ArchitectureChemicals

Connecting an AI optimizer to your DCS while keeping the safety instrumented system independent

An AI optimizer earns a place in a chemical plant only if it fits the control hierarchy that already exists. It should advise operators or set targets above advanced process control, stay outside the safety instrumented system, cross the OT network through defined conduits and pass the same change control as any other modification. Below is a layered reference architecture, three integration modes and the evidence needed to move between them.

Reviewed 7 min read

On this page
  1. Where an optimizer fits in a chemical plant's control hierarchy
  2. Reference architecture: optimizer above APC, safety system apart
  3. Advisory, operator-confirmed and closed-loop supervisory modes
  4. Keep the optimizer out of the safety instrumented system
  5. Network path through Purdue levels, the DMZ and IEC 62443 conduits
  6. How a bounded target reaches the controller
  7. Constraint handling and fallback when the model is unsure
  8. Change control duties when a model is introduced or retrained
  9. Energy optimization on a distillation column train
  10. Matching the level of autonomy to the unit
  11. Questions and answers
  12. Sources

Where an optimizer fits in a chemical plant's control hierarchy

A chemical plant already has layers of control. The DCS runs regulatory loops that hold flows, temperatures, pressures and levels at setpoint. Advanced process control, usually model predictive control, moves those setpoints together to run units closer to their constraints, and some sites add real-time optimization that recalculates economic targets from a steady-state model. Apart from all of this, the safety instrumented system has its own sensors, logic solver and final elements, and acts only on demand.

An AI optimizer is best treated as a new kind of optimization layer: it proposes targets for APC, or recommendations for operators, and nothing else. The NAMUR Open Architecture concept describes a similar second channel for monitoring and optimization beside the core automation. ColdAI's chemical work treats this boundary as a design input from the first plant and process audit onward6.

Reference architecture: optimizer above APC, safety system apart

Enterprise and planning01Site DMZ02Optimizer and historian03APC / MPC04DCS regulatory control05Safety instrumented system06
  1. Enterprise and planning

    Production plans and energy prices that set the economic objective; no path to control.

  2. Site DMZ

    Replicated historian data for analytics; remote and cloud access ends here.

  3. Optimizer and historian

    An on-site host that computes targets, logs every proposal and enforces limits.

  4. APC / MPC

    Receives bounded targets and keeps its own constraint handling as the fallback.

  5. DCS regulatory control

    PID loops and the operator HMI; any loop can be taken to manual.

  6. Safety instrumented system

    Independent sensors, logic and final elements; read-only data out, nothing written in.

Conceptual layering for one plant, top to bottom. The safety instrumented system is drawn last because it sits apart from the control layers, not beneath them.

Advisory, operator-confirmed and closed-loop supervisory modes

CriterionAdvisoryOperator-confirmedClosed-loop supervisory
What the optimizer writesNothing; recommendations on a displayA proposed target the operator accepts or rejectsBounded targets to APC on a fixed cycle
Who actsThe operator, by handThe operator, with one actionThe optimizer, with operator override at any time
PrerequisitesClean historian data and an agreed objectiveA guarded write path and an approved changeStable APC, validated analyzers, tested watchdog and fallback
Main riskAdvice ignored or misreadOperators accept without checkingInteraction with APC and unseen extrapolation
How to switch it offClose the displayDisable the write pathWatchdog reverts to standing APC targets
Evidence to move upAdvice tracked against operator actions and outcomesRejections explained and no limit excursionsHighest mode; extend to the next unit on the same evidence

Moving between modes is a management-of-change decision, not a configuration toggle.

Keep the optimizer out of the safety instrumented system

Network path through Purdue levels, the DMZ and IEC 62443 conduits

Advisory analytics can run off-site on data replicated to the DMZ, ideally through a one-way data diode so nothing travels back toward control. Anything that writes targets should run on an on-site host, reach APC through one defined conduit with an allow-list of tags and value ranges, and keep working if the internet link drops. IEC 62443 supplies the vocabulary: group assets into zones by risk, define each conduit between them and set a target security level per zone2.

How a bounded target reaches the controller

Proposed targetsChecked proposalAccept or rejectBounded target writeSetpoint movesHeartbeat and statusRevert on lost signal01Optimizer02Limit guard03Operator HMI04APC controller05DCS loops
  1. Optimizer

    Computes targets from current data and the economic objective.

  2. Limit guard

    Checks hard limits, rate of change, data validity and model confidence.

  3. Operator HMI

    Shows the proposal, its reasons and an accept or reject choice.

  4. APC controller

    Applies the target within its own constraints.

  5. DCS loops

    Regulatory control that moves the valves.

  1. Optimizer to Limit guardProposed targets
  2. Limit guard to Operator HMIChecked proposal
  3. Operator HMI to Limit guardAccept or reject
  4. Limit guard to APC controllerBounded target write
  5. APC controller to DCS loopsSetpoint moves
  6. APC controller to Limit guardHeartbeat and status
  7. Limit guard to APC controllerRevert on lost signal
Conceptual message order in operator-confirmed mode. In closed-loop mode the operator step becomes a standing override, while the guard and heartbeat stay.

