Safety instrument system with diagnosis function

Abstract

The invention discloses a safety instrument system with a diagnosis function, which belongs to the application of an automatic instrument system in the process industry and comprises a logic controller, a relay, a two-position three-way electromagnetic valve, a two-position five-way electromagnetic valve, a two-position three-way pneumatic control valve, a pneumatic actuating mechanism, an electric valve positioner, a filtering pressure reducing valve and a silencer, the gas path system and the circuit system are composed of the components, and the problems of two-out-of-three gas inlet and two-out-of-three gas exhaust of a gas path are solved structurally; unification of two-out-of-three of an electric signal loop and two-out-of-three of a gas circuit can be achieved only through three electromagnetic valves, it is guaranteed that only two or more electromagnetic valves are powered off, the cut-off valve can conduct interlocking action, and the fault failure probability of the system is reduced while it is guaranteed that the device jumps safely; in addition, a partial stroke testing function is adopted, the cut-off valve can be diagnosed on line, and the failure probability that the cut-off valve and an executing mechanism cannot be detected is further reduced.

Description

Technical Field

[0001] The present invention belongs to the field of application of automation instrument systems in the process industry, and specifically relates to a safety instrument system with a diagnostic function. Background Art

[0002] Factory production is often accompanied by safety risks, and when it comes to some high-risk industrial fields, the slightest carelessness may lead to casualties, economic losses, and environmental pollution. In particular, the chemical / petrochemical industry often involves toxic, flammable, and explosive process media, which poses even higher safety risks. As the country strengthens its safety management of enterprises, safety instrument systems are increasingly used in the industrial field.

[0003] The safety instrument system includes sensors, logic controllers, and final actuators, and is divided into high-demand mode and low-demand mode, with safety levels ranging from SIL1 to SIL4. During normal production, the safety instrument system is in a silent state. When the production equipment reaches a dangerous operating condition, the logic controller performs logical judgment based on the received sensor signals and sends a trip signal to the actuator, putting the production equipment in a safe state or stopping the state. In an emergency, the trip signal can even be manually sent to the actuator to stop the production equipment.

[0004] However, safety instrument systems can fail to trip due to faults. Failure to trip a safety interlock can cause casualties and property damage. Similarly, safety instrument systems can trip erroneously. For many large chemical projects, restarting after a trip often requires significant investment. Therefore, erroneous trips can also result in significant economic losses.

[0005] For most working conditions, the SIF loop of the safety instrument system is in low-requirement mode, and a safety integrity level of SIL1 can meet the production requirements of the enterprise. However, for a safety instrument system in low-requirement mode with a safety integrity level of SIL2, if a solenoid valve is used to drive the shut-off valve, the solenoid valve and the relay connected to it may fail, causing refusal to operate or malfunction. It is difficult for a single shut-off valve to pass the SIL2 level verification. If a redundant shut-off valve is used, the dual-valve setting increases the cost of the enterprise, and the malfunction of the valve will cause unnecessary shutdown.

[0006] In order to meet the different needs of different companies for the safety and availability of production equipment, some companies use a double solenoid valve structure on the instrument actuator. Considering the safety performance of the device, the two solenoid valves are connected in series (see Figure 1 ), any solenoid valve failure will cause the machine to trip to ensure safe production; considering the availability of the device, the two solenoid valves adopt a parallel structure (see Figure 2 ), the machine will trip only when two solenoid valves fail at the same time, thus improving the stability of the device;

[0007] However, when two solenoid valves in series are used to drive the cut-off valve (see Figure 1 ), although the car will trip safely when any one of the solenoid valves loses power, the disadvantage is that any fault trip of the dual solenoid valves running in series will cause the device to trip, which increases the probability of valve malfunction and causes unnecessary trips; when the production device requires high reliability, although the two parallel solenoid valves drive the cut-off valve (see Figure 2 ), the device will trip only when both solenoid valves lose power. However, the disadvantage is that any one of the solenoid valves running in parallel will fail to operate, which will cause the device to trip without interlocking, thereby reducing the safety of the production device.

[0008] From this we can see that the safety and availability of safety instrumented systems are usually a pair of contradictions. Improving the safety of the device often means sacrificing the availability of the device, and improving availability often means sacrificing safety.

