标准编号:	HG/T 20511-2014
中文名称:	信号报警及联锁系统设计规范
英文名称:	Design code for signal alarm and interlock system engineering
行业分类:	HG    化工行业标准
发布机构:	中华人民共和国工业和信息化部
发布日期:	2014-05-06
实施日期:	2014-10-1
标准状态:	现行
替代旧标准:	HG/T 20511-2000 信号报警、安全连锁系统设计规定
翻译语言:	英文
文件格式:	PDF
中文字符数:	24000 字
翻译价格(元):	2100.00 元
交付时间:	付款后 1 个工作日

Codeofchina.com is in charge of this English translation. In case of any doubt about the English translation, the Chinese original shall be considered authoritative.



This code is revised by East China Engineering Science & Technology Co., Ltd. and other entities mobilized by the National Chemical Automatic Control Design Technique Center as entrusted by China Petroleum & Chemical Engineering Survey and Design Association, in accordance with the requirements of Notice on printing and distributing the development and revision plan of the first batch of professional standards in 2010 (GONGXINTINGKE [2010], No. 74) issued by the Ministry of Industry and Information Technology (MIIT) and Notice on forwarding the "Notice on printing and distributing the development and revision plan of the first batch of professional standards in 2010" issued by the General Office of the Ministry of Industry and Information Technology (ZHONGSHIHUALIANZHIFA [2010], No. 222) issued by China Petroleum and Chemical Industry Association.



This code replaces HG/T 20511-2000 Design code for signal alarm and safety interlock system from the implementation date hereof.



On the basis of the original professional standard HG/T 20511-2000 Design code for signal alarm and safety interlock system, Chinese experts from automatic instrument industry, as mobilized by the National Chemical Automatic Control Design Technique Center, have revised this code according to the current policy guidelines for China's national economic construction by holding several relevant meetings for discussion and review and drawing on the scientific research achievements and practical experience of chemical engineering system in signal alarm and interlock design, construction and operation in recent years, as well as the feedbacks from various entities during the trial implementation for more than 10 years.



Main technical contents of this code: the first part is about the signal alarm system, including general requirements, message-sending device, logic solver, human machine interface and alarm sequence; the second part is about the interlock system, including general requirements, sensor, logic solver, final element, requirements for hardware fault tolerance of safety interlock system, separation requirements, operator station, etc.



The following main changes have been made with respect to HG/T 20511-2000:



1. the clause “terms and abbreviations” is added;



2. the original clauses of "light display unit", "audio unit", "push button" and "alarm realized by DCS/PLC" in the signal alarm system are merged into "human machine interface";



3. the "auxiliary output” is deleted;



4. during the design, the interlock system is divided into safety interlock system and non-safety interlock system;



5. the clauses such as "requirements for fault tolerance of safety interlock system" are added for interlock system.



This code was proposed by and is under the jurisdiction of China Petroleum and Chemical Industry Association.



East China Engineering Science & Technology Co., Ltd. is responsible for the explanation of the technical contents of this code. In case of any opinion and suggestion in the process of implementing this code, please contact East China Engineering Science & Technology Co., Ltd. (address: No. 70 Wangjiang East Road, Hefei, Anhui; postal code: 230024; E-mail: xujirong@chinaecec.com) for reference in future revision.





Design code for signal alarm and interlock system engineering



1 General provisions



1.0.1 This code is formulated in order to unify the technical requirements for signal alarm and interlock system engineering design in the chemical industry, promote the standardization of signal alarm and interlock system engineering design, and achieve the purposes of safety, applicability, technology advancement and economic rationality.



1.0.2 This code is applicable to the signal alarm and interlock system engineering design for constructed, expanded and renovated chemical plants.



1.0.3 In addition to this code, the signal alarm and interlock system engineering design shall also meet the requirements of the relevant current national standards.



2 Terms and abbreviations



2.1 Terms



2.1.1 basic process control system



system that responds to the input signals from process as well as equipment related to the system and operators, and generates output signals to enable the process and equipment related to the system to operate in a required manner; it shall not perform the safety instrumented function with a safety integrity level higher than or equal to 1



2.1.2 digital variable



a variable having two values only, which is used to indicate the state of a thing or event



2.1.3 diagnostic coverage



ratio of failure rate to total failure rate of components or subsystems under the coverage of diagnostic test, excluding any faults detected during the inspection test



2.1.4 fault tolerance



capability of a functional unit of continuing to perform the specified functions in case of a fault or error



2.1.5 logic solver



equipment that performs one or more logic functions, which may be either a part of the basic process control system or a part of the safety instrumented system



2.1.6 final element



equipment such as valve and motor, which performs the preset action to make the process reach the preset state; it is an integral part of the interlock system



2.1.7 human machine interface



means of information exchange between the operator and the signal alarm and interlock system, such as operator station, light screen, audio, push button, alarm, printer, etc.



