The seven stages of chemical engineering technology from concept to industrialization (Issue 50/100) -- Instrumentation and interlock design

Thread Content

This post was last edited by xiouxingzhe on 2026-6-23 09:12. Seven stages of chemical technology from concept to industrialization (Issue 50/100) —— Technology finalization: Instrumentation and interlock design. Link to the table of contents: Model of the seven stages of chemical technology from concept to industrialization (100 issues) – Table of contents (updated in real time). Dear friends: Hello everyone! In the previous issue, we discussed the grades of pipeline materials; each pipeline has its own material, wall thickness, and insulation scheme. This issue covers instrument and interlock design—one of the sections in the process package with the highest safety requirements and the most intensive interdisciplinary involvement. Instrumentation is the eyes of a device, while interlocks are its immune system. If the gauge is selected incorrectly, the operator cannot see the actual operating conditions ； The interlock design is flawed: it fails to activate when protection is needed, and it activates erroneously when protection is not required—both situations can lead to serious consequences. This issue focuses on three topics: how to assign instrument tags, how to fill out instrument data sheets, and why the interlock logic diagrams must be developed under the supervision of the process engineering team. I. Instrument tag numbering: The instrument tag is the unique identifier for each instrument within the entire plant. Clear, unified, and traceable tag numbering rules are essential to ensure that subsequent tasks such as index compilation for instrumentation, wiring diagram creation, DCS configuration, and on-site commissioning can be carried out in an orderly manner. There are mainly two approaches to compiling bit numbers. One method is to use the drawing number followed by a sequence number. The prefix of the instrument tag corresponds to the PID diagram number, allowing it to be easily determined which diagram the instrument is on, thus facilitating searching. This rule is simple and intuitive, suitable for small and medium-sized devices. Another is by process number, unit number, and sequence number. The tag number contains information about the process unit, allowing it to be immediately determined to which process and which unit this gauge belongs. The advantage of this rule is that once one is familiar with the unit division of the device, it is quick to find the tag number of any instrument. In projects with well-defined unit structures, the instrument tag numbers inherently reflect the logical flow of the process operations, which is useful for both commissioning and troubleshooting. Regardless of the numbering rule used, there is only one core requirement: the tag number must be unique and identifiable. The same tag number must never appear on two tables. After the numbering is completed, a complete instrument index table should be established to facilitate reference by various specialties. Backup instruments are distinguished by the suffixes A, B, and C – for example, if two temperature transmitters are installed at the same location to serve as backups for each other, they are designated as TE-1001A and TE-1001B. After the numbering rules are established, there is a step that is easily overlooked: the correspondence with PID. For each instrument labeled with a PID, there should be a corresponding entry in the instrument index table. There is a one-to-one mapping relationship between PIDs and the index table; it is not allowed for a PID to exist without a corresponding entry in the index table, or for an entry to exist in the index table without a corresponding PID. This disconnect directly results in the instrumentation team being unable to accurately count the number of I/O points. II. Preparation of instrument data sheets: Once the tag numbers have been assigned, the next step is to prepare an instrument data sheet for each measurement and control point. The process parameters listed in the data sheet must and can only be obtained from the PFD – operating temperature, operating pressure, flow rate, composition of the medium, density, viscosity; all these values come from the information on material flows and equipment operating conditions provided in the PFD. The instrument data sheet shall include at least the following information: tag number, purpose, pipeline number or equipment tag number where it is located, name and properties of the medium, operating conditions, design conditions, range, accuracy requirements, type of output signal, explosion protection rating, protection class, installation method, and material requirements. The determination of the range needs to take the operation window into account. The normal operating value should generally be between 30% and 70% of the instrument’s range – too low results in insufficient measurement accuracy, while too high eliminates the overload protection capability. For example, if the operating pressure is 1.0 MPa, it might be appropriate to select a range of 2.5 MPa for the pressure transmitter. For instruments with alarms and interlocks, the range