Codeofchina.com is in charge of this English translation. In case of any doubt about the English translation, the Chinese original shall be considered authoritative.
This code is revised by East China Engineering Science & Technology Co., Ltd. and other entities mobilized by the National Chemical Automatic Control Design Technique Center as entrusted by China Petroleum & Chemical Engineering Survey and Design Association, in accordance with the requirements of Notice on printing and distributing the development and revision plan of the first batch of professional standards in 2010 (GONGXINTINGKE [2010], No. 74) issued by the Ministry of Industry and Information Technology (MIIT) and Notice on forwarding the "Notice on printing and distributing the development and revision plan of the first batch of professional standards in 2010" issued by the General Office of the Ministry of Industry and Information Technology (ZHONGSHIHUALIANZHIFA [2010], No. 222) issued by China Petroleum and Chemical Industry Association.
This code replaces HG/T 20511-2000 Design code for signal alarm and safety interlock system from the implementation date hereof.
On the basis of the original professional standard HG/T 20511-2000 Design code for signal alarm and safety interlock system, Chinese experts from automatic instrument industry, as mobilized by the National Chemical Automatic Control Design Technique Center, have revised this code according to the current policy guidelines for China's national economic construction by holding several relevant meetings for discussion and review and drawing on the scientific research achievements and practical experience of chemical engineering system in signal alarm and interlock design, construction and operation in recent years, as well as the feedbacks from various entities during the trial implementation for more than 10 years.
Main technical contents of this code: the first part is about the signal alarm system, including general requirements, message-sending device, logic solver, human machine interface and alarm sequence; the second part is about the interlock system, including general requirements, sensor, logic solver, final element, requirements for hardware fault tolerance of safety interlock system, separation requirements, operator station, etc.
The following main changes have been made with respect to HG/T 20511-2000:
1. the clause “terms and abbreviations” is added;
2. the original clauses of "light display unit", "audio unit", "push button" and "alarm realized by DCS/PLC" in the signal alarm system are merged into "human machine interface";
3. the "auxiliary output” is deleted;
4. during the design, the interlock system is divided into safety interlock system and non-safety interlock system;
5. the clauses such as "requirements for fault tolerance of safety interlock system" are added for interlock system.
This code was proposed by and is under the jurisdiction of China Petroleum and Chemical Industry Association.
East China Engineering Science & Technology Co., Ltd. is responsible for the explanation of the technical contents of this code. In case of any opinion and suggestion in the process of implementing this code, please contact East China Engineering Science & Technology Co., Ltd. (address: No. 70 Wangjiang East Road, Hefei, Anhui; postal code: 230024; E-mail: xujirong@chinaecec.com) for reference in future revision.
Design code for signal alarm and interlock system engineering
1 General provisions
1.0.1 This code is formulated in order to unify the technical requirements for signal alarm and interlock system engineering design in the chemical industry, promote the standardization of signal alarm and interlock system engineering design, and achieve the purposes of safety, applicability, technology advancement and economic rationality.
1.0.2 This code is applicable to the signal alarm and interlock system engineering design for constructed, expanded and renovated chemical plants.
1.0.3 In addition to this code, the signal alarm and interlock system engineering design shall also meet the requirements of the relevant current national standards.
2 Terms and abbreviations
2.1 Terms
2.1.1 basic process control system
system that responds to the input signals from process as well as equipment related to the system and operators, and generates output signals to enable the process and equipment related to the system to operate in a required manner; it shall not perform the safety instrumented function with a safety integrity level higher than or equal to 1
2.1.2 digital variable
a variable having two values only, which is used to indicate the state of a thing or event
2.1.3 diagnostic coverage
ratio of failure rate to total failure rate of components or subsystems under the coverage of diagnostic test, excluding any faults detected during the inspection test
2.1.4 fault tolerance
capability of a functional unit of continuing to perform the specified functions in case of a fault or error
2.1.5 logic solver
equipment that performs one or more logic functions, which may be either a part of the basic process control system or a part of the safety instrumented system
2.1.6 final element
equipment such as valve and motor, which performs the preset action to make the process reach the preset state; it is an integral part of the interlock system
2.1.7 human machine interface
means of information exchange between the operator and the signal alarm and interlock system, such as operator station, light screen, audio, push button, alarm, printer, etc.
2.1.8 interlock system
system implementing the preset requirements in case that the process parameters exceed the limit, the state of equipment etc. are abnormal and the operator inputs signals; it is divided into safety interlock system and non-safety interlock system, and may be composed of sensor and/or message-sending device, logic solver, final element and related software
2.1.9 message-sending device
equipment outputting the digital variable signal
2.1.10 push button
state device with only one stable position, which is classified into software button and hardware button
2.1.11 redundancy
the configuration that two or more components or systems are used to independently perform the same function, and are mutually standby and switched to each other
2.1.12 signal alarm system
system that indicates the process parameters exceeding limits and abnormal states of equipment in the form of sound, light, etc.
