Logic Solvers For Safety Interlocks

The purpose of this work is to give an overview of the use of logic solvers for critical safety interlock systems application at the Monsanto facility.

Logic Solver is a programmable electronic or hardware system which is used to resolve process conditions to drive an output to control a final control element. Logic Solvers used in the design of an interlock system are:

a)       Programmable Electronic Systems (PES) – these include, but are not limited to general purpose programmable logic controllers (PLC), IEC 61508 compliant PLC’s and distributed control systems (DCS).

b)       Hardwired Relay Systems – This system will likely have applicability in situations where a small number of interlocks are required or the system is part of a redundant Logic Solver.

 Logic Solvers shall meet the following requirements:

 

• Approved, mature technology is required. Logic Solvers shall be redundant and separate from the Basic Process Control System (BPCS).

 

• Diverse logic solvers are required for some interlocks. A PES that meets the requirements for IEC61508 SIL 3 (Safety Integrity Level 3) is an option and should be used instead of general purpose PLC’s for one or both portions of the diverse requirement for some interlocks. The associated IEC61508 SIL 3 I/O shall be used in conjunction with the interlocking PES. A combination of an Interlock PES with a hard-wired relay system is often a cost-effective means of implementing an interlock system.

 

• A redundant Logic Solver may be implemented in a second Interlock PES. If two Interlock PES’s are used, they shall be diverse. A single, conventional Interlock PES with a backup CPU is not allowed, due to common mode error problems with common I/O, backplanes, configuration, etc. Caution is advised when using multiple Interlock PES’s, because software diversity may not be achieved due to the potential common cause fault of designing from the same logic.

 

• Loss of an analog input signal shall activate the interlock. Particular attention shall be given to those interlocks where a rising signal trips the interlock and a complete loss of signal would disable the interlock.

 

• Voting logic to trip the interlock is, at a minimum, one out of two. That is, an out of limit condition from either of the redundant sensing elements shall trip the interlock. Two out of two voting logic is not allowed. Where spurious trips are a concern, two out of three voting shall be used (two out of the three sensors must agree for the trip condition to be satisfied).

 

• The failure of any operator, engineering, or communication interface device shall not compromise the function of the interlock.

 

• The interlock shall be designed such that once it has placed the process in a safe state; it shall remain in the safe state until a reset or restart has been initiated.

 

• In the event of a power failure for de-energized to trip circuits, the PES (hardware and software) shall not prevent the outputs from reverting to a safe condition. A safe condition shall be maintained upon the restoration of power or a manual reset.

As overall results, the interlocks using logic solvers have been demonstrated very good performance, and all the interlock information are integrated and available at the operator’s displays. The configuration and tests of existing interlock system has become easier the faster, reducing plant downtimes.

References

 ANSI/ISA 84.00.01-2004, Functional Safety: Safety Instrumented Systems for the Process Industry Sector, Instrumentation, Systems, and Automation Society, NC (2004).

 IEC, IEC 61508, Functional Safety of Electrical /Electronic/Programmable Electronic Safety Related Systems, Parts 1-7, Geneva, Switzerland (1999-2001).

 IEC, IEC 61511, Functional Safety: Safety Instrumented Systems for the Process Industry Sector, Geneva, Switzerland (2003).

 Reliability Data for Safety Instrumented Systems, PDS Data Handbook, Sintef, 2006.

 Monsanto’s Guidelines for Interlocks and Alarms, April 2010.