[0009] However, for most working conditions, the safety instrument system must take into account both reliability and availability. It needs to achieve SIL2 safety integrity level in low-demand mode and have a certain degree of redundant fault tolerance. It is difficult to reduce the probability of false shutdown. The reason is that the final actuator has the greatest impact in a safety instrument system, and among the final actuators, the pneumatic actuator and the shut-off valve have the greatest impact. For first-line brand valves on the market, in low-demand mode, when the solenoid valve is redundant, it is difficult for the entire SIF circuit to achieve SIL2. In order to solve the above problems, the present invention provides the following technical solutions. Summary of the Invention

[0010] The object of the present invention is to provide a safety instrument system with a diagnostic function, which can enable a single actuator to meet the safety requirements of the SIL2 level and has a very low probability of false shutdown.

[0011] The purpose of the present invention can be achieved through the following technical solutions:

[0012] A safety instrument system with diagnostic function includes a filter pressure reducing valve, the input end of the filter pressure reducing valve is connected to the air pipe network of the whole plant, and the output end of the filter pressure reducing valve is connected to the inlet of the second three-way joint;

[0013] The first outlet of the second three-way connector is connected to the P port of the two-position three-way solenoid valve 3, and the second outlet of the second three-way connector is connected to the electric valve positioner. The air signal outlet of the electric valve positioner is connected to the 2 port of the two-position three-way solenoid valve 3. The electric valve positioner receives the control signal from the logic controller and feeds back the valve position signal at the same time.

[0014] The 1 port of the two-position three-way solenoid valve 3 is connected to the inlet of the first three-way connector; the 1st outlet of the first three-way connector is connected to the P port of the two-position three-way solenoid valve 2, and the 2nd outlet of the first three-way connector is connected to the P port of the two-position five-way solenoid valve;

[0015] Port 1 of the two-position three-way solenoid valve 2 is connected to the inlet of the third three-way connector; the first outlet of the third three-way connector is connected to port 2 of the two-position five-way solenoid valve, and the second outlet of the third three-way connector is connected to port P of the two-position three-way air control valve 2; port 1 of the two-position three-way air control valve 2 is connected to port P of the two-position three-way air control valve 1;

[0016] Connect port 1 of the two-position three-way air control valve 1 to port 2 of the two-position three-way solenoid valve 1;

[0017] Port 1 of the two-position five-way solenoid valve is connected to port P of two-position three-way solenoid valve one, port 3 of the two-position five-way solenoid valve is connected to the inlet of the fourth three-way connector, the first outlet of the fourth three-way connector is connected to the control air source interface of the two-position three-way air-controlled valve one, and the second outlet of the fourth three-way connector is connected to the control air source interface of the two-position three-way air-controlled valve two; port 1 of the two-position three-way solenoid valve one is connected to the pneumatic actuator.

[0018] As a further solution of the present invention, port 2 of the second two-position three-way solenoid valve is connected to the third muffler;

[0019] Port 2 of the two-position three-way air control valve 2 is connected to the second muffler;

[0020] Port 2 of the two-position three-way air control valve 1 is connected to the first muffler;

[0021] The fourth port of the two-position five-way solenoid valve is connected to the fourth muffler;

[0022] When the exhaust port of the solenoid valve exhausts to the atmosphere, a muffler is used to eliminate noise.

[0023] As a further embodiment of the present invention, the logic controller includes: a SIS analog input card, a SIS analog output card, a first SIS switch output card, a second SIS switch output card, a third SIS switch output card, and a fourth SIS switch output card;

[0024] The solenoid valve and each switching output card are isolated by the first to fourth relays respectively;

[0025] The SIS analog output card in the logic controller controls the valve opening, and the SIS analog input card receives the actual opening signal fed back by the valve.

[0026] As a further solution of the present invention, a two-position three-way solenoid valve has a P-1 port connected and a 1-2 port closed when normally excited; and a P-1 port closed and a 1-2 port connected when de-energized;

[0027] Two-position five-way solenoid valve, when normally excited, the P-1 port is connected, the 1-2 port is closed, the P-3 port is closed, and the 3-4 port is connected; when de-energized, the P-1 port is closed, the 1-2 port is connected, the P-3 port is connected, and the 3-4 port is closed;

[0028] Two-position three-way air control valve, when the control gas source is pressurized, the P-1 port is connected and the 1-2 port is closed; when the control gas source loses pressure, the P-1 port is closed and the 1-2 port is connected.