2.1.13 failure
termination of the capability of a functional unit
2.1.14 safe failure
failure which impossibly brings the safety instrumented system into potential danger or loss of function
2.1.15 safe failure fraction
total random failure rate fraction of the hardware of the device causing safe failure or detectable dangerous failure
2.1.16 safety interlock system
safety instrumented system with safety integrity level of 1, 2 or 3
2.1.17 safety instrumented function
instrument safety protection function realized by one or more sensors, logic solvers, final elements, etc. to prevent or reduce the occurrence of dangerous events or maintain the safe state of the process
2.1.18 safety integrity level
discrete level (SIL 1~SIL 4) used to specify the safety integrity requirements of instrument safety function assigned to safety instrumented system, wherein, SIL 4 is the highest safety integrity level while SIL 1 is the lowest
2.1.19 safety instrumented system
instrumented system for realizing one or several safety instrumented functions, which may be composed of sensor, logic solver, final element and related software
2.1.20 switch
state device with two stable positions, which is classified into software switch and hardware switch
2.2 Abbreviations
BPCS——basic process control system
SFF——safe failure fraction
SIF——safety instrumented function
SIL——safety integrity level
SIS——safety instrumented system
3 Signal alarm system
3.1 General requirements
3.1.1 The signal alarm system may be composed of message-sending device, logic solver and human machine interface.
3.1.2 For process parameters involved in interlocking, alarm shall be set and pre-alarm should be set.
3.1.3 Alarm shall be set for hardware and software faults of safety interlock system while should be set for hardware and software faults of BPCS.
3.1.4 General signal alarm shall be displayed at the operator station. For important signal alarm, in addition to the display at the operator station, light display unit and audio unit should be arranged on the auxiliary console.
3.2 Message-sending device
3.2.1 The digital variable signal output by the message-sending device should be provided with electrical independent contact.
3.2.2 Where the message-sending device belongs to an electrical system, isolation equipment such as signal isolator and intermediate relay should be used for signal isolation before the introduction of signal into the logic solver.
3.3 Logic solver
3.3.1 Where conventional instruments are adopted for BPCS, single-loop flash alarm and/or assembled integrated flash alarm should be adopted for logic solver.
3.3.2 Where programmable electronic devices are adopted for BPCS, the logic solver should be shared with the control unit of BPCS.
3.4 Human machine interface
3.4.1 The light display unit may be designed as follows:
1 If a non-video display is used, the design of light display unit shall meet the following requirements:
1) where both the first alarm point and the general alarm point are available in the signal alarm system, the light display units should be arranged separately;
2) red light shall be used to indicate an out-of-limit alarm or abnormal state, while yellow light shall indicate a pre-alarm or non-first alarm;
3) flash light, sustained light or light-out shall be used to indicate different states of alarm sequence;
4) alarm point name, alarm degree and alarm point number shall be marked on the light display unit.
2 If a video display is used, the design of light display unit shall meet the following requirements in addition to Item 1, 3.4.1:
1) alarm information shall include the current parameter value, set value, text description and other information of the alarm;
2) light display unit should be provided on the auxiliary console for important alarm points.
Note: generally, video display refers to operator station display or large screen display, etc. and non-video light display unit refers to alarm light screen, signal lamp, etc.
3.4.2 The volume of the audio unit shall be higher than that of the background noise and can be clearly heard in the nearby area.
3.4.3 The following methods may be adopted to distinguish different alarm areas, alarm functions and alarm degrees for the audio unit:
1 using audible alarms with different sounds or tones;
2 changing the oscillation frequency or amplitude of sound.
3.4.4 The setting of push buttons, such as test button, muting button and confirmation button, shall meet the functional requirements of the alarm system.
3.4.5 If a video display is used, the functional push button should be "software button" displayed on the screen or special key on the operation keyboard.
3.4.6 The confirmation and test buttons should be in black and white respectively, and other functional push buttons should be in appropriate color according to the specific situation.
3.4.7 Where programmable electronic logic solver is adopted, a special printer for alarm information should be provided.
3.4.8 The printing of alarm information may be triggered either manually or automatically by alarm signals.
3.5 Alarm sequence
3.5.1 The alarm sequence shall be selected according to process characteristics, operation requirements and types of alarm signals.
3.5.2 The general flash alarm sequence shall meet those specified in Table 3.5.2.
Table 3.5.2 General flash alarm sequence
Process state Light display Audio Remarks
Normal Off Silent
Alarm signal input Flash Giving an audible alarm
Pressing the confirmation button Sustained light Silent
Alarm signal disappears Off Silent Operating normally
Pressing the test button On Giving an audible alarm Test and inspection
3.5.3 The flash alarm sequence for distinguishing the first signal should meet those specified in Table 3.5.3.
Table 3.5.3 Flash alarm sequence for distinguishing the first signal
Process state Light display of first signal Other light displays Audio Remarks
Normal Off Off Silent
First signal input Flash Sustained light Giving an audible alarm Other signal input
Pressing the muting button Flash Sustained light Silent
Pressing the confirmation button Sustained light Sustained light Silent
Alarm signal disappears On Off Silent Returning to normal operation
Pressing the reset button Off Off Silent
Pressing the test button On On Giving an audible alarm Test and inspection
3.5.4 The flash alarm sequence for distinguishing the instantaneous signal should meet those specified in Table 3.5.4.
Table 3.5.4 Flash alarm sequence for distinguishing the instantaneous signal
Process state Light display Audio Remarks
Normal Off Silent
Process state Light display Audio Remarks
Alarm signal input Flash Giving an audible alarm
Pressing the confirmation button Instantaneous signal Off Silent
Persistent signal Sustained light Silent
Alarm signal disappears On Silent No alarm signal input
Pressing the test button On Giving an audible alarm Test and inspection
4 Interlock system
4.1 General requirements
4.1.1 The design of interlock system shall meet the requirements of trial run and operation of chemical plants as well as commissioning, test and maintenance of interlock circuits.