Constraint handling and fallback when the model is unsure

The model extrapolates

Early signalInputs outside the training range, such as a new feedstock or aged catalyst.

MitigationCheck inputs against the training envelope and fall back to standing APC targets when it is exceeded.

An analyzer fails quietly

Early signalFrozen, flat-lined or out-of-range quality readings.

MitigationValidate inputs every cycle and suspend optimization of the variables a bad analyzer informs.

Optimizer and APC fight

Early signalOscillating targets, or APC repeatedly hitting move limits.

MitigationApply rate-of-change limits, cycle slower than APC and tune during the advisory stage.

Recommendations add alarm load

Early signalOperators acknowledge optimizer messages as nuisances.

MitigationShow advice outside the alarm system; any new alarm goes through ISA-18.2 rationalization3.

Change control duties when a model is introduced or retrained

OSHA Process Safety Management, 29 CFR 1910.119[^4]

United States

Applies whenA process involves listed highly hazardous chemicals, or flammable liquids or gases, above threshold quantities4.

  • Follow written management-of-change procedures that address the technical basis and safety impact before any change other than replacement in kind4.
  • Update hazard analysis, procedures and training where affected, with a pre-startup safety review when process safety information changes4.

Seveso III Directive 2012/18/EU[^5]

European Union, through national law

Applies whenAn establishment holds dangerous substances at or above the lower-tier or upper-tier thresholds5.

  • Run a safety management system that includes procedures for planning modifications to installations and processes5.
  • Upper-tier operators review and, where needed, update the safety report after a modification that could significantly affect major-accident hazards5.

IEC 61511-1, functional safety of safety instrumented systems[^1]

International standard, widely recognized as good practice

Applies whenA change could affect a safety instrumented function or the assumptions behind its integrity assessment1.

  • Analyze the safety impact before the change and follow the SIS modification procedure1.

Energy optimization on a distillation column train

Matching the level of autonomy to the unit

  • If

    A continuous unit with well-tuned APC, reliable analyzers and stable feed.

    Then

    Plan for bounded closed-loop supervisory control after an operator-confirmed period.

    APC already handles constraints, so the optimizer only shifts targets within a proven envelope.

  • If

    Weak base-layer tuning or no APC.

    Then

    Fix loops and deploy APC first, running the AI in advisory mode meanwhile.

    No optimizer compensates for valves in manual and oscillating loops.

  • If

    An exothermic reactor with runaway potential.

    Then

    Advisory or operator-confirmed only, within limits agreed in the hazard review.

    A wrong target there has consequences beyond cost.

  • If

    A batch or multi-product plant.

    Then

    Recommendations at phase boundaries, confirmed against the approved recipe.

    Recipes and their approvals govern what may change within a batch.

  • If

    Utilities such as steam, cooling water and compressed air.

    Then

    Often the first closed-loop candidates.

    Failures are mostly economic and the physics is well understood.

Questions and answers

Does an AI optimizer need its own SIL rating?

Not if it performs no safety function and is never credited as a protection layer. The hazard review should still confirm independence: the optimizer shares no logic solver or final elements with the SIS, and the effect of a wrong target is covered by existing alarms and trips. A functional safety engineer should record that conclusion.

Can the optimizer run in the cloud?

For advisory work, yes, using data replicated to the DMZ. For writing targets, an on-site host is the safer design: a cloud dependency adds latency, a failure mode when connectivity drops and a path toward the control network that each IEC 62443 conduit would need to justify2. Training in the cloud and running inference on site is a common split.

How is a machine learning optimizer different from traditional real-time optimization?

Traditional RTO fits a first-principles steady-state model to the plant and solves it for economic targets. A machine learning optimizer learns behavior from data, which helps where no good first-principles model exists, but extrapolates poorly. Hybrid designs keep physical structure and learn the corrections, an approach close to the digital twin work many sites already run.

Do refineries and petrochemical sites follow the same pattern?

Yes. The hierarchy, the separation from the SIS and the change-control duties are the same; refineries often have more APC in place, which makes supervisory modes reachable sooner. Sector-specific topics such as pipeline integrity and flow metering are covered on our oil and gas page.

Sources

  1. IEC 61511-1:2016+AMD1:2017 Functional safety: safety instrumented systems for the process industry sector, Part 1 — International Electrotechnical Commission · checked 10 October 2026
  2. ISA/IEC 62443 Series of Standards — International Society of Automation · checked 10 October 2026
  3. ISA-18 Series of Standards (ANSI/ISA-18.2, Management of Alarm Systems for the Process Industries) — International Society of Automation · checked 10 October 2026
  4. 29 CFR 1910.119 Process safety management of highly hazardous chemicals — US Occupational Safety and Health Administration · checked 10 October 2026
  5. Directive 2012/18/EU on the control of major-accident hazards involving dangerous substances (Seveso III) — EUR-Lex · checked 10 October 2026
  6. AI for chemical manufacturing: delivery process and safety-first design — ColdAI

More in Chemicals

Back to Chemicals

Next step

Review one unit's control architecture before adding an optimizer

Share a description of one unit, its APC scope and its historian tags. We will propose an integration mode, the guard limits it needs and the evidence to collect before moving to the next mode.

Book an architecture review