[0029] As a further solution of the present invention, when the solenoid valve is energized, the air source enters the pneumatic actuator to drive the valve to open or close; the electric valve positioner is used to convert the electrical signal into a gas signal, and the size of the electrical signal determines the size of the air pressure, thereby controlling the opening of the valve.

[0030] As a further solution of the present invention, a method for testing whether the valve and the pneumatic actuator are working properly is as follows:

[0031] The safety instrument system triggers the three-way, two-position solenoid valve to energize the three-excitation tape, and the gas circuit is switched to the air inlet and outlet of the electric valve positioner. For the shut-off valve that is normally open and closed due to a fault, the safety instrument system logic controller outputs the opening α% to the electric valve positioner, and the electric valve positioner converts the electrical signal into a gas signal, where α is the preset value.

[0032] Detect the feedback signal of the electric valve positioner and determine whether the opening of the shut-off valve feedback is α%. If so, it means that the shut-off valve and the pneumatic actuator are operating normally. If not, it means that the shut-off valve and the pneumatic actuator are operating abnormally, and the test is completed.

[0033] As a further solution of the present invention, for a shut-off valve that is normally closed but faulty and open, the safety instrument system triggers the de-energization of the third excitation of the two-position three-way solenoid valve, and the instrument air is conducted from the P-1 terminal of the third two-position three-way solenoid valve. The electric valve positioner is in a bypass state, and the safety instrument system logic controller outputs an opening ≥α% to the electric valve positioner. If the position signal fed back by the electric valve positioner is consistent with the control signal, it indicates that the valve can be closed normally without a fault, and the test is completed and exits the test mode.

[0034] As a further solution of the present invention, a hydraulic device may be used to replace the pneumatic actuator.

[0035] Beneficial effects of the present invention:

[0036] 1. The present invention adopts two two-position three-way solenoid valves, one two-position five-way solenoid valve, and an air-controlled valve, which structurally solves the three air intake channels and three air exhaust channels required by the 2oo3 circuit, and structurally solves the three-choice-two intake and three-choice-two exhaust of the air circuit; therefore, the present invention only needs three solenoid valves to achieve the unification of the three-choice-two of the electrical signal circuit and the three-choice-two of the intake and exhaust air circuits, thereby ensuring that the valve will not be interlocked when one solenoid valve loses power, and the valve will be interlocked when two or three solenoid valves lose power; the failure probability of faults in the circuit and the failure probability of faults in the air circuit are solved, ensuring that the device can achieve safe tripping.

[0037] 2. The safety interlock is normally in a silent state, and the shut-off valve is also in a silent state, making it difficult to determine the health of the shut-off valve. To prevent the shut-off valve from refusing to operate when it is required, the present invention adopts a partial stroke test function, which allows maintenance personnel to understand the health of the shut-off valve online, greatly reducing the probability of undetectable failure of the shut-off valve and the actuator. Due to the use of a test solenoid valve, the electric valve positioner can be bypassed when testing is not required, ensuring that failure of the electric valve positioner will not affect system safety, thereby improving the safety integrity level of the shut-off valve.

[0038] 3. The use of two two-position three-way air-controlled valves solves the problem of fail-safe failure caused by failure of a single air-controlled component from a structural perspective, reducing the probability of failure in the air circuit. In low-demand mode, a single shut-off valve can be used in SIL2 level working conditions at most, suitable for most continuous production conditions, and a double shut-off valve fully meets the SIL3 level. The present invention avoids redundant settings of shut-off valves, and can save investment for high-pressure valves and valves made of special materials and special structures. The circuit and air circuit of the present invention both adopt fail-safe modes, namely, power-off safety mode and air-off safety mode.

[0039] 4. The present invention allows online testing. For devices in continuous production, it is possible to determine whether the actuator can work normally without jumping the machine, thereby reducing the frequency of abnormal shutdowns and saving the cost of starting and stopping. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] The present invention will be further described below with reference to the accompanying drawings.

