Discussion thread on control systems DCS ESD SIS

Introduction to the SIS system: To meet the requirements of safe production and handling of hazardous chemicals, in the design of such systems, in addition to the production control DCS system, a safety instrumented system – SIS – is also implemented. Its purpose is to ensure safe production and to take appropriate actions in advance when a hazard is likely to occur, thereby safeguarding production and production equipment and minimizing the risk of accidents. Many of the functions previously available in SIS systems are now implemented in DCS systems. In particular, in small or less hazardous low-pressure and low-temperature production systems, most of the functions related to emergency shutdown systems are integrated into the production control system, without a separate SIS system being installed. The main reason for this is to reduce costs while still ensuring safety, thereby minimizing investment. However, with the increasing occurrence of serious safety accidents in China’s industrial production in recent years, and based on the principle that safety comes first, the SIS system has become a separate safety control system independent of the production control system DCS.

The ESD emergency shutdown system, in accordance with the principles of safety and independence, operates independently of the DCS distributed control system, and its safety level is higher than that of the DCS. Under normal conditions, the ESD system remains in a static state and requires no human intervention. As a safety protection system, it operates above the production process control to monitor the safety of the devices in real time. Only in the event of an emergency in the production equipment is it not necessary to go through the DCS system; instead, the ESD directly sends out protection interlock signals to safeguard the on-site equipment and prevent the spread of danger from causing significant losses. According to relevant information, people’s judgment and actions in dangerous situations are often delayed and unreliable; when operators are faced with a life-threatening situation, they must react within 60 seconds, and the probability of making a wrong decision is as high as 99.9%. Therefore, it is highly necessary to install safety interlocks that are independent of the control system; this is an important principle for ensuring safe production. It moves when it should move and stays still when it shouldn’t – this is a notable feature of the ESD system. The scanning cycle of the CPU in an ESD control system is generally in the range of several dozen milliseconds; depending on the number of control points that need to be scanned, it is usually around 50 ms. As a result, the response time of ESD systems is extremely fast. The most popular ESD systems currently available in China are those produced by TRICONEX from the United States (distributed in China by China Automation Group – Kangjisen Automation).

Why is it necessary to have an ESD system set up separately? Of course, general safety interlock protection functions can also be implemented by a DCS. However, for larger-scale emergency shutdown systems, they should be installed separately from the DCS in accordance with the principle of safety and independence. There are several main reasons for this: (1) to reduce the probability of both control functions and safety functions failing simultaneously, so that a malfunction in the DCS does not compromise the safety protection system; (2) for large-scale installations or rotating mechanical equipment, the faster the response time of the emergency shutdown system, the better. This helps to protect the equipment and prevent accidents from escalating ； It also helps in distinguishing the records of accident causes. Since DCS processes a large amount of process monitoring information, its response speed is difficult to make fast ； (3) The DCS system is a process control system that is dynamic and requires frequent manual intervention, which may lead to human-induced errors ； ESD, on the other hand, is static and does not require human intervention; by setting it this way, human errors can be avoided.

DCS----Distributed Control System 1 What is DCS? DCS is the abbreviation for Distributed Control System; in China’s automation industry, it is also referred to as a distributed control system. 2DCS is the result of a high degree of integration of computer technology, control technology, and network technology. DCS typically uses several controllers (process stations) to control numerous control points in a production process; these controllers are connected via a network and can exchange data with each other. The operation is carried out via a computer control station, which is connected to the controller over a network to collect production data and transmit operational commands. Therefore, the main feature of DCS can be summarized in one sentence as: decentralized control with centralized management.

