Why do SIS use normally closed contacts, while DCS uses normally open contacts? The key issue is that the valve malfunctions and either opens or closes incorrectly; it doesn’t seem like there’s much difference

The SIS system requires fail-safe operation.

The last edit to this post was made by 275340019 on 2019-3-31 at 22:04. In terms of the protection layer, SIS is located on the outer layer of the DCS. SIS takes fail-safety into consideration, while DCS focuses on operational availability. For example, under normal operating conditions, the buttons on the SIS auxiliary control panel should be closed to disable interlocks. In this way, interlocking will occur whether the interlocking conditions are met or due to button or circuit failures. If a button is used, its normal operating condition is to be in the open state, with the closing action occurring. The circuit was disconnected, and the operators were unable to detect this fault; by the time an emergency stop was needed, the button no longer functioned. For another example, in the pneumatic cut-off valves of SIS interlocks, the solenoid valves should remain energized under normal operating conditions, and the relay on the indoor side should also be closed; it is disconnected during interlock activation. The reason is the same as above. DCS focuses on availability; even if it fails, SIS takes over. However, DCS circuits are not necessarily all normally open; it depends on the specific situation. Note: An open valve at the site has nothing to do with whether the indoor contacts are normally open or normally closed.

The faulty state of the valve is determined by the process conditions

Nonsense; SIS uses normally open contacts, while DCS can use either normally closed or normally open contacts. I usually opt for normally open contacts.

SIS programming is 1 to 0, so there you go

This post was last edited by yunrun on 2019-4-1 17:43. In the design of alarms and interlocks for control systems, relay \"power-off\" alarms are typically used, as they are more reliable than \"power-on\" alarms. Frequently, people ask questions such as: \"Since the relay is energized when everything is normal and de-energized when there is a fault, does this mean that the fault signal from the power supply system should be connected to the relay’s normally closed contact?\" To resolve these issues, it is necessary to have a correct understanding of the relay’s contacts and the status of its alarm functions. http://yunrun.com.cn/upload/201604/08/201604081933414845.jpg Proper selection of relays for alarm functions: Instruments with alarm and interlock functions, as well as DCS systems and frequency converters, all rely on relays; in most cases, it is through the contacts of these relays that they are connected to the alarm and interlock circuits, thereby enabling alarms and interlocks to function. As mentioned above, “excitation” refers to the condition in which the relay coil is under voltage, while “de-excitation” refers to the condition in which the relay coil has no voltage. When an alarm occurs, is it better for the relay coil to be under voltage or without voltage? Let’s analyze the advantages and disadvantages of each of these conditions from a reliability perspective. yunrun.com.cn/tech/604.html The relay coil operating while still energized in order to trigger an alarm in the circuit is a design that is easy to understand. However, there is a potential problem: if the relevant connections are not properly made and an open circuit occurs, or if there is an issue with the power supply to the relay coil, and an alarm is needed in case of an accident, the relay coil should operate while still energized. If, for the reasons mentioned above, the relay does not operate, the consequences can be severe. If it is changed to a \"power loss\" alarm, no alarm will be triggered in the event that the instrument wiring is not properly connected or is open-circuited, there are issues with the power supply to the relay coil, or the instrument malfunctions. The reason is that the relay coil is in a \"powered\" state when no alarm has been triggered; once the aforementioned abnormal conditions occur, the relay coil returns to a \"depowered\" state ； Operators and maintenance personnel will investigate the cause of the alarm due to it. When they find that the signal is normal yet an alarm is still triggered, they will look for other causes and resolve the fault, restoring the alarm circuit to normal operation and thus preventing the absence of alarms. Clearly, a relay that triggers an alarm when de-energized is more reliable than one that triggers an alarm when energized. How can the load-carrying capacity of relay contacts be increased? In practice, if the load capacity of the contacts does not meet the requirements, this issue can be resolved by connecting several pairs of contacts in parallel. However, adjustments should be made before use to ensure that the synchronization of the contacts meets the requirements; otherwise, it will have the opposite effect. The best approach is to use intermediate relays or contactors to increase the load capacity of the contacts.

Because using normally open means that safety cannot be guaranteed when the circuit fails and is disconnected.

Normal open and normal closed have nothing to do with SIS and DCS. It is related to the reliability of the signal.

4.5 The safety instrumented system shall be designed to be fail-safe. When the process has special safety requirements, it can be designed to be fail-safe. Fail-safe type should be designed for non-excitation shutdown ； The non-fault-safe type should be designed for excitation shutdown. Source: Sinopec Safety Instrumented System (SIS) Technical Specifications