High-value problem
Thread Content
In the past, when a system only had a DCS, there were high alarms and high-high interlocks. Later, it was requested to go on SIS, with a high cut-off. Is there a difference between these two high values?
This post was last edited by Clouds of flowing water shine on 2020-10-14 09:21. The attached image shows a case from the \"AQ/T 3054-2015 Guidelines for the Application of Layer of Protection Analysis (LOPA) Methods\". The original DCS system reported high values; the newly installed SIS system implemented high-high interlocking for the original LV and new RBV units. What is the relationship between these two high-high values?
If one simply separates the interlock functions from the original DCS, I don’t think this constitutes a SIS. A SIS needs to be independent; if all of its signal sources come from the DCS, then the value of the SIS isn’t reflected
They are two independent things with no direct relationship; in terms of process settings, the value for SIS HH is slightly higher than that for DCS HH
In a certain design document, SIS is set to HHH while DCS is set to HH. Assuming it is a level measurement, previously 75% of the DCS systems were set to trigger an high-level alarm at H, and 85% were set to activate a interlock at HH. Currently, 75% of the DCS systems are set to high-level alarms. Is it necessary to set up high-level alarms for both SIS and DCS as well? If so, what should the values be? Has there been a significant change in the range for level control and interlocks compared to before?
The SIS is independent, and its set value is slightly higher than that of the DCS. Exactly how much higher it is is determined through communication between the process team and the design firm; values such as 75 for H, 85 for HH, 90 for SIS, 89 or 92 are all possible, but it cannot be below 85. Otherwise, the DCS would still be adjusting while an alarm is detected, and the SIS would act first – alas, the process team will be upset. . . . It depends on the company’s management procedures. I used to have an account that gave me the authority to modify all the alarm settings in the DCS, allowing me to make changes as needed. It’s more complicated with the SIS; to change any interlock setting, the signatures of both the safety officer and the process manager are required
The previous HH interlock can be directly incorporated into the SIS; this value can then be displayed on the DCS as well. There is no need for three separate high-alarm signals
There is a difference, and it’s a significant one. Previously, it was the ESD system, which served for safety-related shutdowns; DCS was merely used for process control. The SIS system used today is designed for emergency shutdowns, so surely the interlock values and alarm values can’t be the same
I think the same way, but the emergency management department has a evaluation criterion according to which the shutdown of an SIS system is considered an accident, and companies do not want to end up on this blacklist. Unless it’s absolutely necessary, they prefer to use DCS to solve a problem. That’s when the HH and HHH problems arose.
The SIS system is a separate safety instrumented system that requires its own data loop, but it can share data sources with the DCS. As for the high setpoint, the values for the two systems can be the same, or the high setpoint of the SIS system can be slightly higher than that of the DCS; otherwise, the high setpoint of the DCS would be meaningless.
Is this the case everywhere or only in some places? Is it the local **management department? Will the regulatory authorities find out if a company fails to report? The intention was good, but it was misused in the end.