Hardwire interlocks

Sections 9.1.6 (c) and 9.2.1 (h) drew attention to the hazards of using old equipment. Similar remarks apply to old software except that, unfortunately, it never wears out. I do not know of any incidents in the process industries due to this cause, but it was responsible for the loss of the European space rocket Ariane 5. A function that no longer served any purpose was left in for commonality reasons, and the decision to do so was not analyzed or fully understood [14]. In another incident, cancer patients received excessive doses of radiation because operators were able to enter data faster than the computer could process them. This had always been the case, but originally a hardwired interlock had prevented... 

Interlocks hardwired interlocks, scan rates, suppression, logging, reporting, acknowledgment, computer system handshakes and watchdogs, avoid deadly embrace... 

A permissive is a special type of interlock that controls a set of conditions that must be satisfied before a piece of equipment can be started. Permissives deal with start-up items, whereas hardwire interlocks deal with shutdown items. A permissive is an interlock controlled by the distributive control system (DCS). This type of interlock will not necessarily shut down the equipment if one or more of its conditions are not met. It will, however, keep the equipment from starting up. 

The purpose of the logic within the safety interlock system is veiy different from the logic within the process controls. Fortunately, the logic within the safety interlock system is normally much simpler than the logic within the process controls. This simplicity means that a hardwired implementation of the safety interlock system is usually an option. Should a programmable implementation be chosen, this simplicity means that latent defects in the software are less likely to be present. Most safety systems only have to do simple things, but they must do them very, very well. 

Process control and safety shutdowns must be provided during all modes of operation, not only in the RUN mode. Other modes will require a BPCS configured for the mode operating algorithm and very likely a different set of safety interlocks must provide appropriate protection. Hardwire devices, like timers or software logic, can be used to actuate the SIS pertinent to the operating mode. 

The view is therefore growing that we should try to design plants so that they are safe even if there is a fault in the software. This can be done by adding on independent safety systems, such as relief valves and hardwired trips and interlocks, or by designing inherently safer plants that remove the hazards instead of controlling them (see Chapter 21). 

The difference in the nature of process controls and safety interlock systems leads to the conclusion tliat these two should be physically separated (see Fig. 8-92). That is, safety interlocks should not be piggybacked onto a process control system. Instead, the safety interlocks should be provided by equipment, either hardwired or programmable, that is dedicated to the safety functions. As the process controls become more complex, faults are more likely. Separation means that faults within the process controls have no consequences in the safety interlock system. 

Separation also applies to the measurement devices and actuators. Although the traditional point of reference for safety interlock systems is a hardwired implementation, a programmed implementation is an alternative. The potential for latent defects in software implementation is a definite concern. Another concern is that solid-state components are not guaranteed to fail to the safe state. The former is addressed by extensive testing the latter is addressed by manufacturer-supplied and/or user-supplied diagnostics that are routinely executed by the processor within the safety interlock system. Although issues must be addressed in programmable implementations, the hardwired implementations are not perfect either. 

The potential that the logic within the interlock could contain a defect or bug is a strong incentive to keep it simple. Within process plants, most interlocks are implemented with discrete logic, which means either hardwired electromechanical devices or programmable logic controllers. 

Diversity can be used to further advantage in redundant configurations. Where redundant measurement devices are required, different technology can be used for each. Where redundant logic is required, one can be programmed and one hardwired. Reliability of the interlock systems has two aspects ... 

Are there hardwired trips and interlocks Challenge them. 

Alarm/event handling needs careful consideration and design. Where alternative (often hardwired) safety/interlock systems are installed, consideration should be given to mirroring their actions... 

The purging cycle must be timed, and must be interlocked to prevent the start-up of the oxygen/fuel combustion equipment, per NFPA 86 (sect. 5-4.1.2). The purging process is considered a critical safety interlock and therefore must be hardwired to de-energize the safety shutoff valves per NFPA 86 (sect. 5-3.3). 

Most of the system interlocks are handled by the embedded NI controller. This is similar to that used in other laboratory-scale reactor systems (Mills and Nicole, 2005) except the Siemens 545 PLCs have been replaced with the National Instruments system. The National Instruments controller monitors the status of the AIMS process variables and takes appropriate action if any interlock conditions are found. In addition to these interlocks, the external heater controllers that are used for the system heating tapes and sampling valve box contain hardwired overtemperature interlocks built-in to these controllers. However, these interlocks only interrupt power to the affected heating device, so the NI controller must still take action to shutdown the rest of the process. 

A safety interlock control function must be separate from the BPCS. Its function is not on-spec product but the prevention of a catastrophic event that would result in human injury or death or damage to equipment. Safety interlocks are usually hardwired to make it difficult to bypass or defeat them. This is done because there have been past occurrences of a unit engineer or a process technician jumping to the conclusion that an alarm was faulty and there was no problem. They tried to go around the interlock to shut off the alarm or prevent process interference. Safety interlocks must not be bypassed without written approval. 

At least one hard-wired Emergency Stop function shall be generated to create an emergency shutdown independent of the PLC and shall function even if a component of the PLC fails. The Emergency Stop function shall be interlocked in to the PLC software. The E-Stop hardwiring shall open appropriate power circuits to PLC outputs. 

An example of a design incorporating hardwired safety circuits is shown in Fig. 13.24. This shows how the outputs of the interlocking switch and the emergency stop actuator are routed not only to the input of the PLC... 

Rack 1 (first from the left standing in front of the console) is the Safety Display and Command Rack, which belongs to the reactor protection system. In all its engineering aspects, it is equivalent to rack three in the main console hardwired, functionally and electrically independent, its indicator panel implements the Safety Parameter Display Unit, its command panel includes the manual triggering, interlock and reset pushbutton of the protection and active-safety systems. This rack in the secondary console includes all the equipment that is required to shutdown the reactor and to keep the reactor in a safe shutdown condition... 

---