Seeking help with a small issue in the SIS interlock design
Thread Content
As shown in the figure, 1. For the 1.sis interlock logic, must the output status be off (fail-safe)? Does the DCS have the same requirement? 2. Is this logic a positive logic? Under what circumstances is it permissible to use the counterlogical 3.XB-01 interlock bypass? It should be a button on the control panel, right? Then why is the interlock status closed? Shouldn’t it be in an interlocked state, with the button being normally closed and thus disconnected?
Interlocks should be understood on the basis of the process.
I’ll answer your questions one by one. For the first question, according to clause 5.0.11 of the \"GB/T 50770-2013 Code for Design of Safety Instrumented Systems in Petrochemical Industries\", the safety instrumented system shall be designed to be fail-safe. In other words, when the interlock is not active, the DO controlling the valve should remain in a closed state, thereby ensuring that the valve on-site remains energized at all times. For the safety-related interlocks involved in DCS, the process requirements are the same, and the instrumentation department should also design accordingly. The second question: according to the interlock diagram, XZV-1110 should be a air-operated shut-off valve that opens when power is lost, while XZV-1112 and XZV-1211B are air-operated valves that close when power is lost. The interlock bypass is the branch switching switch for each interlock; it closes when activated and opens when deactivated. The interlock bypass permit, on the other hand, is the master switching switch for these interlocks. Thirdly, it is a hard button or a knob, which means it is closed when interlocking is activated and open when it is deactivated.
This post was last edited by HEJIYUER on 2022-3-14 at 23:45. The interlock design was created many years ago; however, the status of the equipment on-site and the \"0/1\" logic might be reversed, making system debugging difficult. It was changed later to ensure consistency between the logical definition and the status of the field devices: Interlock activation: Field connection is disconnected, resulting in logic 0; Bypass activation: The contacts are closed, resulting in logic 1. Interlock output: Logic 0, with I/O powered down (if the solenoid valve losing power triggers the interlock). Startup allowed: Logic 1, with I/O powered on. With this approach, a NOT gate is placed before and after R/S, which gives the same result as what you described. As for the internal logic, as long as it works, that’s fine.
Compared to DCS, SIS has stricter requirements in terms of reliability and availability; its output is isolated to ensure that the system remains safe even in fault conditions, whereas DCS does not have such high requirements.
Correct answer. If you still can’t understand it, it means you don’t have enough on-the-ground experience; it’s recommended to spend more time at the site
Whether it is SIS or DCS, both must adhere to the principle of fail-safe in terms of limit violation logic. That is, the fault symptoms should match the over-limit signals (the symptoms of poor contact or broken wires should correspond to the over-limit interlock signals). High-level logic and normal closed are merely the results of a selection ； Using high-level logic is simply more conventional; in fact, many PLCs exhibit positive logic in terms of their external appearance and programming, but their internal components use negative logic ； When that BX-01 is closed, it is in the normal state with the interlock bypass active.
Actually, there’s no need to worry about these things; it’s sufficient to ensure that the final DO output is 0 at the time of interlock activation. de-energize to trip.