[0041] Figure 1 This is a schematic diagram of two solenoid valves in series;

[0042] Figure 2 This is a schematic diagram of two solenoid valves in parallel structure;

[0043] Figure 3 Safety instrument system corresponding to the shut-off valve that fails closed;

[0044] Figure 4Safety instrumented system corresponding to the shut-off valve that opens for a fault;

[0045] Figure 5 This is a schematic diagram of the gas flow when solenoid valves A to C are all energized;

[0046] Figure 6 This is a diagram of the air flow when solenoid valve A loses power and solenoid valves B and C are energized. In this case, the air control valve failure has no effect.

[0047] Figure 7 This is a schematic diagram of the gas flow direction when solenoid valve B is de-energized and solenoid valves A and C are energized;

[0048] Figure 8 This is a diagram of the gas flow when C is de-energized and A and B are energized;

[0049] Figure 9 This is a diagram of the gas flow when A and B are de-energized and C is energized. In this case, the failure of the gas control valve has no effect.

[0050] Figure 10 This is a diagram of the gas flow direction when A and C are de-energized, B is energized, and the gas control valves are normal;

[0051] Figure 11 This is a schematic diagram of the gas flow direction when A and C are de-energized, B is energized, and the gas control valve A fails;

[0052] Figure 12 This is a schematic diagram of the gas flow direction when A and C are de-energized, B is energized, and the gas control valve B fails;

[0053] Figure 13 This is a diagram of the gas flow when B and C are de-energized and A is energized;

[0054] Figure 14 This is a schematic diagram of the gas flow direction when A~C are all powered off;

[0055] Figure 15 A schematic diagram of the gas flow direction when testing whether the valve and pneumatic actuator are working properly;

[0056] Figure 16 This is a schematic diagram of how the specific triggering actions of the solenoid valve and the air control valve affect the gas flow direction and the status of the safety instrument system. DETAILED DESCRIPTION

[0057] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making any creative efforts shall fall within the scope of protection of the present invention.

[0058] Example 1

[0059] A safety instrumented system with diagnostic capabilities, such as Figure 3 、 Figure 4 As shown, the safety instrument system includes a safety instrument system logic controller, a shut-off valve 1, an electric valve positioner 2, a pneumatic actuator 3, a first relay 4, a second relay 5, a third relay 6, a fourth relay 7, a two-position three-way solenoid valve 1 8, a two-position five-way solenoid valve 9, a two-position three-way solenoid valve 2 10, a two-position three-way air-controlled valve 1 11, a two-position three-way air-controlled valve 2 12, a two-position three-way solenoid valve 3 13, a first three-way connector 14, a second three-way connector 15, a third three-way connector 16, a fourth three-way connector 17, a first muffler 18, a second muffler 19, a third muffler 20, and a fourth muffler 21;

[0060] The safety instrumented system logic controller includes: a SIS analog input card 22, a SIS analog output card 23, a first SIS switch output card 24, a second SIS switch output card 25, a third SIS switch output card 26 and a fourth SIS switch output card 27;

[0061] The input end of the filter pressure reducing valve 30 is connected to the air pipe network of the whole plant, and the output end of the filter pressure reducing valve 30 is connected to the inlet of the second three-way connector 15;

[0062] The first outlet of the second three-way connector 15 is connected to the P port of the two-position three-way solenoid valve 3 13 (for test switching), and the second outlet of the second three-way connector 15 is connected to the electric valve positioner 2 (with valve position feedback). The air signal outlet of the electric valve positioner 2 is connected to the 2 port of the two-position three-way solenoid valve 3 13. The electric valve positioner 2 receives the control signal (4-20mA) from the logic controller and feeds back the valve position signal (4-20mA).

