【Daily Question 20090213】 Survey on the utilization rate of the ESD emergency shutdown system

Engineering applications of ESD systems: In the engineering application of ESD systems, a control scheme should first be determined based on process analysis; thereafter, configuration software is used to configure the system and design the control programs. Finally, the compiled configuration programs are installed, and after online debugging is completed successfully, the system can be put into use. The following explains the two main components in the engineering application of ESD systems. (1) Configuration of the ESD system: The main aspects of configuring an ESD system include setting system parameters, configuring hardware, and establishing connections for communication channels. The design of control programs primarily involves using the programming software provided by hardware manufacturers to create logical descriptions; by dragging and selecting various logic gates or flip-flops and connecting them together, interlock functions can be implemented. The general steps include: ① First, determine whether the interlock inputs and outputs should use normally open contacts or normally closed contacts when the process is operating normally; in other words, determine whether the logical value for the interlock inputs and outputs is 0 or 1 (a logical value of 1 corresponds to a closed switch contact) ； When the digital contact is open, its logical value is 0. At this time, the on-site digital instruments may be connected to normally open contacts or normally closed contacts). Generally, it is standard practice to set the interlock input and interlock output values to 1 when the process is operating normally; that is, these values are 1 when the interlocks are functioning properly. The condition for automatic interlocking is met when the interlock input value becomes 0, and automatic interlocking is activated when the interlock output value becomes 0. If there are multiple interlock inputs, and automatic interlocking is activated when any one of them meets the automatic interlock conditions, the interlock inputs should be connected using an AND gate. It should be noted that under normal operating conditions, the normally open contact (0) or normally closed contact (1) is not exactly identical to the normally open or normally closed contact of the relay. Relay contacts that are open when there is no power supply are the relay normally open contacts, while those that are closed when there is no power supply are the relay normally closed contacts. ②According to the control scheme, the signal logic relationships are designed using truth tables or cause-and-effect diagrams, simplified through logical algebra, expressions are derived, and logic diagrams are drawn based on these expressions. ③ Based on the drawn logic diagram, use the programming software provided by the hardware manufacturer to describe the logic diagram, that is, to develop an offline program. The programming software provided by hardware manufacturers generally complies with the IEC1131-3 international standard for programmable controllers, and supports various programming languages and methods including ladder diagrams, sequence function charts, function block diagrams, structured text, instruction lists, as well as third-party programmers. (2) Debugging of online programs. The debugging of programs while they are in operation plays a key role in verifying the correctness of the system configuration and control programs. The specific aspects of this debugging include: ① Reconfirmation of interlocks. Technical personnel from the process, equipment, and automation fields discuss whether the interlock settings are correct, and reconfirm the interlock conditions based on the requirements of the process equipment. ② Check the input and output values of the system, and observe whether there is any indication of open circuits at the inputs and outputs on the diagnostic diagram. If so, check whether the inputs, outputs, and field instruments are properly connected, and whether the wiring of the field instruments is correct. For analog input, disconnect the wiring of the field instrument, apply the corresponding signal at the field, check whether the display of the relevant tag number is correct, and verify the instrument’s range according to the documentation ； For digital switch input signals, close and open them to check whether their states are correct. For pressure switches or level switches, etc., specialized instruments are required to bring them into normal and abnormal operating conditions in order to check whether the operating values of the switches match the design specifications. For both the hard switches and buttons on the auxiliary control panel, as well as the soft switches and buttons on the operation screen, it is necessary to verify one by one whether their locations match those defined in the configuration ； For digital switch output signals, they should be forced to logic 1 or logic 0, and it is necessary to check whether the indicator lights on the corresponding channels of the system card or the relay indicator lights show the correct values. (Generally, the indicator light is on when the logic is 1, and off when the logic is 0.) ③ For the commissioning of interlocks, based on the interlock diagram, manual operations are carried out to satisfy each interlock condition (making sure that every individual interlock condition is met), thereby triggering the operation of the interlock circuits. It is then necessary to check whether the output status of the interlocks is correct, as well as to verify that all the actuators on site operate properly and are in the correct positions. All possible conditions are taken into consideration to form various combinations of conditions, which serve as interlock activation conditions, in order to check whether the interlock circuits operate correctly. ④ Interlock screen inspection: Process engineers carefully check whether there are any errors in the process flow, whether the names of equipment, process pipelines, and materials are correctly labeled, and whether it is easy to navigate through, switch between, and access different pages on the interlock screen. Technical personnel specialized in automatic control shall check whether the operations of soft switches and buttons on the interlock screen are correct, whether the displayed data is accurate, whether the color changes on the screen are proper, and whether the on/off status of the equipment as well as the on/off status of solenoid valves are correctly shown. ⑤ Check the function of the first accident record (SOE). An SOE (Sequence of Events) is an event logging procedure built into the system to record the occurrence of events; it allows operators to easily find the record of the first event that occurred following an interlock action, thereby facilitating the identification of the cause of the fault. During debugging, the logical values of the DI or DO signals can be manually changed, and then it can be checked in the SOE program to see if they are recorded correctly. ⑥ Saving the configuration database: After debugging is completed, the configuration database file in the controller should be saved promptly, with the save time noted down, so that it can be restored or further modified later. This prevents the loss of the configuration database file due to various reasons; failing to save it in time would render all efforts pointless.