2.1.8 interlock system



system implementing the preset requirements in case that the process parameters exceed the limit, the state of equipment etc. are abnormal and the operator inputs signals; it is divided into safety interlock system and non-safety interlock system, and may be composed of sensor and/or message-sending device, logic solver, final element and related software



2.1.9 message-sending device



equipment outputting the digital variable signal



2.1.10 push button



state device with only one stable position, which is classified into software button and hardware button



2.1.11 redundancy



the configuration that two or more components or systems are used to independently perform the same function, and are mutually standby and switched to each other



2.1.12 signal alarm system



system that indicates the process parameters exceeding limits and abnormal states of equipment in the form of sound, light, etc.



2.1.13 failure



termination of the capability of a functional unit



2.1.14 safe failure



failure which impossibly brings the safety instrumented system into potential danger or loss of function



2.1.15 safe failure fraction



total random failure rate fraction of the hardware of the device causing safe failure or detectable dangerous failure



2.1.16 safety interlock system



safety instrumented system with safety integrity level of 1, 2 or 3



2.1.17 safety instrumented function



instrument safety protection function realized by one or more sensors, logic solvers, final elements, etc. to prevent or reduce the occurrence of dangerous events or maintain the safe state of the process



2.1.18 safety integrity level



discrete level (SIL 1~SIL 4) used to specify the safety integrity requirements of instrument safety function assigned to safety instrumented system, wherein, SIL 4 is the highest safety integrity level while SIL 1 is the lowest



2.1.19 safety instrumented system



instrumented system for realizing one or several safety instrumented functions, which may be composed of sensor, logic solver, final element and related software



2.1.20 switch



state device with two stable positions, which is classified into software switch and hardware switch



2.2 Abbreviations



BPCS——basic process control system



SFF——safe failure fraction



SIF——safety instrumented function



SIL——safety integrity level



SIS——safety instrumented system



3 Signal alarm system



3.1 General requirements



3.1.1 The signal alarm system may be composed of message-sending device, logic solver and human machine interface.



3.1.2 For process parameters involved in interlocking, alarm shall be set and pre-alarm should be set.



3.1.3 Alarm shall be set for hardware and software faults of safety interlock system while should be set for hardware and software faults of BPCS.



3.1.4 General signal alarm shall be displayed at the operator station. For important signal alarm, in addition to the display at the operator station, light display unit and audio unit should be arranged on the auxiliary console.



3.2 Message-sending device



3.2.1 The digital variable signal output by the message-sending device should be provided with electrical independent contact.



3.2.2 Where the message-sending device belongs to an electrical system, isolation equipment such as signal isolator and intermediate relay should be used for signal isolation before the introduction of signal into the logic solver.



3.3 Logic solver



3.3.1 Where conventional instruments are adopted for BPCS, single-loop flash alarm and/or assembled integrated flash alarm should be adopted for logic solver.



3.3.2 Where programmable electronic devices are adopted for BPCS, the logic solver should be shared with the control unit of BPCS.



3.4 Human machine interface



3.4.1 The light display unit may be designed as follows:



1 If a non-video display is used, the design of light display unit shall meet the following requirements:



1) where both the first alarm point and the general alarm point are available in the signal alarm system, the light display units should be arranged separately;



2) red light shall be used to indicate an out-of-limit alarm or abnormal state, while yellow light shall indicate a pre-alarm or non-first alarm;



3) flash light, sustained light or light-out shall be used to indicate different states of alarm sequence;



4) alarm point name, alarm degree and alarm point number shall be marked on the light display unit.



2 If a video display is used, the design of light display unit shall meet the following requirements in addition to Item 1, 3.4.1:



1) alarm information shall include the current parameter value, set value, text description and other information of the alarm;



2) light display unit should be provided on the auxiliary console for important alarm points.



Note: generally, video display refers to operator station display or large screen display, etc. and non-video light display unit refers to alarm light screen, signal lamp, etc.



3.4.2 The volume of the audio unit shall be higher than that of the background noise and can be clearly heard in the nearby area.



3.4.3 The following methods may be adopted to distinguish different alarm areas, alarm functions and alarm degrees for the audio unit:



1 using audible alarms with different sounds or tones;



2 changing the oscillation frequency or amplitude of sound.



3.4.4 The setting of push buttons, such as test button, muting button and confirmation button, shall meet the functional requirements of the alarm system.



3.4.5 If a video display is used, the functional push button should be "software button" displayed on the screen or special key on the operation keyboard.



3.4.6 The confirmation and test buttons should be in black and white respectively, and other functional push buttons should be in appropriate color according to the specific situation.



3.4.7 Where programmable electronic logic solver is adopted, a special printer for alarm information should be provided.



3.4.8 The printing of alarm information may be triggered either manually or automatically by alarm signals.



3.5 Alarm sequence



3.5.1 The alarm sequence shall be selected according to process characteristics, operation requirements and types of alarm signals.