must also cover the alarm values and interlock trigger values. The properties of the medium directly affect instrument selection. High viscosity, solid particles, strong corrosion, and tendency to crystallize – these properties have a completely different impact on the suitability of different types of instruments. Mass flow meters are sensitive to gas presence, vortex flow meters are sensitive to vibrations, orifice plates are prone to wear, and electromagnetic flow meters require the medium to be conductive. If the medium properties impose special requirements on instrument selection, they must be clearly specified in the data sheet. Another error-prone aspect in preparing instrument data sheets is the distinction between local instruments and remote instruments. Local instruments are only for on-site reading and do not participate in the control circuit; they are marked as “local” on the data sheet. Remote instrument signals are sent to the DCS or SIS for remote monitoring and automatic control. The two need to be distinguished and labeled in PID, as well as clearly indicated in the data table. In some cases, both are required – for example, for the liquid level at the bottom of a tower: an on-site glass level gauge is installed for inspectors to check the level, while a remote transmitted level transmitter is used to feed data into the DCS for control purposes. The data sheets for these two instruments are prepared separately. III. Interlock logic diagram: Why the process engineering team must take the lead. This is a very important task during the process package development phase. For SIS interlock circuits, the process engineer must draw an interlock logic diagram that clearly shows what the triggering conditions are – which sensors are used for detection and what the trigger values are ； What is the logical relationship—AND gate or OR gate, is delay confirmation required, is there any voting logic? ； What are the actions to be taken—which valves to shut off, which vents to open, which backup equipment to activate ； What are the reset methods and conditions—manual reset or automatic reset, reset from the DCS operator station or is it necessary to press the reset button on-site? Why can’t the interlock logic diagrams be handed over to the instrumentation team? Because the essence of interlocking is not \"how to connect the instruments\", but rather \"how to protect the process\". Only process engineers know best which parameter deviations can cause what hazards, what actions need to be taken to bring the plant back to a safe state, and whether there is a sequence or mutual exclusivity among these actions. The responsibility of the instrumentation team is to convert the interlock logic diagrams into specific configuration and wiring plans for the SIS system, once those diagrams have been finalized. However, the correctness of the logical relationships themselves must be the responsibility of the process engineering team. This isn’t about taking jobs; it’s about everyone doing their own role. The process defines the logic for protection, and the instruments implement this logic. It’s important to distinguish between the two, so that it’s clear who is responsible in case of any problems. There are certain standards for drawing interlock logic diagrams. The ISA standard defines common logical symbols – an AND gate outputs a true value only when all input conditions are true; an OR gate outputs a true value whenever at least one input is true; and a NOT gate inverts the input value. An RS flip-flop is used to latch interlock actions – once triggered, the interlock action remains in effect even if the triggering conditions are no longer met, until the operator manually resets it after confirming safety. Timers come in two types: delay-on and delay-off, which are used to prevent accidental activation of interlocks due to transient fluctuations. Logic diagrams are conventionally laid out with causes on the left and effects on the right. On the left is the sensor signal, with the tag number and trigger value indicated. In the middle are the logical operations, indicating the type of logic gate and the delay setting. On the right are the actuators, labeled with their tag numbers and operating states—whether they are off or on, started or stopped. By reading a single diagram from left to right, the entire interlock chain of “detection → decision → execution” becomes clear. IV. Reset design of interlocks: How to reset the interlocks after they are triggered is an area where problems often arise in interlock design, and it is also a point that is frequently questioned during HAZOP reviews. There are two reset methods. Manual reset is the norm—most safety interlocks must be designed for manual reset. The operator can perform the reset operation only after confirming that the safety conditions are met on-site or in the control room. Automatic reset is a special case – it is permitted only when the cause of activation is clear, automatic reset does not introduce new safety risks, and there are other independent protection mechanisms in place as a backup. There are several principles for reset design. First, safety conditions must be confirmed before resetting—you cannot reset with