SIS (Safety Instrumented System) can utilize negative logic interlocks
Thread Content
This post was last edited by zhoudingshengs on 2023-11-23 at 16:53. Safety Instrumented Systems (SIS) can utilize negative logic interlocks. Alarm, interlock, and shutdown systems are used to ensure the safe operation of process production units and their auxiliary facilities. Safety interlocks can use contacted relays or contactless transistor circuits. Generally speaking, they are dry contacts and wet contacts. The control system utilizes a triple (or quadruple) redundant SIS instrument safety system, with sensors being designed in an independent or redundant manner to meet safety requirements. Safety interlock systems are typically designed to be fail-safe; when an interlock action occurs, the output should be 0, which is why negative logic control is used. (1) The wiring of sensors and the signal input to the control system follow the following principles: 1. When switches are used as sensors, normally closed switches are generally selected; that is, they remain closed under normal conditions and open when the interlock set point is reached, meaning that the Boolean value is “0” when the interlock input signal is triggered. 2. In the initial state or fault state of the logic controller, the boolean value in the software is “0”. (II) The commonly used safety interlock designs are as follows: 1. Negative logic OR block for safety interlocks. When the interlock condition is 0, the OR block functions in a ‘AND’ manner; that is, the interlock takes effect only when two or more interlock conditions are 0 at the same time. 2. Negative logic AND block for safety interlocks: When the interlock condition is 0, the AND block operates in an “or” manner; that is, the interlock is effective if any one of the two or more interlock conditions is 0. 3. Interlock design with reset when the action condition is 0: During an alarm, when the interlock condition is 0, inverting it results in R=1; the output of the SR flip-flop is 0, and thus the interlock takes effect. When the alarm disappears, the interlock condition is 1; after inversion, R=0, S=0, and Q=Qn-1 becomes 0, meaning the interlock remains active. After the interlock is reset, R=0; S first becomes 1 and then 0; Q first becomes 1 and then Qn-1 becomes 0, at which point the Q output is 1 and the interlock is released. 4. Interlock design with reset when the action condition is 1. Generally, an appropriate safety level is determined through a qualitative assessment of the likelihood of all possible events, the severity of their consequences, and the effectiveness of other safety measures: Level 1 is used for situations where accidents occur very rarely. In the event of an accident, there will be only minor effects on the equipment and products; it will not cause immediate environmental pollution or casualties, and the economic losses will be minimal. Level 2 is used for accidents that occur occasionally. In the event of an accident, it has a significant impact on the equipment and products, and may lead to environmental pollution and casualties, resulting in substantial economic losses. Level 3 is used in areas where accidents occur frequently. In the event of an accident, it will have severe effects on the equipment and products, cause serious environmental pollution and casualties, as well as substantial economic losses. ISA-S84.01 classifies safety integrity levels into 3 grades (SIL1-SIL3) based on the probability that the system will not respond to safety interlock requirements. Positive logic is generally used in DCS, with low safety requirements and minimal hazards. However, interlocks in systems such as SIS, ESD, and ITCC are all related to equipment damage or personal safety incidents, and negative logic may be used as per regulations. This prevents the control system from continuing to assume that the site is safe due to damage to the instrumentation equipment or open circuits, thereby ensuring that protection functions are maintained. For interlock output signals, when the line is open circuit, in the case of positive logic, the signal received at the field side remains 0, and no interlock action occurs. In negative logic, as long as a wire is broken, interlocking is triggered to ensure safety; this is the function of negative logic, which focuses on safety and reliability.
The main purpose of a Safety Instrumented System (SIS) is to ensure the safety of personnel, equipment, and the environment in industrial processes. SIS typically needs to meet a specific Safety Integrity Level (SIL) in order to ensure that the system can take appropriate protective measures in the event of dangerous situations, based on the level of risk involved. Negative logic interlocks are often used in the design of safety instrumented systems. The design of negative logic interlocks means that, under normal operating conditions, the output of the interlock logic is 1 or \"high\", while when a safety action needs to be carried out, such as an Emergency Shutdown (ESD), the output of the interlock logic becomes 0 or \"low\". The advantage of this design is its sensitivity to system failures. In the event of sensor failures, broken connections, or loss of power, the system will automatically switch to a safe state, thereby achieving fail-safe operation. Here are some specific points regarding safety logic and interlock design: 1. When digital instruments are used, normally closed switches (closed under normal conditions and open in the event of a fault) are employed to implement negative logic; that is, when the interlock set point is reached and the switch opens, the input signal becomes “0”, triggering a safety action. 2. In the initial or fault condition, the boolean value in the software for the logic controller should be “0” in order to maintain or trigger the safe state. 3. For the negative logic OR and AND blocks of safety interlocks, the logic is the opposite of that of traditional positive logic gate operations. In negative logic design, the OR block functions similarly to an \"AND\" gate (the output is 0 when all inputs are 0), while the AND block functions similarly to an \"OR\" gate (the output is 0 when any one of the inputs is 0). 4. The interlock design with reset functionality allows the interlock to be reset through specific operations after it is triggered, restoring the system to normal operation. 5. In accordance with international standards such as ISA-S84.01 or IEC 61508, the corresponding safety integrity level (SIL level) is determined based on the probability that the system will meet the requirements of safety interlocks. 6. The use of negative logic enhances the security of the system, as it prevents misjudgments by the control system regarding the safety of the site due to damage or open circuits in the devices and circuits present in a positive logic system. By adopting a negative logic interlock design, the SIS can improve its ability to respond to equipment failures or abnormal conditions, ensuring that safety measures can be effectively implemented in case of dangerous situations, thereby reducing the risk of accidents and protecting the safety of personnel and equipment. .