3.5.2 The general flash alarm sequence shall meet those specified in Table 3.5.2.



Table 3.5.2 General flash alarm sequence

Process state Light display Audio Remarks

Normal Off Silent

Alarm signal input Flash Giving an audible alarm

Pressing the confirmation button Sustained light Silent

Alarm signal disappears Off Silent Operating normally

Pressing the test button On Giving an audible alarm Test and inspection



3.5.3 The flash alarm sequence for distinguishing the first signal should meet those specified in Table 3.5.3.



Table 3.5.3 Flash alarm sequence for distinguishing the first signal

Process state Light display of first signal Other light displays Audio Remarks

Normal Off Off Silent

First signal input Flash Sustained light Giving an audible alarm Other signal input

Pressing the muting button Flash Sustained light Silent

Pressing the confirmation button Sustained light Sustained light Silent

Alarm signal disappears On Off Silent Returning to normal operation

Pressing the reset button Off Off Silent

Pressing the test button On On Giving an audible alarm Test and inspection



3.5.4 The flash alarm sequence for distinguishing the instantaneous signal should meet those specified in Table 3.5.4.



Table 3.5.4 Flash alarm sequence for distinguishing the instantaneous signal

Process state Light display Audio Remarks

Normal Off Silent

Process state Light display Audio Remarks

Alarm signal input Flash Giving an audible alarm

Pressing the confirmation button Instantaneous signal Off Silent

Persistent signal Sustained light Silent

Alarm signal disappears On Silent No alarm signal input

Pressing the test button On Giving an audible alarm Test and inspection



4 Interlock system



4.1 General requirements



4.1.1 The design of interlock system shall meet the requirements of trial run and operation of chemical plants as well as commissioning, test and maintenance of interlock circuits.



Note: generally, these requirements include interlock functions such as input/release, reset and forcing.



4.1.2 The design of safety interlock system shall meet the safety requirements of SIS and the level requirements of SIF and SIL, and be verified.



4.1.3 The non-safety interlock system may be designed as electrical interlock.



4.1.4 The intermediate links shall be reduced for the design of safety interlock system.



4.1.5 The safety interlock system should be designed so as to maintain the safe state (if any) of the process until start-up or reset.



4.1.6 Where SIFs of different SILs are realized in the safety interlock system, the shared hardware and software shall meet the requirements of the higher SIL.



4.1.7 The safety interlock system should be designed as a power loss interlock. If an electrical interlock is required by SIS safety requirements, a circuit integrity testing device shall be configured, and an alarm and record of circuit integrity loss shall be provided in the system.



4.1.8 Where the safety interlock system is explosion-proof and intrinsically safe and is equipped with an isolating safety barrier, the safety barrier should not be powered by the baseplate.



Note: the baseplate refers to a multi-circuit power supply baseplate with electronic circuits.



4.1.9 When releasing, forcing, testing and maintaining the interlock, the system memory or print-out equipment shall be adopted for the safety interlock system for automatic recording, and alarm prompt shall be provided in the human machine interface.



4.1.10 In addition to introducing the logic solver, the manual emergency shutdown hardware button signal of safety interlock system should directly start the final element.



4.1.11 Redundancy equipment in the safety interlock system shall not be powered by the same busbar section.



4.1.12 Where the safety interlock system and BPCS have shared equipment related to SIF, the power supply for the equipment shall be provided by the safety interlock system.



4.1.13 Flame-retardant paired shielded cables should be adopted for the safety interlock system and set separately.



4.1.14 The cable junction box of the safety interlock system should be set separately.



4.2 Sensor



4.2.1 The sensor of the safety interlock system should be an intelligent transmitter with 4~20mA superimposed HART signal transmission, and the output signal should be provided with fault mode output.



4.2.2 When the digital variable instrument is selected for the sensor, anti-shake switch shall be selected.



4.2.3 Redundant sensors of different technologies may be adopted for the safety interlock system.



4.2.4 Where the same process parameter requires BPCS control and participates in the interlocking of safety interlock system, the sensors used by BPCS and safety interlock system to measure the parameter may be of different technologies.



4.2.5 The sensor of safety interlock system and that of BPCS should not share the same process interface.



4.3 Logic solver



4.3.1 Positive logic may be adopted for the logic design of non-safety interlock system while negative logic for that of safety interlock.



Note: positive logic refers to high level or Boolean quantity of "1" when the interlock input signal is triggered; negative logic refers to low level or Boolean quantity of "0" when the interlock input signal is triggered.



4.3.2 Where programmable electronic logic solver is adopted for safety interlock, its design, manufacture and certification shall meet the relevant requirements of the current national standard GB/T 20438 Functional safety of electrical/electronic/programmable electronic safety-related systems.



