[2026 Safety Interlock] Can the DCS send signals to the SIS to control valve switches or motors?
Thread Content
I. Safety interlocks: Can it be achieved with DCS? 1. DCS and SIS: Fundamental differences in roles and functions. First, it is necessary to clarify the fundamental differences between DCS and SIS. They play distinctly different roles in the safety system of production facilities. First line of defense: The design, selection, installation, and operating procedures of the devices at the production process level constitute the most fundamental safety safeguards.
Second line of defense: Process control layer (DCS). The DCS is responsible for continuous dynamic control, maintaining stable production, optimizing operations, and handling routine switching and start/stop interlocks.
Third line of defense: Safety Protection System (SIS). The SIS acts as a silent \"safety guardian\" that operates only under abnormal conditions to carry out safety functions such as emergency shutdown; it represents the last and most crucial barrier for protecting people and equipment.
DCS can be thought of as a car’s “automatic driving and cruise control system,” responsible for ensuring the vehicle moves smoothly and efficiently； SIS, on the other hand, stands for \"Airbags and ABS Anti-lock Braking System\"; it does not intervene under normal conditions but is activated only in emergency situations to prevent accidents.
2. Standards and specifications: The major domestic and international safety standards are very clear regarding the use of DCS for implementing safety interlocks – it is not recommended, and higher-level safety functions must be independent. International standard: Separation is highly recommended.
International mainstream standards generally emphasize the physical and functional separation of control and protection systems: IEC 61511 / GB/T 21109 – the core standards for safety instrumented systems in the process industry – define the safety lifecycle and Safety Integrity Levels (SIL). ISA 84 / ANSI/ISA-61511: Standards issued by the International Automation Association, equivalent to IEC 61511; it is highly recommended that SIS and DCS hardware be installed separately. API RP 14C: Requires safety systems to provide two levels of independent protection and to be separate from normal process control equipment.
Domestic regulations: Independent systems are required in critical scenarios. China has clear mandatory requirements for high-risk scenarios: The Interim Provisions on the Supervision and Management of Major Hazard Sources of Hazardous Chemicals (Order No. 40 issued by the State Administration of Work Safety) stipulates that primary or secondary major hazard sources involving toxic gases, liquefied gases, or highly toxic liquids must be equipped with independent Safety Instrumented Systems (SIS).
\"Criteria for Identifying Major Potential Hazards for Production Safety Incidents in Chemical and Hazardous Chemicals Production and Operation Units (Trial):\" Failing to equip such tank areas with an independent SIS system is considered a major potential hazard for accidents.
“The Guidelines of the State Administration of Work Safety on Strengthening the Management of Safety Instrumented Systems in the Chemical Industry” (Safety Supervision General Administration Document No. San [2014] 116): Require safety instrumented system function assessments to be conducted for facilities involving those classified as “two key areas and one major hazard” (highly regulated hazardous chemical processes, highly regulated hazardous chemicals, and major hazard sources).
3. Key technical differences: Even without considering standards, from a technical perspective, the design objectives of DCS and SIS mean that they are not suitable for being used together.
II. DCS can send signals to SIS to control valve switches or motors, but this is not recommended. In actual engineering designs, some valve switches or motor start/stop signals are only available in one form; if it is necessary to bring these valves and motors to a stop urgently in an emergency situation, such signals must come from SIS. In this way, when DCS sends a signal to control a switch valve or motor, it can only first send the signal to the SIS, which then outputs a signal to control the device in question. According to Section 5.0.9 of GB/T 50770, this situation is acceptable.