High! I had never considered this issue before. I think it’s related to the design of the chain system – perhaps the safety requirements are too strict, leading to unnecessary stops. In my opinion, it also depends on whether the production process is proper. This kind of chain-stop strategy should be adjusted based on the opinions of the operators on site. Additionally, shouldn’t there be some kind of warning given before the chain system activates, such as an alarm in the control room, so that the operator can make another judgment?

Since the introduction of safety interlock design standards, a great deal of money has been wasted and sent to foreign countries needlessly. If there are standards, then design is required; once designed, it has to be put into use. But once in use, people are afraid to operate it, and if operated, it causes incorrect parking.

The safety of ESD chains is certainly high, and frequent shutdowns do indeed occur. But the reason for the problem is not high safety requirements; rather, it’s because of budget constraints and various other factors in our country (which everyone knows), that equipment and instruments there suffer from frequent failures. To ensure continuous production, it is necessary to bypass or remove the interlocks. It not only increases the risks associated with production but also places a heavier burden on the operators.

The main components of ESD system configuration include system parameter setting, hardware configuration, and the connection of communication channels. The design of control programs primarily involves using the programming software provided by hardware manufacturers to create logical descriptions; by dragging and selecting various logic gates or flip-flops and connecting them together, interlock functions can be implemented. The general steps include: ① First, determine whether the interlock inputs and outputs should use normally open contacts or normally closed contacts when the process is operating normally; in other words, determine whether the logical value for the interlock inputs and outputs is 0 or 1 (a logical value of 1 corresponds to a closed switch contact) ； When the digital contact is open, its logical value is 0. At this time, the on-site digital instruments may be connected to normally open contacts or normally closed contacts). Generally, it is standard practice to set the interlock input and interlock output values to 1 when the process is operating normally; that is, these values are 1 when the interlocks are functioning properly. The condition for automatic interlocking is met when the interlock input value becomes 0, and automatic interlocking is activated when the interlock output value becomes 0. If there are multiple interlock inputs, and automatic interlocking is activated when any one of them meets the automatic interlock conditions, the interlock inputs should be connected using an AND gate. It should be noted that under normal operating conditions, the normally open contact (0) or normally closed contact (1) is not exactly identical to the normally open or normally closed contact of the relay. Relay contacts that are open when there is no power supply are the relay normally open contacts, while those that are closed when there is no power supply are the relay normally closed contacts. ②According to the control scheme, the signal logic relationships are designed using truth tables or cause-and-effect diagrams, simplified through logical algebra, expressions are derived, and logic diagrams are drawn based on these expressions. ③ Based on the drawn logic diagram, use the programming software provided by the hardware manufacturer to describe the logic diagram, that is, to develop an offline program. The programming software provided by hardware manufacturers generally complies with the IEC1131-3 international standard for programmable controllers, and supports various programming languages and methods including ladder diagrams, sequence function charts, function block diagrams, structured text, instruction lists, as well as third-party programmers.

ESD does indeed easily cause shutdowns; to make good use of it, one often needs to conduct repeated experiments and accumulate experience in various aspects, but overall it is still very useful

ESD is the abbreviation for Emergency Shutdown Device, which refers to the emergency shutdown system. Larger-scale emergency shutdown systems should be installed separately from the DCS in accordance with the principle of safety and independence. There are several main reasons for this: (1) to reduce the probability of both control functions and safety functions failing simultaneously, so that a malfunction in the DCS does not compromise the safety protection system; (2) for large-scale installations or rotating mechanical equipment, the faster the response time of the emergency shutdown system, the better. This helps to protect the equipment and prevent accidents from escalating ； It also helps in identifying the causes of accidents and keeping records of them. Since DCS processes a large amount of process monitoring information, its response speed is difficult to make fast ； (3) The DCS system is a process control system that is dynamic and requires frequent manual intervention, which may lead to human-induced errors ； ESD, on the other hand, is static and does not require human intervention; by setting it this way, human errors can be avoided. It is thus evident that ESD is highly necessary, and effective measures can be taken to avoid incidents of incorrect parking (for example, through a two-out-of-three voting mechanism, the system can provide users with high reliability and error-free operation).