4.3.3 Safety barriers, signal isolators, etc. used for safety interlock shall be products passing functional safety certification.



4.3.4 The logic solver of the safety interlock system shall be consistent with the clock of BPCS.



4.3.5 The central processing unit, input unit, output unit, power supply unit, communication unit, etc. of the logic solver shall be independent units.



4.3.6 Signals from redundant sensors should be connected to different input units of the logic solver.



4.3.7 Control signals of the redundant final element should be connected from different output units of the logic solver.



4.3.8 The central processing unit load of the logic solver shall not exceed 50% of its rated load.



4.3.9 The internal communication load of the logic solver shall not exceed 50% of its rated load.

Foreword i
1 General provisions
2 Terms and abbreviations
2.1 Terms
2.2 Abbreviations
3 Signal alarm system
3.1 General requirements
3.2 Message-sending device
3.3 Logic solver
3.4 Human machine interface
3.5 Alarm sequence
4 Interlock system
4.1 General requirements
4.2 Sensor
4.3 Logic solver
4.4 Final element
4.5 Requirements for hardware fault tolerance of safety interlock system
4.6 Separation requirements
4.7 Operator station
4.8 Setting of equipment maintenance and test switch
4.9 Setting of interlock bypass switch
4.10 Setting of interlock reset button
4.11 Setting of emergency shutdown button
4.12 Engineering workstation and sequence event recorder
Explanation of wording in this code
List of quoted standards