[0063] The 1 port of the two-position three-way solenoid valve 3 13 is connected to the inlet of the first three-way connector 14; the first outlet of the first three-way connector 14 is connected to the P port of the two-position three-way solenoid valve 2 10, and the second outlet of the first three-way connector 14 is connected to the P port of the two-position five-way solenoid valve 9;

[0064] Port 2 of the two-position three-way solenoid valve 2 10 is connected to the third muffler 20, and port 1 of the two-position three-way solenoid valve 2 10 is connected to the inlet of the third three-way connector 16; the first outlet of the third three-way connector 16 is connected to port 2 of the two-position five-way solenoid valve 9, and the second outlet of the third three-way connector 16 is connected to port P of the two-position three-way air-controlled valve 2 12; port 1 of the two-position three-way air-controlled valve 2 12 is connected to port P of the two-position three-way air-controlled valve 1 11, and port 2 of the two-position three-way air-controlled valve 2 12 is connected to the second muffler 19;

[0065] Port 1 of the two-position three-way air control valve 11 is connected to port 2 of the two-position three-way solenoid valve 8, and port 2 of the two-position three-way air control valve 11 is connected to the first muffler 18;

[0066] Port 1 of the two-position five-way solenoid valve 9 is connected to port P of the two-position three-way solenoid valve 1 8, port 3 of the two-position five-way solenoid valve 9 is connected to the inlet of the fourth three-way connector 17, and port 4 of the two-position five-way solenoid valve 9 is connected to the fourth muffler 21; the first outlet of the fourth three-way connector 17 is connected to the control air source interface of the two-position three-way air control valve 1 11, and the second outlet of the fourth three-way connector 17 is connected to the control air source interface of the two-position three-way air control valve 2 12; port 1 of the two-position three-way solenoid valve 1 8 is connected to the pneumatic actuator 3 of the actuator;

[0067] As mentioned above, the connection material between the components is the gas source pipeline, and the solenoid valve and the safety instrument system are isolated by the first relay 4 to the fourth relay 7;

[0068] The first SIS switching output card 24 to the fourth SIS switching output card 27 in the safety instrumented system logic controller (SIS-PES) control the solenoid valve through the first relay 4 to the fourth relay 7;

[0069] The SIS analog output card 23 of the safety instrumented system logic controller (SIS-PES) controls the valve opening (for testing), and the SIS analog input card 22 receives the actual valve opening signal fed back by the valve.

[0070] The working methods of each component in the above safety instrument system are as follows:

[0071] Two-position three-way solenoid valve (including two-position three-way solenoid valve 1 8, two-position three-way solenoid valve 2 10, two-position three-way solenoid valve 3 13), when normally excited, the P-1 port is connected and the 1-2 port is closed; when power is lost, the P-1 port is closed and the 1-2 port is connected;

[0072] The setting of the two-position three-way solenoid valve 3 13 is used to reduce the impact of the electric valve positioner failure on the failure rate of the safety instrument system;

[0073] Two-position five-way solenoid valve 9, when normally excited, P-1 port is connected, 1-2 port is closed, P-3 port is closed, 3-4 port is connected; when de-energized, P-1 port is closed, 1-2 port is connected, P-3 port is connected, 3-4 port is closed;

[0074] The purpose of setting two two-position three-way solenoid valves and one two-position five-way solenoid valve (instead of three two-position three-way solenoid valves) is to solve the three-choice-two of the intake air path and the three-choice-two of the exhaust air path;

[0075] Two-position three-way air control valve (including two-position three-way air control valve 11 and two-position three-way air control valve 2 12), when the control air source is pressurized, the P-1 port is connected and the 1-2 port is closed; when the control air source loses pressure, the P-1 port is closed and the 1-2 port is connected;

[0076] The purpose of setting up two-position three-way air control valve 1 and two-position three-way air control valve 2 in series is to reduce the impact of the air control valve failure on the failure rate of the safety instrument system; the failure probability of the air control valve and the solenoid valve are usually of the same order of magnitude. The failure probability of SIL2 undetectable failure is 0.01 to 0.001, and the failure probability of the two air control valves in series is 10 -4 ~10 -6 , the impact on the failure probability of the safety instrumented system can be ignored;

[0077] When the exhaust port of the solenoid valve exhausts to the atmosphere, a muffler is used to eliminate noise;

[0078] Filter pressure reducer 30, used to filter water vapor, oil droplets, and particulate matter in the instrument air and stabilize the air source pressure;

[0079] The final actuator includes an electric valve positioner 2 (with valve position feedback), a shut-off valve 1, and a pneumatic actuator 3. The shut-off valve 1 includes an air-to-open type (the valve is opened by air source and closed in case of air failure, FC) and an air-to-close type (the valve is closed by air source and opened in case of air failure, FO). When the solenoid valve is energized, the air source enters the pneumatic actuator 3 to drive the valve to open or close.

