Issues with DCS interlock and SIS interlock protection layers

DCS interlocks are generally considered to be part of the BPCS layer. In the safety protection onion model of GB50770, the BPCS (Basic Process Control System) is responsible for daily automatic control tasks, including the DCS interlock functions. Answering your question: 1. If there are three thermometers used for automatic control, alarm, and DCS interlock, this means there are three separate protection layers: the automatic control layer (BPCS), the alarm and human intervention layer, and the DCS interlock (as part of the BPCS). 2. If one thermometer is used for automatic control and another is used simultaneously for alarm purposes and DCS interlocking, this actually constitutes only two separate protection layers: the automatic control layer and the alarm and human intervention layer (although the DCS interlocking function is included, the use of the same hardware resources violates the principle of independence). Regarding the relationship between DCS interlocks and alarms, the role of the alarm layer is to provide operators with an opportunity to intervene, thereby preventing the process from going beyond safe limits and reaching a point where DCS interlocks are necessary. Therefore, the alarm layer remains very important, as it primarily provides preventive measures, while DCS interlocks serve as a safety protection mechanism that acts more like a last line of defense. In summary, whether SIS interlocks are present or not, DCS interlocks serve as part of the BPCS layer, while alarms and human intervention constitute an independent protection layer. .

So that means, in terms of the order of the protection layers, the DCS interlock comes before alarms and human intervention? Does that mean it’s possible to first activate interlocking before triggering an alarm, and then have personnel intervene to manually close the on-site manual valves or pneumatic valves?

This post was last edited by Xiao Fu fu on 2024-7-4 09:23. Does DCS interlock belong to the BPCS layer? Answer: Strictly speaking, the DCS interlock does not constitute an independent layer alongside the BPCS in the onion diagram; rather, it can be regarded as a function or component within the BPCS layer. The DCS system itself includes various functions such as process control, data acquisition, monitoring, and interlocking; these functions together constitute the BPCS layer. 3 thermometers are used respectively for automatic control, alarm, and DCS interlock situations. Answer: This situation actually involves multiple protection layers. Automatic control belongs to the BPCS layer (or more specifically, it is a function within the BPCS layer); alarms fall under the alarm and human intervention layer. Although DCS interlocks technically belong to the DCS system, from a safety protection perspective, they can still be regarded as an interlock function within the BPCS layer. Therefore, this situation can be considered to involve at least two protection layers (the BPCS layer and the alarm and personnel intervention layer), but the DCS interlock itself does not constitute a new, separate protection layer. One thermometer is used for automatic control, while another is used for alarms and DCS interlocks. Answer: Similarly, this situation also involves at least two protection layers. A thermometer is used for automatic control and belongs to the BPCS layer ； Another thermometer is used for alarms and DCS interlocks; the alarms fall under the alarm and human intervention layer, while the DCS interlocks, as mentioned earlier, can be considered a function within the BPCS layer. Therefore, this situation also involves at least two protective layers. If the DCS interlock belongs to the BPCS layer, is the alarm layer located after the DCS interlock? Answer: Logically, both alarm and DCS interlock are functions that may be included within the BPCS layer. However, from a safety perspective, alarms are generally regarded as a step prior to interlock, used to alert operators to abnormal conditions and prompt them to take appropriate actions. If the DCS interlock is triggered, it usually means that an emergency has arisen that requires immediate action to prevent the situation from worsening. Therefore, although DCS interlocks and alarms are both functions within the BPCS layer, their roles and positions in the safety protection process are different. If DCS interlocks do not belong to the BPCS layer, where should they be placed? Answer: In fact, the DCS interlock does not constitute an independent protection layer that stands alongside BPCS in the onion diagram. As mentioned earlier, it is more of a function or component within the BPCS layer. Therefore, there is no need to place the DCS interlocks in a separate level within the onion diagram.

This should actually be considered a form of automatic control, with the input signal being a binary signal – specifically a signal indicating 110°C – which controls the opening degree of the shut-off valve, i.e., whether it is open or closed. The mechanism used for this control is interlocking, but it’s not the conventional type of interlocking; generally, an alarm is given first, allowing the operator to intervene and make adjustments. If intervention isn’t timely or no adjustment can be made, then the supply of material or the reaction process is stopped through interlocking. The level of interlocking should be higher than that of alarms. However, your situation is a bit special. Due to the lag in steam regulation, it is recommended that you set up two circuits in the steam pipeline. For example, if the target temperature is 90°C, you can set up a control circuit with a target of 85°C. But this control circuit requires that the minimum opening degree of the control valve not be less than 10%. Thus, when the temperature reaches 85°C, the valve opening degree will decrease, and when it reaches 90°C, the valve can be fully closed. This way, the valve opening degree is reduced within the 85–90°C range, preventing too rapid an increase in temperature and ensuring stable control

According to the explanatory provisions of GB50770 and the onion model, the interlock system is generally regarded as part of the process control system; specifically, in the case of DCS (Distributed Control System) interlocks, it actually constitutes a component of the BPCS layer (Basic Process Control System). BPCS is responsible for daily automated control and operation, while DCS interlocks represent an additional safety measure built on top of this, used to monitor and manage critical variables in order to prevent the process from reaching dangerous conditions. 1. For the example in the question: – If there are 3 separate thermometers used for automatic control, alarm signaling, and DCS interlocking, this situation corresponds to three protection layers: the automatic control layer (BPCS), the alarm and human intervention layer, and the DCS interlocking, which also falls under the BPCS layer. - If one thermometer is used for automatic control and another is used for both alarm generation and DCS interlock, then these two functions actually constitute only two layers of protection, as the alarm and DCS interlock rely on the same signal source; from a perspective of independence, their level of protection remains at the same level. 2. Regarding the relationship between DCS interlocks and alarms: - Although DCS interlocks belong to the BPCS layer, they can operate in parallel with the alarm system. While the alarm system issues a warning, the DCS interlock can already begin taking necessary actions to prevent or mitigate the development of the dangerous situation. In this way, even if one system fails, the other system can still provide a certain level of protection. 3. In the absence of SIS (Safety Instrumented System) interlocks: – As you described, without an additional independent safety layer such as an SIS, the main dependencies are BPCS automatic control, human intervention for over-limit alarms, and DCS interlocks. In this configuration, the DCS interlock plays a critical safety role, striving to ensure that the process does not enter an unsafe state. In summary, the DCS interlock indeed constitutes a safety control measure at the BPCS level; it works together with the alarm system to create multiple protection strategies aimed at enhancing the safety of the entire system. .