Note: generally, these requirements include interlock functions such as input/release, reset and forcing.
4.1.2 The design of safety interlock system shall meet the safety requirements of SIS and the level requirements of SIF and SIL, and be verified.
4.1.3 The non-safety interlock system may be designed as electrical interlock.
4.1.4 The intermediate links shall be reduced for the design of safety interlock system.
4.1.5 The safety interlock system should be designed so as to maintain the safe state (if any) of the process until start-up or reset.
4.1.6 Where SIFs of different SILs are realized in the safety interlock system, the shared hardware and software shall meet the requirements of the higher SIL.
4.1.7 The safety interlock system should be designed as a power loss interlock. If an electrical interlock is required by SIS safety requirements, a circuit integrity testing device shall be configured, and an alarm and record of circuit integrity loss shall be provided in the system.
4.1.8 Where the safety interlock system is explosion-proof and intrinsically safe and is equipped with an isolating safety barrier, the safety barrier should not be powered by the baseplate.
Note: the baseplate refers to a multi-circuit power supply baseplate with electronic circuits.
4.1.9 When releasing, forcing, testing and maintaining the interlock, the system memory or print-out equipment shall be adopted for the safety interlock system for automatic recording, and alarm prompt shall be provided in the human machine interface.
4.1.10 In addition to introducing the logic solver, the manual emergency shutdown hardware button signal of safety interlock system should directly start the final element.
4.1.11 Redundancy equipment in the safety interlock system shall not be powered by the same busbar section.
4.1.12 Where the safety interlock system and BPCS have shared equipment related to SIF, the power supply for the equipment shall be provided by the safety interlock system.
4.1.13 Flame-retardant paired shielded cables should be adopted for the safety interlock system and set separately.
4.1.14 The cable junction box of the safety interlock system should be set separately.
4.2 Sensor
4.2.1 The sensor of the safety interlock system should be an intelligent transmitter with 4~20mA superimposed HART signal transmission, and the output signal should be provided with fault mode output.
4.2.2 When the digital variable instrument is selected for the sensor, anti-shake switch shall be selected.
4.2.3 Redundant sensors of different technologies may be adopted for the safety interlock system.
4.2.4 Where the same process parameter requires BPCS control and participates in the interlocking of safety interlock system, the sensors used by BPCS and safety interlock system to measure the parameter may be of different technologies.
4.2.5 The sensor of safety interlock system and that of BPCS should not share the same process interface.
4.3 Logic solver
4.3.1 Positive logic may be adopted for the logic design of non-safety interlock system while negative logic for that of safety interlock.
Note: positive logic refers to high level or Boolean quantity of "1" when the interlock input signal is triggered; negative logic refers to low level or Boolean quantity of "0" when the interlock input signal is triggered.
4.3.2 Where programmable electronic logic solver is adopted for safety interlock, its design, manufacture and certification shall meet the relevant requirements of the current national standard GB/T 20438 Functional safety of electrical/electronic/programmable electronic safety-related systems.
4.3.3 Safety barriers, signal isolators, etc. used for safety interlock shall be products passing functional safety certification.
4.3.4 The logic solver of the safety interlock system shall be consistent with the clock of BPCS.
4.3.5 The central processing unit, input unit, output unit, power supply unit, communication unit, etc. of the logic solver shall be independent units.
4.3.6 Signals from redundant sensors should be connected to different input units of the logic solver.
4.3.7 Control signals of the redundant final element should be connected from different output units of the logic solver.
4.3.8 The central processing unit load of the logic solver shall not exceed 50% of its rated load.
4.3.9 The internal communication load of the logic solver shall not exceed 50% of its rated load.
Foreword i
1 General provisions
2 Terms and abbreviations
2.1 Terms
2.2 Abbreviations
3 Signal alarm system
3.1 General requirements
3.2 Message-sending device
3.3 Logic solver
3.4 Human machine interface
3.5 Alarm sequence
4 Interlock system
4.1 General requirements
4.2 Sensor
4.3 Logic solver
4.4 Final element
4.5 Requirements for hardware fault tolerance of safety interlock system
4.6 Separation requirements
4.7 Operator station
4.8 Setting of equipment maintenance and test switch
4.9 Setting of interlock bypass switch
4.10 Setting of interlock reset button
4.11 Setting of emergency shutdown button
4.12 Engineering workstation and sequence event recorder
Explanation of wording in this code
List of quoted standards
