Process control interlocks

The next step is to apply a number of loss control credit factors such as process control (emergency power, cooling, explosion control, emergency shutdown, computer control, inert gas, operating procedures, reactive chemical reviews), material isolation (remote control valves, blowdown, drainage, interlocks) and fire protection (leak detection, buried tanks, fire water supply, sprinkler systems, water curtains, foam, cable protection). The credit factors are combined and appHed to the fire and explosion index value to result in a net index. 

In continuous processes, most process control applications rely on continuous measurements. In batch processes, many of the process control applications will utihze discrete as well as continuous measurements. In both types of processes, the safety interlocks and process interlocks rely largely on discrete measurements. 

By attempting to maintain process conditions at or near their design values, the process controls so attempt to prevent abnormal conditions from developing within the process. Although process controls can be viewed as a protective layer, this is really a by-product and not the primaiy func tion. Where the objective of a function is specifically to reduce risk, the implementation is normally not within the process controls. Instead, the implementation is within a separate system specifically provided to reduce risk. This system is generally referred to as the safety interlock system. 

The purpose of the logic within the safety interlock system is veiy different from the logic within the process controls. Fortunately, the logic within the safety interlock system is normally much simpler than the logic within the process controls. This simplicity means that a hardwired implementation of the safety interlock system is usually an option. Should a programmable implementation be chosen, this simplicity means that latent defects in the software are less likely to be present. Most safety systems only have to do simple things, but they must do them very, very well. 

The difference in the nature of process controls and safety interlock systems leads to the conclusion that these two should be physically separated (see Fig. 8-89). That is, safety interlocks should not be piggy-backed onto a process-control system. Instead, the safety interlocks should be provided by equipment, either hard-wired or programmable, that is dedicated to the safety functions. As the process controls become more complex, faults are more likely. Separation means that faults within the process controls have no consequences in the safety interlock system. 

Modifications to the process controls are more frequent than modifications to the safety interlock system. Therefore, physically separating the safety interlock system from the process controls provides the following benefits ... 

The possibility of a change to the process controls leading to an unintentional change to the safety interlock system is eliminated. 

Implementation of process interlocks within process control systems is perfectly acceptable. Furthermore, it is also permissible (and probably advisable) that responsible operations personnel be authorized to bypass or ignore a process. Safety interlocks must be implemented within the separate safety interlock system. Bypassing or ignoring safety interlocks by operations personnel is simply not permitted. When this is necessary for ac tions such as verifying that the interlock continues to be func tional, such situations must be infrequent and incorporated into the design of the interlock. 

Basic Process Control System (BPCS) and Safety Interlock System (SIS)... 

Process control and safety shutdowns must be provided during all modes of operation, not only in the RUN mode. Other modes will require a BPCS configured for the mode operating algorithm and very likely a different set of safety interlocks must provide appropriate protection. Hardwire devices, like timers or software logic, can be used to actuate the SIS pertinent to the operating mode. 

Introduction The chemical processing industry relies on many types of instrumented systems, e.g., the basic process control systems (BPCSs) and safety instrumented system (SIS). The BPCS controls the process on a continuous basis to maintain it within prescribed control limits. Operators supervise the process and, when necessary, take action on the process through the BPCS or other independent operator interface. The SIS detects the existence of unacceptable process conditions and takes action on the process to bring it to a safe state. In the past, these systems have also been called emergency shutdown systems, safety interlock systems, and safety critical systems. 

Whatever method is used, there should be a clear design philosophy for the basic process control system (BPCS) employed at a facility that is consistent throughout each process and throughout the facility. Consistency in application will avoid human factor errors by operators. The philosophy should cover measurements, displays, alarms, control loops, protective systems, interlocks, special valves (e.g., PSV,... 

Where loss of control could lead to severe consequences, the integrity of the basic process control system and the protective safeguards must be designed, operated and maintained to a high standard. Industry standards such as ANSI/ISA-S84.01 (1996) and IEC 61508 (2000) address the issues of how to design, operate and maintain safety instrumented systems such as high temperature interlocks to achieve the necessary level of functional safety. The scope of these standards includes hardware, software, human factors and management (HSE 2000). 

What will the measurement results be used for Will they be used for process control (closed loop, open loop, feed-forward, feedback) Will they be used as a safety interlock (This puts very strict requirements on the analyzer reliability, and may even require duplicate analyzers.) Will the results be used to accept raw materials or to release product Will they be used to sort or segregate materials How frequently does the measurement need to be made How rapid does one individual measurement need to be How accurate does it have to be How precise How much analyzer downtime is acceptable ... 

The distributed control system (DCS) hardware areas are often referred to as "process computer rooms." I/O Rooms contain the incoming and outgoing wiring, cables and data highway links, and often small transformers and other related electrical equipment. Often, additional space is needed for a master process engineering computer terminal/work station for process control system changes and for critical safety instrumented systems (SIS) for interlocks and emergency shutdowns. 

The process control is provided by programmable process controllers (PLCs), which are flexible and upgradable. The addition of man-machine interfaces (MMls) based on personal computers and common software systems allows not only system control and interlocks, but also a history... 

The duties of the control engineer include the programming of all necessary process operations, interlocking- and safety precautions into a control program, and avoiding the possibility of incorrect operations by the operators. The major part of the malfunctions which still remain should be detected during the commissioning of the plant. 

Gregory McMillan, formerly an engineering fellow in process control for the Monsanto Chemical Company, approached the subject differently. His very entertaining presentation entitled, Can You Say Process Interlocks at an AIChE Loss Prevention Symposium was written as a parody of a popular youngster s TV show. [27]... 

Mr. Fellow, the process control engineer—in the script of this satirical article—explains that in the past, interlocks would have been placed on many but not all of the indirect causes of a release. In McMillans example, a steam-heated chlorine vaporizer would have only two direct chemical process causes of a release. These direct causes are high pressure, which can open a relief device, and high temperature. The high temperature can accelerate corrosion. 

In the past, this company s process control design would have placed interlocks on many of the indirect causes of releases. The indirect causes include a wide-open steam control valve, a closed chlorine gas valve downstream of the vaporizer, or a wide open upstream nitrogen regulator. Unfortunately with the large number of interlocks with similar test requirements, there was not sufficient time and money to assure the integrity of all of the interlocks. 

---