chemical units including ethylene crackers, polyethylene and polypropylene production. Similarly, Valero, Shell, Marathon Petroleum, LyondellBasell, Phillips 66, Motiva Enterprises, PEMEX, Citgo and PBF Energy operate refineries across Texas and Louisiana that integrate multiple high-hazard units.

Several of these sites are among the largest crude processors on the Gulf Coast, including sites such as Marathon Galveston Bay in Texas City with crude distillation capacity of 631000 barrels per day, the ExxonMobil Beaumont Complex with crude distillation capacity of 612000 barrels per day and the CITGO Lake Charles Refinery with crude distillation capacity of 459800 barrels per day. When SIS changes affect units at this scale, internal approval chains naturally extend across operations, engineering, HSE, projects, finance and executive teams.

ExecGraph's view across 12104 contacts at these 10 operators illustrates just how distributed SIS influence is. Operations alone accounts for 4228 contacts, Engineering 988, Maintenance 514, HSE 189, Safety 64, Projects and Construction 97, Procurement 90 and Executive Leadership 251, with additional roles in Supply Chain, Manufacturing and Reliability and other support functions. In practice, SIS vendors encounter only a subset at any one facility, but this spread explains why approvals often feel slower and more complex than the technical scope suggests.

For commercial teams, the implication is clear: SIS upgrades are classic buying-center decisions. The technical specification may live in instrumentation or engineering, but the approval risk usually sits with HSE, projects, procurement and executives.

How vendors can align proposals with the SIS approval workflow

Knowing who specifies and approves refinery SIS upgrades is only useful if you adapt your pursuit to that reality. Successful vendors design their approach around the functional safety lifecycle and the refinery's internal governance, not just around device catalogues.

• Build multi-role account maps. Identify operations, process engineering, instrumentation, HSE, projects, procurement and executive sponsors around each opportunity rather than relying on a single technical contact.
• Sequence conversations to follow internal workflow. Start with process risk and unit impacts, then move into SIS architecture, implementation planning and finally capital and sourcing terms.
• Tailor content to each decision maker. Operations wants scenario clarity, engineering wants technical depth, HSE wants risk reduction evidence and procurement wants commercial comparability.
• Align with turnaround and capital timing. Many SIS upgrades gain approval only when they fit into an existing turnaround or capital planning cycle.

ExecGraph buyers often use facility-level insight to anticipate these needs. For example, knowing that a target refinery operates a delayed coker and FCC alongside crude and hydrotreating, and that it is part of a larger integrated complex, helps vendors anticipate where SIS upgrade discussions will surface and which leaders are likely to drive them.

Practical checklist before you push a refinery SIS upgrade

Before investing heavily in a refinery SIS pursuit, commercial teams can pressure-test their position against a few concrete questions that mirror the internal approval chain.

1. Have we tied our proposal to specific unit risks? Confirm that operations and process engineering see the SIS upgrade as a solution to clearly articulated scenarios on named units, not as a generic technology refresh.
2. Has internal engineering validated our technical fit? Ensure instrumentation, controls and functional safety engineers have engaged on architecture, integration, proof testing and lifecycle assumptions.
3. Did HSE and safety leaders see the risk story? Share concise materials that translate technical changes into risk reduction and alignment with their process safety priorities.
4. Is maintenance comfortable with execution and testing? Address access, installation, sparing and proof test logistics upfront to avoid late objections.
5. Do we understand the capital and sourcing path? Map whether SIS scope will move through a capital project, turnaround program or smaller sustaining budget, and align your commercial structure accordingly.
6. Is there an executive-level sponsor? For larger SIS envelopes, confirm which executive or business unit leader will ultimately sign off and what competing investments they are weighing.

When your answers to these questions are specific and grounded in the reality of the target facility, you are far more likely to navigate the full specification and approval chain successfully.

Key takeaways for SIS upgrade pursuits

Refinery SIS upgrades live at the intersection of process safety, control systems and capital governance. Operations and process engineering define the problem, instrumentation and engineering shape the technical solution, HSE and safety validate risk reduction, and projects, procurement and executives make the final capital and sourcing decisions. Vendors that recognize and serve that entire chain, rather than selling only to a single discipline, are better positioned to win complex SIS work across Gulf Coast refineries and similar assets.