Interlock, vs. Trip, ESD & SIS – Li Da, 2018-5-9. There are two terms in automatic control in English, “interlock” and “trip”, which have similar meanings but also differences. These two English loanwords are both often translated as “interlock” in Chinese, which is confusing and somewhat problematic. In English, the term “interlock” originally referred to a type of relatively simple preventive protection device used to ensure that when a certain switch or valve is in a particular state, other related switches or valves must be in a corresponding specified state as well, in order to maintain system safety. Today, the meaning of “interlock” has expanded to refer to devices or system configurations used to prevent potential system hazards that may arise from human operational actions or certain actions carried out by the system control. That is, a device or mechanism that ensures that when Party A takes action, Party B must be in a certain specified state. The simplest analogy is the road barriers at grade crossings for roads and railways; when a train is passing, the barriers are lowered, traffic on the road comes to a stop, thereby ensuring traffic safety ； After the train passes, the barriers are opened and road traffic resumes to ensure traffic safety. In the industrial field, the English word “trip” originally meant “to initiate” or “to trigger.” In the field of automatic control, it refers to a type of automatic control device or mechanism that, when control parameters such as displacement, temperature, pressure, or flow rate reach certain pre-set limit values (thresholds), automatically initiates a pre-defined sequence of actions, such as turning on or off certain switches or valves, thereby allowing the system to automatically reach a pre-set stable state. That is, when Party A’s actions or condition reach a predetermined threshold, Party B must take appropriate action promptly to eliminate the danger and bring Party A to a stable and controllable state; the simplest example of this is a safety valve. The fundamental difference between the two lies in their design philosophies: one is designed for normal or typical operating conditions, while the other is designed to handle occasional extreme events. “An “interlock” is generally designed as a mechanism that allows for interactive changes and a return to the normal state. To use a simple analogy, at road-rail grade crossings, when a train is approaching, the road barriers are lowered, forcing pedestrians and road vehicles to stop and wait in order to ensure the safe passage of the train. Once the train has passed, the barriers are raised, returning to the normal state that permits pedestrians to cross the grade crossing freely. Of course, there is a priority system in place, with rail transport being given top priority. This “interlock” is often translated as “interlocking,” which has become the standard term; personally, I think “linkage” would be a better translation, as it refers to a mechanism of linkage with priorities, and it is reversible in order to ensure safety. Calling it a “lock” is also possible, but it’s not a fixed lock that cannot be opened or closed frequently. “\"Trip\" is different; to ensure completeness, \"trip\" is generally designed such that once a certain parameter reaches a preset threshold, the device or system will \"trigger\" or \"activate\", coming to a predetermined stable state. Moreover, manual inspection is required to confirm that everything is safe before it can be manually restored or reset, so that it can proceed further or return to its original state ； Generally, they are not designed or equipped with a function to automatically return to their original state once triggered, in order to eliminate safety hazards. A typical example is the safety valve: once the pressure in the system reaches its limit, the safety valve activates, allowing the pressure to be released and bringing the system back to a safe state. However, the system or device cannot nor should it recover automatically; it will remain in this safe state until manual inspection is carried out to identify the cause, take corrective action, and retest and calibrate the safety valve. Additionally, the settings of the system or device must be reset from some stable or initial state. In my opinion, this “trip” should be translated as “takeoff” or “trigger”. Today, this concept continues to evolve; currently, ESD and its successor, SIS, in automatic control systems represent extensions of this idea. Typically, automatic control systems consist of DCS and ESD/SIS. DCS (Distributed Control System; in China’s automation industry, it is also referred to as a distributed control system) ； ESD (Emergency Shutdown Device/Emergency shutdown system), SIS (Safety Instrument System/Safety instrument system). In football matches, there are referees and line judges; it is the referee who decides whether all actions taken by the players from both teams are within the rules or not, thus ensuring that the game continues ； However, once the ball touches the sideline, it has reached the boundary of the game; it is no longer up to the referee to make a decision. The line judge raises a flag and blows a whistle to pause the game, after which play resumes according to the rules. To use another analogy here, the role of DCS is similar to that of a referee on a football field; it includes many \"interlock\" functions and settings, which are akin to the rules used on the field to ensure the game proceeds smoothly, and they serve to maintain the proper operation of various systems within the device ； The role of ESD or SIS is similar to that of a referee on a football field – it must remain vigilant at all times, giving priority to safety. Once the predetermined parameters are reached, hitting the set threshold, it will act immediately, causing the device to stop and enter a stable safe state. Then, manual inspection must be carried out first to rule out faults; only after ensuring safety can operation be resumed or started from the initial state.