备案号：J 1808—2014
中华人民共和国化工行业标准
HG/T 20511—2014
代替HG/T 20511—2000
信号报警及联锁系统设计规范
Design code for signal alarm and interlock system engineering
2014-05-06发布 2014-10-01实施
中华人民共和国工业和信息化部 发布
中华人民共和国化工行业标准
信号报警及联锁系统设计规范
Design code for signal alarm and interlock system engineering
HG/T 20511—2014
主编单位：东华工程科技股份有限公司
批准部门：中华人民共和国工业和信息化部
实施日期：2014年10月1日
前言
本规范根据工业和信息化部《关于印发2010年第一批行业标准制修订计划的通知》(工信厅科[2010]74号文)和中国石油和化学工业联合会《关于转发工业和信息化部办公厅<关于印发2010年第一批行业标准制修订计划的通知>的通知》(中石化联质发[2010]222号文)的要求，由中国石油和化工勘察设计协会委托全国化工自动控制设计技术中心站组织东华工程科技股份有限公司等单位修订。
本规范自实施之日起代替《信号报警、安全联锁系统设计规定》HG/T 20511—2000。
本规范在原行业标准《信号报警、安全联锁系统设计规定》HG/T 20511—2000的基础上，由全国化工自动控制设计技术中心站组织我国自动化仪表行业专家，多次召开相关会议研讨、审查，并根据当前我国国民经济建设的政策方针，吸取近年化工系统在信号报警和联锁设计、施工和运行等方面的科研成果和实践经验，以及试行10多年来各单位的反馈意见进行修订。
本规范的主要技术内容：第1部分为信号报警系统，包括一般要求、发讯器、逻辑控制器、人机接口和报警顺序；第2部分为联锁系统，包括一般要求、传感器、逻辑控制器、最终元件、安全联锁系统硬件故障裕度要求、独立性要求、操作员站等。
本规范与HG/T 20511—2000相比，主要变化如下：
1.增加了“术语和缩略语”章节；
2.将原规定的信号报警系统中的“灯光显示单元”、“音响单元”、“按钮”、“用DCS/PLC实现的报警”章节归并为“人机接口”；
3.删除“辅助输出”；
4.将联锁系统的设计分为安全联锁系统和非安全联锁系统两种类型进行要求；
5.增加联锁系统的“安全联锁系统的故障裕度要求”等章节内容。
本规范由中国石油和化学工业联合会提出并归口。
本规范的技术内容由东华工程科技股份有限公司负责解释。本规范在执行过程中如有意见和建议，请与东华工程科技股份有限公司联系(联系地址：安徽省合肥市望江东路70号，邮政编码：230024，电子邮箱：xujirong@chinaecec.com)，以供今后修订时参考。
本规范主编单位、参编单位、主要起草人和主要审查人：
主编单位：东华工程科技股份有限公司
参编单位：北京康吉森自动化设备技术有限责任公司
惠生工程(中国)有限公司
主要起草人：徐继荣 马恒平 高生军 何蓉 王明玉
主要审查人：孙建文 于锋 高欣 王颖 赵柱 周一鸣
张同科 王秋红 董萍 吴天一 周江萍
1 总 则
1.0.1 为了统一信号报警及联锁系统工程设计在化工行业的技术要求，推进信号报警及联锁系统工程设计的规范化，达到安全适用、技术先进、经济合理的目的，制订本规范。
1.0.2本规范适用于化工装置新建、扩建及改建项目信号报警及联锁系统的工程设计。
1.0.3信号报警及联锁系统的工程设计除应符合本规范要求外，尚应符合现行国家有关标准的规定。
2术语和缩略语
2.1 术 语
2.1.1基本过程控制系统basic process control system
对来自过程的、与该系统相关设备的以及操作员的输入信号进行响应，并产生输出信号使过程及与该系统相关设备按要求方式运行的系统。该系统不应执行安全完整性等级大于或等于1的仪表安全功能。
2.1.2 开关量digital variable
开关量是只有两个数值的变量，用来表示事物或事件的状态。也称为“数字变量”。
2.1.3诊断覆盖率diagnostic coverage
诊断测试检测的部件或子系统的失效率与总失效率之比。诊断覆盖率不包括由检验测试检测到的任何故障。
2.1.4 故障裕度 fault tolerance
在出现故障或误差时，功能单元继续执行要求功能的能力。
2.1.5逻辑控制器logic solver
本规范逻辑控制器是指执行一个或多个逻辑功能的设备，它既可以是一个基本过程控制系统的一部分，也可以是安全仪表系统的一部分。
2.1.6最终元件final element
本规范最终元件是指执行预先设定的动作，使过程达到预定状态的设备，如阀门、电机等，它是联锁系统的组成部分。
2.1.7人机接口human machine interface
本规范人机接口是指操作人员与信号报警联锁系统之间进行信息交换的手段，如操作员站、灯屏、音响、按钮、报警器、打印机等。
2.1.8联锁系统interlock system
当过程参数越限、设备等状态异常以及操作员输入信号时，执行预先设定要求的系统。联锁系统分为安全联锁系统和非安全联锁系统。联锁系统可由传感器和/或发讯器、逻辑控制器、最终元件及相关软件组成。
