Issue of shared thermometer sleeves for dual-element thermal resistors in DCS and SIS systems

Regarding your question: 1. It is generally permissible for DCS and SIS to share the same thermometer sleeve. In the safety system standards of the ISA (International Society of Automation), namely ISA-84 (which has also been renumbered as IEC 61511), such applications are not explicitly prohibited. In practical engineering, in order to reduce costs and simplify the design, it is common to use a single temperature measurement point to supply signals to both the DCS and the SIS. It must be noted, however, that sharing measurement points may introduce the risk of shared failures; if there is a problem with the measurement points, information collection in both systems will be affected. 2. For a instrument with a safety level of SIL 1, it is permissible for its signal to be sent to both the DCS and the SIS in a one-to-two configuration. According to the specifications of ISA-84 or IEC 61511, only instruments at SIL 2 and above require a separate independent signal source. However, similar to the above, such a configuration also requires consideration of the risk of shared failures. However, in practice, these configurations may need to take into account local regulations and the specific conditions of the actual project; therefore, it is best to consult professionals in the relevant field. .

Measurement instruments may be shared between SIS and BPCS (basic process control systems such as DCS, PLC, FCS, etc.) only when all of the following three conditions are met: (1) It must be rated at SIL1 or SIL2 (use is not allowed for SIL3). (2) Both safety redundancy and availability redundancy are employed simultaneously (such as a “2oo3” configuration). (3) The “three-out-of-three” signal is used as the control signal for the BPCS. Other requirements that must also be met include: the shared measuring instruments shall be powered by the SIS, rather than by the BPCS ； Online comparative diagnostic technology should be employed between different measuring instruments. It is recommended that for signal sharing, the SIS output signals be wired directly to the BPCS input cards, or communication signals be used; this approach is typically applicable when both the SIS and BPCS are products from the same manufacturer. It is not recommended to use signal distributors before the signals are fed into the SIS. The prerequisite for SIS and BPCS to use common sensors or common control valves is that the failure rate of the relevant equipment is sufficiently low, and that the SIS can bring the process to a safe state within the required time. In reality, even for SIL1 application scenarios, it’s very difficult to achieve this.

The measuring instruments specified in GB/T50770 6.8 sil1 can be shared with the instruments of the basic control system. However, expert examinations still require them to be separated

This post was last edited by sun_fm on 2023-11-9 09:46. 1. Does this count as sharing a data source for DCS and SIS? As far as I remember, there are guidelines that permit such practice. Seeking such a specification or interpretation. Answer: It is considered a 2. It is classified as an SIL1 instrument; currently, a one-input two-output safety barrier is used to connect it to the DCS and SIS. Is there any standard that permits this approach? Answer: Sometimes this can be done (such as for just temperature display), but it’s not possible if the temperature in the DCS is also measured by an IPL sensor. Sometimes, the selection of instruments is also related to the applicable standards; for example, HGT20507 can be used, but SHT3005 cannot. Regarding whether SIS and DCS can be shared, one needs to refer to GBT50770, HGT20511, AQ3054, etc. Regarding SHT3005, in section 5.3.2, in addition to the temperature sensing elements arranged in a two-out-of-three configuration, those used for safety interlock purposes should be separated from the elements used for other purposes and installed in different thermometer casings ； For safety interlocks or critical controls, temperature sensing elements with a single detection point should be dual-ended, and temperature transmitters should be of dual-channel type or configured in a redundant manner. 5.3.10e) For temperature measuring elements used in safety interlock circuits or critical control circuits, it is advisable to select dual-element resistance temperature detectors or dual-element thermocouples. Therefore, strictly speaking, 1. For safety interlocks, single detection points should preferably employ a dual-arm configuration with temperature redundancy, or dual channels ； 2. As long as there are not 3 or more temperature sensing elements, the SIS and DCS should be installed completely separately.

1. Does this count as sharing a data source for DCS and SIS? I believe there are standards that permit such practice. Seeking such a specification or interpretation. Answer: From an engineering application perspective, it is recommended to set them separately. According to 6.1.6 of GBT50770-2013, measuring instruments and sampling points should be installed separately. Approved version: 6.1.6 The measuring instruments of the Safety Instrumented System should be set up independently from the basic process control system. For measuring instruments that share the instrument body with the basic process control system, the pressure taps, pressure piping, sensors, etc., of the safety instrumented system’s measuring instruments shall be independently installed and shall not be shared with the basic process control system. In SHT3007, 5.4.7/6.3.1 states that low-pressure/pressure storage tanks shall be equipped with local pressure indication instruments and remote pressure transmission instruments. Pressure local indicators and remote pressure transmitters must not share the same opening. One of the findings in the investigation into the Xiangshui accident in Jiangsu was the use of a shared opening. For new projects and, where applicable, any type of SIS instrument, it is recommended not to use the same interface. It is inappropriate to use a tee for the liquid level in some projects and the same sleeve for the temperature. In HGT20511, 4.2.5 The safety interlock system and the sensors of the BPCS should not share the same process interface.

If the normal operation of the BPCS control loop meets the following requirements, it can serve as an independent protection layer; the BPCS control loop must be physically separated from the functional safety loops SIF of the Safety Instrumented System, including sensors, controllers, and final elements. (For details, see GB/T 32857-2016 Guidelines for the Application of Protective Layer Analysis (LOPA))