Can the DCS system send DO signals to the SIS?
Thread Content
I would like to ask the experts here: can DCS send dry contact DO signals to SIS? For example: a pneumatic on/off valve – inlet valve controlled by DCS, and an emergency shut-off valve – feed valve controlled by SIS. Under normal conditions, the water inlet valve is closed while the feed valve is open. In the event of a hazard, the DCS must open the water inlet valve; simultaneously, the DCS sends a signal to the SIS, which then shuts down the feed valve via interlock. Is this feasible? What should be done if it’s not feasible?
The key is to determine whether major hazard sources of level 1 or 2 are involved. Interim Provisions on the Supervision and Management of Major Hazard Sources of Hazardous Chemicals, Article 13: Hazardous chemical enterprises shall, based on the types and quantities of hazardous chemicals that constitute major hazard sources, as well as the production and usage processes (methods) or relevant equipment and facilities, establish and improve safety monitoring systems in accordance with the following requirements to enhance control measures: (1) Major hazard sources shall be equipped with systems for continuous collection and monitoring of information such as temperature, pressure, liquid level, flow rate, and composition, as well as detection and alarm devices for leaks of flammable gases and toxic and harmful gases. Such systems shall also have functions such as remote data transmission, continuous recording, accident early warning, and information storage ； Class 1 or Class 2 major hazard sources are equipped with an emergency shutdown function. The electronic data recorded shall be retained for no less than 30 days ； (II) Automated control systems for chemical production facilities and equipment involving major hazard sources that meet safety production requirements ； For Class 1 or Class 2 major hazard sources, an emergency shutdown system is required ； (III) Install emergency shut-off devices for key facilities such as toxic gases, highly toxic liquids, and flammable gases among the major hazard sources ； For facilities handling toxic gases, emergency devices for dealing with leaks must be installed. For Class 1 or Class 2 major hazard sources involving toxic gases, liquefied gases, or highly toxic liquids, an independent Safety Instrumented System (SIS) is required ； An independent Safety Instrumented System (SIS) means that the failure of the DCS system’s functions does not affect the operation of the Safety Instrumented System (SIS).
” In the event of a hazard, the water inlet valve must be opened via the DCS; simultaneously, the DCS sends a signal to the SIS, which then shuts down the feed valve through interlocking. This indicates that such a hazard triggers an action by the SIS, so why is it necessary to use the DCS as an intermediary? You can check the causal relationship: 1. What is the reason why SIS closed the feed valve? Does this reason require turning on the water injection valve at the same time? 2. What is the reason for opening the water injection valve? If that reason also requires closing the feed valve, it is recommended to move the water injection valve to the SIS.
It is best to connect the pneumatic on/off valve – inlet valve position switch directly to the SIS system.
For example, in the event of a fire, it is necessary to open the water injection valve in the DCS to prevent the fire from spreading, while the SIS interlock shuts down the propylene feed valve to cut off the feed.
That was the initial consideration, but there was a fear that if the DO signal was sent and the water inlet valve opened, but the valve position switch malfunctioned and no signal was returned, it could lead to a failure of the SIS interlock.
After the DO signal is sent, for various reasons, the control valve may not actually open. It is relatively reliable to send the valve position switch signal directly to the DCS. If the valve position switch fails, it can be assumed that the entire control valve is faulty (since the valve position switch is a component of the control valve), and this approach is also reasonable.
I don’t think this is a problem, as SIS also relies on input signals to be activated, and there is also a possibility that the signals may be invalid; this issue can be addressed by considering the selection of instruments and the materials used.
In the event of a fire, it is necessary to first cut off the hydrocarbon materials in order to prevent the fire from spreading; this is the top priority, rather than starting water injection first. If water injection is used for spray fire suppression, it should be activated by the fire protection system ； If water is injected into the equipment, the water injection valve can be opened from the SIS DO to the DCS. Have you considered what impact it would have on normal production if the DCS mistakenly opens the water injection valve, but the feed valve remains open? Conversely, SIS closed the feed valve but did not open the water injection valve – what impact does this have on safety? (Conditions for opening the water injection valve: The solenoid valve of the feed valve loses power, and the “Water Injection” button is pressed at the same time)
The level of SIS is higher than that of DCS; your approach reverses the logic. It is recommended to transfer the signals to SIS for handling and execution.
Thank you for your guidance; I will consider the options further.