2.1.9 发讯器 message-sending device
输出开关量信号的设备
2.1.10按钮push button
按钮是只有一种稳定位置的状态器件。有软件按钮和硬件按钮两种。
2.1.11 冗余redundancy
采用二个或多个部件或系统分别独立执行同一个功能，并且互为备用及切换。
2.1.12信号报警系统signal alarm system
以声、光等形式表示过程参数越限、设备等状态异常的系统。
2.1.13失效failure
功能单元执行某种功能能力的终止。
2.1.14安全失效safe failure
不可能导致安全仪表系统处于潜在危险状态或丧失功能的失效。
2.1.15安全失效分数safe failure fraction
导致安全失效或者可检测出的危险失效的装置总硬件随机失效率分数。
2.1.16安全联锁系统safety interlock system
安全完整性等级为1、2、3的安全仪表系统。
2.1.17仪表安全功能safety instrumented function
本规范仪表安全功能是指用一个或多个传感器、逻辑控制器、最终元件等实现的仪表安全保护功能，防止或减少危险事件发生或保持过程安全状态。
2.1.18安全完整性等级safety integrity level
用于规定分配给安全仪表系统的仪表安全功能的的安全完整性要求的离散量等级(SIL 1～SIL 4)。SIL 4是安全完整性最高等级；SIL 1是安全完整性最低等级。
2.1.19安全仪表系统safety instrumented system
用于实现一个或几个仪表安全功能的仪表系统。安全仪表系统可由传感器、逻辑控制器、最终元件及相关软件组成。
2.1.20开关switch
开关是具有两种稳定位置的状态器件。有软件开关和硬件开关两种。
2.2缩略语
BPCS——basic process control system(基本过程控制系统)
SFF——safe failure fraction(安全失效分数)
SIF——safety instrumented function(仪表安全功能)
SIL——safety integrity level(安全完整性等级)
SIS——safety instrumented system(安全仪表系统)
3信号报警系统
3.1一般要求
3.1.1信号报警系统可由发讯器、逻辑控制器、人机接口组成。
3.1.2参与联锁的过程参数应设报警，宜设预报警。
3.1.3安全联锁系统的硬件和软件故障应设报警；BPCS的硬件和软件故障宜设报警。
3.1.4一般信号报警应在操作员站显示，重要信号报警除在操作员站显示外，宜在辅助操作台上设灯光显示单元和音响单元。
3.2发讯器
3.2.1发讯器输出的开关量信号宜为无源接点。
3.2.2发讯器属于电气系统时，在信号引入逻辑控制器前宜采用信号隔离器、中间继电器等隔离设备进行信号隔离。
3.3逻辑控制器
3.3.1 当BPCS采用常规仪表时，逻辑控制器宜采用单回路闪光报警器和/或拼装集成式闪光报警器。
3.3.2 当BPCS采用可编程电子装置时，逻辑控制器宜与BPCS的控制单元共用。
3.4人机接口
3.4.1 灯光显示单元的设计可分为下列两种情况：
1 当采用非视屏显示器时，灯光显示单元的设计应满足下列要求：
1)当信号报警系统中既有第一报警点又有一般报警点时，其灯光显示单元宜分开排列；
2)应用红色灯光表示越限报警或异常状态，黄色灯光表示预报警或非第一报警；
3)应用闪光、平光或熄灭表示报警顺序的不同状态；
4)应在灯光显示单元上标注报警点名称、报警程度和报警点位号。
2 当采用视屏显示器时，灯光显示单元的设计除满足本规范第3.4.1条第l款外，还应满足下列要求：
1)报警信息应包括报警参数当前值、报警设定值、文字描述及其他信息；
2)对于重要报警点，宜在辅助操作台上设置灯光显示单元。
注：视频显示器通常指操作员站显示器或大屏幕显示器等；非视频灯光显示单元通常指报警器灯屏、信号灯等。
3.4.2音响单元的音量应高于背景噪声，在其附近区域应能清晰地听见。
3.4.3 音响单元可采用以下方式区分不同的报警区域、报警功能以及报警程度：
1采用不同声音或音调的音响报警器；
2通过改变声音振荡频率或振荡幅度。
3.4.4按钮的设置应满足报警系统的功能需要，如试验按钮、消音按钮、确认按钮等。
3.4.5 当采用视屏显示器时，功能按钮宜采用显示于屏幕的“软件按钮”，也可采用操作键盘上的专用按键。
3.4.6确认按钮宜采用黑色，试验按钮宜采用白色，其他功能按钮可根据具体情况采用合适的颜色。
3.4.7当逻辑控制器采用可编程电子装置时，宜设置报警信息专用打印机。
3.4.8报警信息的打印可手动触发，也可由报警信号自动触发。
3.5 报警顺序
3.5.1 应根据过程特点、操作要求及报警信号种类等选择报警顺序。
3.5.2一般闪光报警顺序宜符合表3.5.2的规定。
表3.5.2一般闪光报警顺序
过程状态 灯光显示 音响 备注
正常 不亮 不响
报警信号输入 闪光 响
按动确认按钮 平光 不响
报警信号消失 不亮 不响 运行正常
按动试验按钮 亮 响 试验、检查

