One input and two outputs; the safety barrier feeds into the DCS on one path and the SIS on another
Thread Content
Dear teachers, for the projects in 2012, such as certain flow interlocks, there were interlocks in both DCS and SIS. At that time, a one-input two-output safety barrier was used, with one output going to the DCS and another to the SIS, and then the interlocks were implemented in each system. In 2020, the current project also used this approach. I wonder if this complies with the regulations, and whether it will pass expert inspections in the future? Currently, the DCS interlock value is lower than that of SIS; in other words, the DCS triggers the interlock first when the corresponding value is reached, and then the SIS triggers the interlock.
The circuit for SIL1 is acceptable; sensor sharing is not allowed for 2/3
As an independent protection layer, SIS should be independent across the entire system, even for SIS1. IEC61508/61511 have provisions in their new versions, and the new version of GB50770 will also be revised!
Actually, this is the blind spot: whether to use DCS or interlocks. If a HOZAP analysis is conducted, the classification should extend to include the SIS as well; in DCS, it should mainly involve basic control functions, and nowadays DCS systems also come equipped with interlocks. It’s actually due to an unreasonable design. It is not possible to separate control from interlocking; one simply copies others’ processes without rethinking the design.
First, a step-by-step design is carried out to create an initial version of the PID controller; after that, a professional agency is hired to conduct a HAZOP analysis in order to determine the SIL level. Once the SIL level has been determined, further design work is done for the SIS system, followed by detailed design. In cases where the analysis agency fails to assign a SIL level for the interlock systems, then such DCS interlocks actually function as simple controls (for example, turning on when the liquid level is high and turning off when it is low). This may be because the analysis agency lacks the necessary capabilities, or it might simply be trying to make money. Since many chemical process packages originate from abroad (and have been used for many years now), it’s necessary to conduct HAZOP analyses again every one or two years. If there are new requirements or technical upgrades, those changes also need to be incorporated into the SIS system. Chinese people dare not easily judge foreign process packages, so they simply copy what exists; in reality, advanced foreign designs already separate interlocking functions from control functions. So, to answer your question: in DCS, this is referred to as control, while in SIS it is called interlock. Using a two-part safety barrier to introduce signals into the DCS for display, and using intermediate variables for control, should not theoretically have any impact; but according to current standards… . . In fact, the best approach for SIS is to be independent.
This mainly depends on the SIL level of your SIS interlock circuit; according to GBT 50770 requirements, SIL1 circuits can be shared, while SIL2/3 circuits need to be installed separately.
Having studied it, it’s difficult to determine the appropriate system for this stage of development
The current regulations are as such, but changes may occur in the future; therefore, it is personally recommended to keep them separate and not use the same transmitter.
GB50770 is under revision; regardless of the SIL level, it is best not to share them, and it is preferable to keep SIS and DCS separate.
Now, DCS systems must have an emergency stop function... and the control panel must also have physical emergency stop buttons!
It’s better to keep DCS and SIS separate; otherwise, it will be a problem during inspections, and making changes will be more troublesome later on