[0080] The electric valve positioner 2 is used to convert an electrical signal into a gas signal. The magnitude of the electrical signal determines the magnitude of the gas pressure, thereby controlling the valve opening. The electric valve positioner 2 is used to test the fault or stuck condition of the shut-off valve and the actuator, and is used to reduce the probability of undetectable fault failure of the shut-off valve and the actuator.

[0081] In practical applications, the final actuator can also be an actuator with other power sources such as a hydraulic device, which can also achieve the same effect.

[0082] The operation method of the above safety instrumented system is:

[0083] like Figure 14 As shown, when the safety interlock is triggered and the relay, SIS switch output card and solenoid valve are all in good condition, the two-position three-way solenoid valve 1 8, the two-position five-way solenoid valve 9 and the two-position three-way solenoid valve 2 10 are de-energized, the valve interlock is actuated and the device trips normally;

[0084] like Figure 9 、 Figure 10 、 Figure 11 、 Figure 12 、 Figure 13As shown in the figure, when the safety interlock is triggered, although the relay, SIS switching output card, and solenoid valve are faulty, causing any one of the two-position three-way solenoid valve 1 8, the two-position five-way solenoid valve 9, and the two-position three-way solenoid valve 2 10 to refuse to operate, the device trips normally due to the triggering of the other two solenoid valves;

[0085] like Figure 6 、 Figure 7 、 Figure 8 As shown, when the safety interlock is triggered, the device will refuse to jump only when at least two solenoid valves among the two-position three-way solenoid valve 1 8, the two-position five-way solenoid valve 9, and the two-position three-way solenoid valve 2 10 refuse to act.

[0086] Similarly, when the process is operating normally, the loss of power to any one solenoid valve will not cause a shutdown. Only when both solenoid valves are de-energized will an abnormal shutdown occur. Because the solenoid valves involved in the safety interlock have a safety integrity level of SIL2 (safety-certified), with a failure probability of 0.01 to 0.001 per year, the probability of both solenoid valves failing simultaneously is even lower.

[0087] Specifically, the specific triggering action of each solenoid valve and air control valve affects the air flow direction and the status of the safety instrument system. Figure 16 ;

[0088] In this table, the two-position five-way solenoid valve 9 is marked as solenoid valve A, the two-position three-way solenoid valve 10 is marked as solenoid valve B, and the two-position three-way solenoid valve 1 8 is marked as solenoid valve C;

[0089] The two-position three-way air-controlled valve 11 is marked as air-controlled valve A, and the two-position three-way air-controlled valve 12 is marked as air-controlled valve B.

[0090] When in non-test state, solenoid valve T is not energized, solenoid valves A to C are normally energized, instrument air passes through the filter pressure reducer and the P-1 port of solenoid valve T / A / C enters the actuator cylinder, driving the shut-off valve to open; (See attached Figure 5 );

[0091] When in non-test state, solenoid valve T is not energized, solenoid valve A fails, solenoid valves B and C are normally energized, and instrument air passes through the filter pressure reducer, the P-1 port of solenoid valve T / B, the 2-1 port of solenoid valve A, and the P-1 port of solenoid valve C into the actuator cylinder, driving the shut-off valve to open; (See attached Figure 6 );

[0092] When in non-test state, solenoid valve T is not energized, solenoid valve B is faulty, solenoid valves A and C are normally energized, instrument air passes through the filter pressure reducer and the P-1 port of solenoid valve T / A / C enters the actuator cylinder, driving the shut-off valve to open; (See attached Figure 7 );

[0093] When in non-test state, solenoid valve T is not energized, solenoid valve C is faulty, solenoid valves A and B are normally energized, and instrument air passes through the filter pressure reducer, the P-1 port of solenoid valve T / B, the P-1 port of air control valve A / B, and the 2-1 port of solenoid valve C into the actuator cylinder, driving the shut-off valve to open; (See attached Figure 8 );