3.5.3 区别第一信号的闪光报警顺序宜符合表3.5.3的规定。
表3.5.3 区别第一信号的闪光报警顺序
过程状态 第一信号灯光显示 其他闪光显示 音响 备注
正常 不亮 不亮 不响
第一信号输入 闪光 平光 响 有其他信号输入
按动消音按钮 闪光 平光 不响
按动确认按钮 平光 平光 不响
报警信号消失 亮 不亮 不响 运行恢复正常
按动复位按钮 不亮 不亮 不响
按动试验按钮 亮 亮 响 试验、检查

3.5.4 区别瞬时信号的闪光报警顺序宜符合表3.5.4的规定。
表3.5.4 区别瞬时信号的闪光报警顺序
过程状态 灯光显示 音响 备注
正常 不亮 不响
过程状态 灯光显示 音响 备注
报警信号输入 闪光 响
按动确认按钮 瞬时信号 不亮 不响
持续信号 平光 不响
报警信号消失 亮 不响 无报警信号输入
按动试验按钮 亮 响 试验、检查

4 联锁系统
4.1一般要求
4.1.1联锁系统的设计应满足化工装置的试车、运行和联锁回路的调试、测试和维护等要求。
注：这些要求通常包括联锁的投入/解除、复位、强制等功能。
4.1.2安全联锁系统的设计应满足SIS的安全要求规定。安全联锁系统的设计应满足SIF和SIL等级要求，并加以验证。
4.1.3非安全联锁系统可设计为带电联锁。
4.1.4安全联锁系统的设计应减少中间环节。
4.1.5安全联锁系统宜设计成只要把过程置于某个安全状态，则该状态将一直保持到启动复位为止。
4.1.6在安全联锁系统中实现不同SIL等级的SIF时，共享或共用的硬件和软件应符合较高SIL等级的要求。
4.1.7安全联锁系统宜设计成失电联锁，如SIS的安全要求规定要求设计为带电联锁，则应配置电路完整性检测装置，并在系统内设置电路完整性丧失的报警和记录。
4.1.8 当安全联锁系统为本安系统防爆，并采用隔离型安全栅时，安全栅不宜采用底板供电方式。
注：底板是指带有电子电路的多路供电底板。
4.1.9安全联锁系统在进行联锁解除、强制、测试、维护时，应采用系统存储器或打印输出设备进行自动记录，并在人机接口应有报警提示。
4.1.10安全联锁系统的手动紧急停车硬件按钮信号，除引入逻辑控制器外，宜直接启动最终元件。
4.1.11安全联锁系统中的冗余设备不宜采用同段母线供电。
4.1.12 当安全联锁系统和BPCS存在与SIF有关的共用设备时，该设备的供电电源应由安全联锁系统提供。
4.1.13安全联锁系统的电缆宜采用阻燃型对绞屏蔽电缆，并独立设置。
4.1.14安全联锁系统的电缆接线箱宜独立设置。
4.2 传 感 器
4.2.1安全联锁系统的传感器宜采用4mA～20mA叠加HART信号传输的智能变送器，输出信号宜带故障模式输出。
4.2.2当传感器选择开关量仪表时，开关应选择防抖动型开关。
4.2.3 当安全联锁系统采用冗余的传感器时，传感器可采用不同技术的产品。
4.2.4当同一过程参数既需要BPCS的控制，又参与安全联锁系统的联锁时，则BPCS和安全联锁系统用于测量该参数的传感器可采用不同技术的产品。
4.2.5 安全联锁系统与BPCS的传感器不宜共用同一过程接口。
4.3逻辑控制器
4.3.1非安全联锁系统的逻辑设计可采用正逻辑，对于安全联锁的逻辑设计可采用负逻辑。
注：正逻辑是指联锁输入信号触发时为高电平或布尔量为“1”；负逻辑是指联锁输入信号触发时为低电平或布尔量为“0”。
4.3.2 当用于安全联锁的逻辑控制器采用可编程电子装置时，其设计、制造、认证等应符合现行国家标准《电气/电子/可编程电子安全相关系统的功能安全》GB/T 20438的有关要求。
4.3.3用于安全联锁的安全栅、信号隔离器等应使用获得功能安全认证的产品。
4.3.4安全联锁系统的逻辑控制器应与BPCS的时钟保持一致。
4.3.5 逻辑控制器的中央处理单元、输入单元、输出单元、电源单元、通信单元等应为独立的单元。
4.3.6冗余传感器的信号宜接入逻辑控制器的不同输入单元。
4.3.7冗余最终元件的控制信号宜接自逻辑控制器的不同输出单元。
4.3.8逻辑控制器的中央处理单元负荷不应超过其额定负荷的50％。
4.3.9 逻辑控制器的内部通信负荷不应超过其额定负荷的50％。
4.4 最终元件
4.4.1 最终元件宜带有联锁动作的反馈输出。
注：对于控制阀，反馈输出为阀门的联锁位置；对于电机，反馈输出为电机的联锁状态。
4.4.2 当安全联锁系统与BPCS控制同一台阀门时，设计应保证安全联锁系统要求阀门的动作优先BPCS的要求。
4.4.3 当安全联锁系统的最终元件为阀门时，阀门宜采用气动执行机构。
4.5 安全联锁系统硬件故障裕度要求
4.5.1 当传感器、最终元件和非可编程电子逻辑控制器为故障安全型时，最低硬件故障裕度应满足表4.5.1中的要求，否则表4.5.1中的最低硬件故障裕度应加1。
表4.5.1 传感器、最终元件和非可编程电子逻辑控制器的结构约束
SIL 最低硬件故障裕度 SIL 最低硬件故障裕度 SIL 最低硬件故障裕度
1 0 2 1 3 2

4.5.2可编程电子逻辑控制器的最低硬件故障裕度应满足表4.5.2中的要求。
表4.5.2可编程电子逻辑控制器的结构约束
SIL 最低硬件故障裕度
SFF<60％ 60％≤SFF≤90% SFF>90％
1 1 0 0
2 2 1 0
3 3 2 1

