Once the Safety Instrumented System brings the system to a safe state, it should remain in that state until an operator manually intervenes.
This topic is explored in more detail with a discussion of clause 11.2.6 to 11.2.7 of the IEC 61511 standard.