[0094] When in non-test state, solenoid valve T is not energized, solenoid valves A and B are de-energized, solenoid valve C is normally energized, and the instrument air is discharged from the actuator cylinder, the 1-P port of solenoid valve C, and the 1-2 port of solenoid valve A / B to the atmosphere through the muffler 20. After the cylinder loses air, the spring in the cylinder drives the shut-off valve to close; (See attached Figure 9 );

[0095] When in non-test state, solenoid valve T is not energized, solenoid valves A and C are de-energized, solenoid valve B is normally energized, and instrument air passes through the filter pressure reducer and the P-3 port of solenoid valve A into the actuator end of air control valve A / B, so that the port 1-2 of air control valve A / B is opened; then, regardless of whether air control valve A fails to operate, instrument air is exhausted from the actuator cylinder, the 1-2 port of solenoid valve C, and the 1-2 port of air control valve B through the muffler 18 to the atmosphere. After the cylinder loses air, the spring in the cylinder drives the shut-off valve to close; (See attached Figure 10 、 12 );

[0096] When in non-test state, solenoid valve T is not energized, solenoid valves A and C are de-energized, solenoid valve B is normally energized, and instrument air passes through the filter pressure reducer and the P-3 port of solenoid valve A into the actuator end of air control valve A / B, so that port 1-2 of air control valve A / B is opened; then, if air control valve B fails to operate, the instrument air is exhausted from the actuator cylinder, port 1-2 of solenoid valve C, and port 1-2 of air control valve A through the muffler 19 to the atmosphere. After the cylinder loses air, the spring in the cylinder drives the shut-off valve to close; (See attached Figure 11 );

[0097] In the non-test state, the solenoid valve T is not energized, the solenoid valves B and C are de-energized, the solenoid valve A is normally energized, the instrument air is discharged from the actuator cylinder, the 1-2 port of the solenoid valve C, the 1-P port of the air control valve A / B, and the 1-2 port of the solenoid valve B to the atmosphere through the muffler 20, and the spring in the cylinder drives the shut-off valve to close after the cylinder loses air; (See the attached Figure 13 );

[0098] When in non-test state, solenoid valve T is not energized, solenoid valves A, B, and C lose power, and the instrument air is exhausted from the actuator cylinder, the 1-2 ports of solenoid valve C, and the 1-2 ports of air control valve A through the muffler 18. After the cylinder loses air, the spring in the cylinder drives the shut-off valve to close. At this time, if the air control valve A refuses to act, the air is exhausted through the 1-2 ports of air control valve B through the muffler 19. After the cylinder loses air, the spring in the cylinder drives the shut-off valve to close; (See attached Figure 14 );

[0099] When in the test state, the solenoid valve T is energized, and the solenoid valves A to C are all energized. The instrument air enters the actuator cylinder through the filter pressure reducer, the electric valve positioner, the 2-1 port of the solenoid valve T, and the P-1 port of the solenoid valve A / C, driving the shut-off valve to open. The safety instrument system logic controller outputs the opening α% to the electric valve positioner. The electric valve positioner converts the electrical signal into a gas signal to make the valve reach a certain opening. The feedback signal of the electric valve positioner is detected to determine whether the opening of the shut-off valve feedback is α%. If so, it indicates that the shut-off valve and the pneumatic actuator are operating normally. If not, it indicates that the shut-off valve and the pneumatic actuator are operating abnormally, and the test is completed; (See attached Figure 15 ).

[0100] In the above-mentioned gas flow direction, when the instrument air in the cylinder is discharged to the atmosphere through the solenoid valve and the muffler, the valve is closed.

[0101] Since the 2OO3 structure determines that at least three air intake paths are required in the air circuit, the interruption of air supply in one path will not affect the air source air intake, and only the interruption of air supply in two or three paths will affect the air intake. Similarly, the exhaust path also requires three exhaust paths. The actuator works normally when the exhaust is interrupted in one path, and the actuator will be activated to perform the safety interlock only when the exhaust is interrupted in two or three paths. Therefore, the use of three two-position three-way solenoid valves cannot completely solve the air circuit problem. The patent of the present invention creatively adopts two two-position three-way solenoid valves and one two-position five-way solenoid valve 9 and two two-position three-way air control valves, wherein one port of the two-position five-way solenoid valve 9 provides the control air source. Since the two-position three-way air control valve also has its own failure probability, two two-position three-way air control valves in series are used to well solve the voting mechanism of the three air circuits.