4.5.3安全联锁系统的子系统的最低硬件故障裕度大于或等于1时，当检测到硬件危险故障时，应报警，并记录，同时应执行与故障硬件相关的安全联锁动作或者在故障平均恢复时间内不能完成恢复，则执行与故障硬件相关的安全联锁动作。
4.5.4安全联锁系统的子系统的最低硬件故障裕度为0时，当检测到硬件危险故障时，应报警，并记录，同时应执行与故障硬件相关的安全联锁动作。
4.6独立性要求
4.6.1 安全联锁系统与BPCS之间应保持独立性，当它们之间存在共享设备时，应满足下列要求：
1 BPCS的失效不应危及安全联锁系统的功能安全；
2安全联锁系统的失效不宜导致BPCS失效；
3对BPCS的任何操作不应对安全联锁系统产生任何危害。
4.6.2 当同一过程变量既需要BPCS的控制，又用于安全联锁系统的联锁时，用于检测该变量的传感器宜独立设置。
4.6.3 当BPCS的控制和安全联锁系统的保护由同一过程变量控制时，则控制阀不宜共用。
4.7 操作员站
4.7.1 BPCS与安全联锁系统共用操作员站时，操作员站的失效不应对仪表安全功能产生任何负面影响。
4.7.2操作员站设置的开关和按钮应满足下列要求：
1应加键锁或口令保护；
2开关、按钮的动作应记录，并具有二次确认的操作；
3开关状态应显示，并记录。
4.7.3对于重要的联锁单元，操作员站应提供联锁逻辑回路画面，画面包括输入输出状态、逻辑关系、联锁旁路和设备维护状态、诊断结果等的显示、报警。
4.8设备维护、测试开关的设置
4.8.1设备维护、测试开关可采用下列方式设置：
1对于安全联锁系统，可在安全联锁系统的操作员站设置软件开关，或在BPCS的操作员站设置软件开关，开关的状态信号可采用通信方式与安全联锁系统连接；
2对于非安全联锁系统，可在BPCS的操作员站设置软件开关；
3可在机柜设置硬件开关。
4.8.2 当设置了设备维护开关时，每个联锁单元宜在辅助操作台上设“允许”开关，在“允许”条件下，维护开关才有效，“允许”开关宜采用红色带钥匙开关。
4.8.3 当设置了设备测试开关时，应在现场设置设“允许”开关，在“允许”条件下，测试开关才有效。
4.8.4设备处于维护状态所用的时间应在操作员站上显示。
4.8.5 当设备维护开关为硬件开关时，应设置维护状态反馈黄色硬件指示灯。
4.8.6 维护、测试状态和“允许”状态应在操作员站显示，并记录。
4.8.7 维护、测试开关动作和“允许”开关动作应在操作员站记录。
4.8.8维护开关宜采用黄色开关，测试开关宜采用红色开关。
4.9联锁旁路开关的设置
4.9.1联锁旁路开关可采用下列方式设置：
1对于安全联锁系统，可在安全联锁系统的操作员站设置软件开关，或在BPCS的操作员站设置软件开关，开关的状态信号可采用通信方式与安全联锁系统连接；
2 对于非安全联锁系统，可在BPCS的操作员站设置软件开关；
3 可在辅助操作台设置硬件开关，开关宜采用黄色带钥匙开关。
4.9.2 当工艺过程变量从原始自然值变化到工艺条件正常数值，联锁信号状态发生改变的，宜设置联锁旁路开关。
4.9.3联锁旁路开关状态应在操作员站显示，并记录。
4.9.4联锁旁路开关动作应在操作员站记录。
4.10联锁复位按钮的设置
4.10.1 联锁复位按钮可采用下列方式设置：
1对于安全联锁系统，可在安全联锁系统的操作员站设置软件按钮，或在BPCS的操作员站设置软件按钮，开关的状态信号可采用通信方式与安全联锁系统连接；
2对于非安全联锁系统，可在BPCS的操作员站设置软件按钮；
3可在辅助操作台设置硬件按钮。
4.10.2联锁复位状态应在操作员站显示，并记录。
4.10.3联锁复位按钮动作应在操作员站记录。
4.10.4联锁复位按钮宜采用灰色按钮。
4.11 紧急停车按钮的设置
4.11.1非安全联锁系统的紧急停车按钮可在BPCS操作员站上设置软件按钮实现，安全联锁系统的紧急停车按钮应在辅助操作台上设置硬件按钮实现。
4.11.2在辅助操作台设置的硬件按钮应引入联锁系统的逻辑控制器，并在系统内设置状态报警并t己录。
4.11.3紧急停车按钮不应设维护开关。
4.11.4 紧急停车按钮应采用红色蘑菇头按钮，并带防护罩。
4.12工程师站及事件顺序记录站
4.12.1安全联锁系统应设工程师站。
4.12.2工程师站应设不同级别的权限密码保护。工程师站应显示安全联锁系统动作和诊断状态。
4.12.3安全联锁系统应设事件顺序记录站。当安全联锁系统设置了独立的操作员站时，事件顺序记录站宜与操作员站共用。当安全联锁系统没有设置独立的操作员站时，事件顺序记录站可与安全联锁系统的工程师站共用，也可单独设置。
4.12.4事件顺序记录站记录每个事件的时间、日期、标识、状态等。事件顺序记录站应设密码保护。
4.12.5 工程师站和事件顺序记录站宜设置防病毒等保护措施。
4.12.6工程师站和事件顺序记录站宜采用台式计算机。
本规范用词说明
1 为便于在执行本标准条文时区别对待，对要求严格程度不同的用词说明如下：
1)表示很严格，非这样做不可的用词：
正面词采用“必须”，反面词采用“严禁”。
2)表示严格，在正常情况下均应这样做的用词：
正面词采用“应”，反面词采用“不应”或“不得”。
3)表示允许稍有选择，在条件许可时首先应这样做的用词：
正面词采用“宜”，反面词采用“不宜”；
4)表示有选择，在一定条件下可以这样做的用词，采用“可”。
2条文中指明应按其他有关标准执行的写法为“应符合……的规定”或“应按……执行”。
引用标准名录
《电气/电子/可编程电子安全相关系统的功能安全》GB/T 20438
《过程工业领域安全仪表系统的功能安全》GB/T 21109—2007