The continuous tank level signal is involved in both the high-high interlock and the low-low interlock

This design seems reasonable, mainly serving to ensure that the tank level remains within a safe range. By connecting the liquid level continuous signal to the Safety Instrumented System (SIS) and incorporating it into the high-high interlock and low-low interlock functions, it is possible to ensure that the system can take automatic action to prevent potential hazards when the liquid level is too high or too low. However, this design may also have some problems: 1. **Redundancy**: Using three continuous level signals may increase the complexity of the system. While this may increase the reliability of the system, it can also lead to more maintenance and calibration requirements. 2. **Signal processing**: Processing both high-high interlocks and low-low interlocks simultaneously in a SIS system may require more complex programming. You need to ensure that the system can respond correctly when it receives signals indicating too high or too low liquid levels. 3. **System response**: What is the system’s response to excessively high or low liquid levels? Are there appropriate hardware and software to handle these situations? This will require careful consideration and design. 4. **Testing and Verification**: The implementation of this design requires rigorous testing and verification to ensure that all sequential operations function properly. This may increase the time and cost of system implementation. Please consider your specific application scenario and requirements; if possible, it is best to consult relevant professionals or suppliers. .

No problem, use low-level interlock along with stopping the discharge pump.

It depends on the protection layer; high-high interlock is an SIS interlock. 1) If low-low interlock is also an SIS interlock and they are not in the same protection layer, then there is no problem； If it is the same protective layer, common cause failure needs to be considered ； Also, for SIL, the one with the highest requirements can be used. 2) If the low-low interlock is a DCS interlock and not part of the DCS’s independent protection layer, it is acceptable. 3) If the low-low interlock is a DCS interlock that also constitutes an independent protection layer, then it is not acceptable

Both high-high interlock and low-low interlock are implemented in SIS; the output circuit for the high-high interlock is independent from that of the low-low interlock

In SIS as well, can software and hardware be shared? A: Yes, but it must be set at the highest level, taking into account the possibility of protection layer failure or the need to raise the SIL level. In HGT20511, when implementing SIFs of different SIL levels in the safety interlock system, the shared hardware and software shall meet the requirements of the higher SIL level. According to 11.2.2 of GBT21109.1, when a SIS is required to perform both instrument safety functions and non-safety functions, all hardware and software that may have a negative impact on any SIF under normal and fault conditions shall be considered part of the SIS and must meet the requirements of the highest SIL level. (Note 1: Where feasible, instrument safety functions should be separated from non-safety functions of the instruments) ； Note 2: Sufficient independence means that the failure of any non-safety function, or the use of the instrument’s non-safety functions for programming purposes, cannot cause the failure of the instrument’s safety functions. ) According to 4.4.1.5 of GBT50892, when multiple safety instrument loops are implemented within one safety instrument system, the common components shall be configured according to the highest safety level. According to my colleagues, there is a requirement for the number of uses abroad (10 times), but I think designing an independent protection layer takes into account possible common causes and the number of actions (with higher or lower requirements), so calculations can be used for this purpose.