Safe programmable logic controller

Safe programmable logic controller (PLC) internal architecture. I/P, input O/P, output. 

Table VIII/2.4 1 Comparsion of Standard and safe Programmable Logic Controllers (PLCs) ...

This paper is based on the work undertaken during the first year of a four year collaborative project entitled "Software Engineering Methods for Safe Programmable Logic Controllers". The project is part of the joint DTl/Serc "Safety Critical Systems Initiative". In the paper the background to the project is presented, and the principal objectives of the project are summarised. Whilst it is too early to present detailed results, the major issues are summarised. The principal conclusion to date is that the cross-sectoral background of project members has challenged many preconceived notions. 

Software Engineering Methods for Safe Programmable Logic Controllers (SEMSPLC)... 

As a rule, this Ex i-isolator is installed in a safe area and connected to additional apparatus not ex-protected, e.g. to a single loop controller or to a PLC (Programmable Logic Controller). Therefore, in the field of intrinsic safety two types of apparatus are distinguished ... 

Requirements for the use of programmable logic controllers (PLCs) are defined in NFPA 86 (sect. 5-3). All critical protection interlocks (e.g., combustion safety interlocks, flame supervision, high and low oxygen and fuel flow interlocks, excessive temperature limits, etc.) shall be wired to de-energize the safety shutoff valves directly, and their operations shall result in a safe system condition. 

Process safety interlocks can be used to prevent ttnd/or mitigate tin upset condition. Salety interlocks consist of outputs from process control systems, such as programmable logic controllers or distributed control systems, which trigger tut action designed to compensate I ot an upset condition and thus avoid an accident even in the e em of human or computer error. An example of a salety interlock would be the introduction of full cooling if the temperature of a reaction exceeded a safe level. 

The main features of the control system of the plant are reported here. A dedicated programmable logic controller (PLC) handles both regulation loops and an alarms-interlocks system. If any process condition exceeds the design values, a trip system is activated and an interlock sequence restores a safe state. The control panel operator monitors alarm indicators and may take appropriate action when needed to avoid a plant shut-down. 

The PES can be a programmable controller, a distributed control system controller, or an application-specific, stand-alone, micro-programmable logic controller (micro-PLC). The complexity of the PES results in numerous paths to failure, including dangerous and safe failures. Many failures are unsafe. Some techniques that can be used to minimize these failures of PES are... 

Design steps for a safe system. ALARP, as low as reasonably practicable BPCS, basic plant control system DCS, distributed control system IPL, independent protection layer PLC, programmable logic controller SIS, safety instrumentation system. 

The purpose of this paper is to provide guidance to enable Programmable Logic Controllers to be configured to provide integrity levels at the highest class of safety (Class 4) when applied to systems that have a known safe state. 

The ability to shutdown the process, independent of the BPCS controller and SIS logic, solver may be required for some applications. The current editions of NFPA 85 and NFPA 86 require independent means for equipment covered by these practices. The SIS logic solver has a very low failure rate, but what will you do when it fails Even with the very low failure rate, programmable electronic systems can fail. Equipment safety manuals may specifically require independence, especially for SIL 3 applications. When non-fail-safe design is used, e.g., energize to shutdown, independent shutdown facilities should be provided that do not require the SIF support system to be operational. 

---