your eyes closed. Second, manual reset should not be set to reset all interlocks with one button, but rather reset them circuit by circuit. Since the reset conditions for different interlock circuits vary—the over-temperature interlock requires the temperature to drop to a safe level, while the over-pressure interlock requires the pressure to decrease to a safe level; the confirmation requirements for both are also different. A one-button reset might inadvertently restore circuits that should not be restored. Third, the location where restoration is carried out is determined based on the risk level. High-risk interlocks require the operator to be on-site for verification before they can be reset – on-site verification means seeing with one’s own eyes that the safety conditions are met, rather than seeing a number on a screen. Low-risk interlocks can be reset at the DCS operation station in the control room. The details of the reset logic must be clearly indicated on the interlock logic diagram; it is not sufficient to simply write “manual reset”. Who performs the reset, where it is performed, and what are the prerequisites for the reset – all these need to be clearly indicated on the drawings. V. Differentiation between DCS and SIS: It is necessary to clearly distinguish between DCS and SIS in terms of PID. Their security levels, maintenance requirements, and operational permissions are completely different. DCS is a distributed control system that is responsible for process control during normal operation – temperature control, pressure control, flow control, level control, and sequence control. The sensors and actuators of DCS are responsible for ensuring the stable operation of the device under designed operating conditions. SIS is a safety instrumented system that provides safety interlock protection – it triggers an emergency shutdown or relief action when process parameters deviate from safe limits. The sensors and actuators of SIS are responsible for bringing the device back to a safe state in case of loss of control. Once the SIS interlock is triggered, it overrides all DCS control commands and carries out safety actions directly. The DCS cannot interfere with the operations of the SIS, nor can the triggering conditions of the SIS be suppressed due to a request from the DCS. This difference in priority must be reflected through markings on the PID. One of the most common and important requirements is that the sensors and actuators of SIS and DCS must remain independent. A single sensor or control valve cannot be shared. If the SIS and DCS share the same sensor, once that sensor fails, both control and interlock functions are lost, resulting in a complete breakdown of the protection system. This is a situation that is absolutely not allowed in protective layer analysis. When preparing the instrument data sheets and interlock logic diagrams, it is necessary to verify the independence of each SIS circuit one by one – whether the sensors are independent of the DCS, and whether the actuators are independent of the DCS’s control functions. VI. Consistency between the instrument data sheet and the interlock logic diagram. The instrument data sheet and the interlock logic diagram are not two separate documents; there is a close data relationship between them. The tag number and trigger value of each sensor on the interlock logic diagram must have corresponding records in the instrument data sheet, with the measurement range covering the interlock trigger values. The tag number and operating status of each actuator on the interlock logic diagram must be recorded in the instrument data sheet, with requirements regarding response time as well. The tag numbers of the reset button and the bypass switch must also be included in the instrument data sheet. This consistency check is an important task during the integration of the overall process package documentation. If it is only discovered during integration that the tag number of the interlock icon cannot be found in the data table, or that the range specified in the data table does not match the interlock trigger values, then it is necessary to go through each item carefully to ensure consistency between the diagrams and the data tables. Preview for the next issue: Issue 51 – Application of HAZOP analysis in the process package phase. The instrument data sheets and interlock logic diagrams have been completed. To determine whether this interlock system can indeed ensure the safety of the device, a systematic approach is required for testing. This is HAZOP analysis – Hazard and Operability Analysis. Many people think that HAZOP is an activity to be carried out only during the preliminary design or detailed design phases, with HAZOP being conducted only after the construction drawings have been completed. As a result, major safety hazards were identified, but the pipeline route had already been determined, the equipment layout had already been finalized, and the interlock scheme had already been decided—making any changes costly. My approach is to conduct the first round of HAZOP analysis at the process package stage. How to do it, what should be the focus, and how to integrate it with SIL grading. To be continued in the next issue.