The discussion on positive and negative logic takes a long time, and some documents classify control logic as \"positive logic\"; in my opinion, it is necessary to discuss it by separating hardware inputs and outputs from the software logic in between. For informational purposes only. The \"positive logic\" in software logic diagrams is used to improve the readability of the logic and to facilitate judgment in daily work, thereby reducing the risk of misinterpretation that could lead to operational interruptions. When reading a logic diagram, do not consider the AND gates with a \"0\" input; in reality, they are OR gates and similar. My understanding is that the hardware-related inputs and outputs are definitely fail-safe in nature; digital inputs represent a \"closed\" state, which corresponds to a value of \"0\". However, through a NOT gate, this becomes \"positive logic\", and then logical operations such as AND, OR, and NOT are performed in the controller software, which is consistent with human thinking. The actuation side, just like the input side, ultimately results in a no-action state. Some documents define the contacts of relays, such as those that operate in a de-energized state for solenoid valves; some safety relays also have only NO contacts. Some documents also state that DCS uses positive logic while SIS uses negative logic. In fact, aside from the hardware, it’s best for the logical operations at the core to be based on positive logic; this makes it easier to analyze and diagnose faults, reduces the risk of errors, and there’s no need to imply that those working on control systems are highly skilled. It’s also simpler to explain these concepts to professionals from other fields, such as process engineering or equipment maintenance.
In GB/T 50770-2013:
This post was last edited by zhoudingshengs on 2023-11-23 at 16:18. I agree with your view. 1. The logical design of the safety interlock system employs negative logic, and this is based on the following considerations: (1) When switch-type sensors are used, switches are generally chosen to be normally closed, meaning they are closed under normal conditions and open when the interlock set point is reached; thus, when the interlock input signal is activated, the boolean value is “0”. (2) When the logic controller is in its initial state or fault state, the boolean value in the software is “0”. 2. According to Clause 4.3.1 of the \"Design Code for Signal Alarm and Interlock Systems HG/T 20511-2014\", positive logic can be used for the logical design of non-safety interlock systems, while negative logic can be employed for the logical design of safety interlocks. Note: Positive logic refers to a high level or boolean value of “1” when the interlock input signal is triggered” ； Negative logic refers to a low level or boolean value of “0” when the interlock input signal is triggered.
This post was last edited by zhoudingshengs on 2023-11-23 at 16:49. 1. Regarding fail-safe design, it is necessary to analyze each situation individually; the most likely failure modes must be identified, rather than assuming that \"normally closed contacts are charged under normal conditions.\" 2. The fault safety principle of system design is that, when components, devices, links, or power sources of the safety instrumented system fail or malfunction, the system design should ensure that the process can proceed toward safe operation or a safe state. Whether \"fail-safe\" can be achieved depends on the process and the design of the safety instrument system. The entire SIS system, including field instruments and actuators, should be designed in accordance with the following absolute safety principles: (1) Field contacts should provide an open-circuit alarm condition and remain closed under normal operating conditions ； (2) The on-site actuator is de-energized during interlock, but energized under normal operating conditions. 3. For actuators such as isolation valves, under normal circumstances, the SIS should be designed so that when a safety interlock is activated, the isolation valve enters a safe state of loss of air pressure. When multiple different process loops have varying requirements for the operation of this isolation valve ； Just like an FC (close on air loss) shut-off valve, this valve is required to be fully open when the A safety interlock activates ； When the other B safety interlock activates, the valve is required to be fully closed. At this point, it is required that the SIS output a “1” in safety interlock A to energize the solenoid valve and open the valve fully, and output a “0” in safety interlock B to de-energize the solenoid valve and close the valve fully.
Thank you to all the experts for sharing; thanks a lot!
Agreed; actually, the key is to help people from other fields understand better