Interlocking systems

Normal Operation. The designer of a chemical plant must provide an adequate interface between the process and the operating employees. This is usually accompHshed by providing instmments to sense pressures, temperatures, flows, etc, and automatic or remote-operated valves to control the process and utility streams. Alarms and interlock systems provide warnings of process upsets and automatic shutdown for excessive deviations from the desired ranges of control, respectively. Periodic intermption of operations is necessary to ensure that instmments are properly caUbrated and that emergency devices would operate if needed (see Flow measurement Temperaturemeasurement). 

By attempting to maintain process conditions at or near their design values, the process controls so attempt to prevent abnormal conditions from developing within the process. Although process controls can be viewed as a protective layer, this is really a by-product and not the primaiy func tion. Where the objective of a function is specifically to reduce risk, the implementation is normally not within the process controls. Instead, the implementation is within a separate system specifically provided to reduce risk. This system is generally referred to as the safety interlock system. 

Where hazardous conditions can develop within a process, a protective system of some type must be provided. Sometimes these are in the form of process hardware such as pressure rehef devices. However, sometimes logic must be provided for the specific purpose of taking the process to a state where the hazardous condition cannot exist. The term safety interlock. system is normally used to designate such logic. 

The purpose of the logic within the safety interlock system is veiy different from the logic within the process controls. Fortunately, the logic within the safety interlock system is normally much simpler than the logic within the process controls. This simplicity means that a hardwired implementation of the safety interlock system is usually an option. Should a programmable implementation be chosen, this simplicity means that latent defects in the software are less likely to be present. Most safety systems only have to do simple things, but they must do them very, very well. 

The difference in the nature of process controls and safety interlock systems leads to the conclusion that these two should be physically separated (see Fig. 8-89). That is, safety interlocks should not be piggy-backed onto a process-control system. Instead, the safety interlocks should be provided by equipment, either hard-wired or programmable, that is dedicated to the safety functions. As the process controls become more complex, faults are more likely. Separation means that faults within the process controls have no consequences in the safety interlock system. 

Modifications to the process controls are more frequent than modifications to the safety interlock system. Therefore, physically separating the safety interlock system from the process controls provides the following benefits ... 

The possibility of a change to the process controls leading to an unintentional change to the safety interlock system is eliminated. 

Although the traditional point of reference for safety interlock systems is a hard-wired implementation, a programmed implementation is an alternative. The potential for latent defects in software implementation is a definite concern. Another concern is that solid-state components are not guaranteed to fail to the safe state. The former is addressed by extensive testing the latter is addressed by manufacturer-supplied and/or user-supplied diagnostics that are routinely executed by the processor within the safety interlock system. Although issues must be addressed in programmable implementations, the hard-wired implementations are not perfect either. 

An interlock is a protec tive response initiated on the detection of a process hazard. The interlock system consists of the measurement devices, logic solvers, and final control elements that recognize the hazard and initiate an appropriate response. Most interlocks consist of one or more logic conditions that detect out-of-hmit process conditions and respond by driving the final control elements to the safe states. For example, one must specify that a valve fails open or fails closed. 

Implementation of process interlocks within process control systems is perfectly acceptable. Furthermore, it is also permissible (and probably advisable) that responsible operations personnel be authorized to bypass or ignore a process. Safety interlocks must be implemented within the separate safety interlock system. Bypassing or ignoring safety interlocks by operations personnel is simply not permitted. When this is necessary for ac tions such as verifying that the interlock continues to be func tional, such situations must be infrequent and incorporated into the design of the interlock. 

These tests must encompass the complete interlock system, from the measurement devices through the final control elements. Merely simulating inputs and checking the outputs is not sufficient. The tests must duplicate the process conditions and operating environments as closely as possible. The measurement devices and final control elements are exposed to process and ambient conditions and thus are usually the most hkely to fail. Valves that remain in the same position for extended periods of time may stick in that position and not operate when needed. The easiest component to test is the logic however, this is the least hkely to fail. 

Interlock System A system that detects out-of-limits or abnormal conditions or improper sequences and either halts further action or starts corrective action. 

On the other hand, Mary, a research process development engineer, does not consider Joe s system to be inherently safer, because a truly inherently safer system would not require an interlock at all. The process uses flammable materials and operates at elevated pressure. Mary, looking at the entire process, would only consider it to be inherently safer if the flammable materials were eliminated or the process was operated at ambient pressure. Mary is considering the inherent safety characteristics of the entire process, rather than a single interlock system. 

From Joe s and Mary s viewpoints, each may be correct. Joe s diverse interlock system is indeed inherently safer as a layer of protection than the alternative using identical sensors, but it is still part of a process which is inherently less safe than alternatives which... 

Basic Process Control System (BPCS) and Safety Interlock System (SIS)... 

There are few chemical plants that are so forgiving that a control system or a safety interlock system is not required. Process engineers provide controls to assure product yield and quality and maintain safe operating conditions. This type of control system is a BPCS. The BPCS acts to alarm and moderate a high or low operating condition specified by the normal operating limits within the never exceed critical limits. The SIS is provided to shut down or otherwise place the process in a safe state if the BPCS fails to maintain safe operating conditions. A BPCS should not be used as the sole source of a process safety shutdown. 

An interlock system (sensors and valves) which isolates offgas flow to die process heater firebox and routes the offgas to atmosphere on detection of low nitrogen flow or high temperature at the detonation flame arrester outlet. 

Inspecting and maintaining the interlock system is a vital function. It is required to ensure general safety and to avoid risks of boiler explosion. Interlocks provide for the safe sequence of boiler startup and shutdown procedures. 

---