[0102] Example 2

[0103] The present invention can also test whether the shut-off valve 1 and the pneumatic actuator 3 are working properly, and the specific method is as follows:

[0104] When starting the calibration, in order not to affect normal production, reduce the device operating load to 90% (the specific value is determined according to different process devices);

[0105] The safety instrument system triggers the excitation of the two-position three-way solenoid valve 313, and the port 1 and port 2 of the two-position three-way solenoid valve 313 are connected. The gas circuit is switched to the air inlet and outlet of the electric valve positioner 2. The gas circuit flows as follows Figure 15 As shown;

[0106] For the shut-off valve 1 that is normally open and closed in the event of a fault, the safety instrument system logic controller outputs an opening of 90% to the electric valve positioner 2. The electric valve positioner 2 converts the electrical signal into a pneumatic signal. If the shut-off valve 1 is not stuck, the shut-off valve 1 is adjusted to the specified opening. The feedback signal from the electric valve positioner 2 is tested. If the feedback opening is 90%, it indicates that the shut-off valve 1 and the pneumatic actuator 3 are operating normally and the test is complete.

[0107] For the shut-off valve 1 that is normally closed but fails to open, the safety instrument system triggers the excitation of the two-position three-way solenoid valve 313 to lose power, and the instrument air is conducted from the P-1 end of the two-position three-way solenoid valve 313. The electric valve positioner 2 is in the bypass state, and the output of the opening ≥90% from the safety instrument system logic controller to the electric valve positioner 2. If the position signal fed back by the electric valve positioner 2 is consistent with the control signal, it means that the shut-off valve 1 can be closed normally without a fault state, and the test is completed and the test mode is exited.

[0108] Although in the test state, under the premise that the electric valve positioner does not fail, the air path between the two-position three-way solenoid valve 1, the two-position five-way solenoid valve, and the two-position three-way solenoid valve is not affected, and the normal execution of the safety function is not affected. If any two of the three solenoid valves are triggered, the exhaust channel is connected, the shut-off valve is interlocked and closed, and the device is in a safe state;

[0109] The P-1 port of the two-position three-way solenoid valve three is connected for the normal execution of the safety function, and the 1-2 port of the two-position three-way solenoid valve three is connected for testing. Regardless of whether the two-position three-way solenoid valve three is faulty, the air path between the two-position three-way solenoid valve one, the two-position five-way solenoid valve, and the two-position three-way solenoid valve two is not affected, and does not affect the execution of the safety function. The fault state of the two-position three-way solenoid valve three will not reduce the failure probability of the safety instrument system.

[0110] Regarding the reliability of the safety instrumented system described in the invention:

[0111] The present invention is based on the failure probability theory of electrical / electronic / programmable electronic systems and is calculated based on the fault tree model. The system has higher reliability and availability than traditional single solenoid valve / two-choose-one / two-choose-two systems.

[0112] According to IEC81508 and GBT21109, the safety integrity level of the safety instrument loop of the safety instrument system is divided into SIL1 to 4 levels. For SIL1, the average probability of dangerous failure in the low-demand mode is SIL1: ≥0.01 and <0.1, SIL2: ≥0.001 and <0.01, SIL3: ≥0.0001 and <0.001, SIL4: ≥0.00001 and <0.0001; high-demand mode;

[0113] For electrical / electronic / programmable electronic systems, the probability of failure is divided into dangerous failure λ D and safe failure λ S , where dangerous failure λ DU Detectable dangerous failure λ DU and undetectable dangerous failures λ DD , the greatest impact on device safety is the undetectable dangerous failure λ DU , which may cause the safety instrument system to refuse interlock and trip when the device is in a dangerous state.

[0114] Ignoring very small components in the probability of failure, the average probability of failure (PFDavg) is simplified to:

[0115] 1oo1 (one out of one): PFD avg =λ DU ×Ti / 2 (Formula 1)

[0116] 1oo2 (one out of two): PFD avg =(λ DU ×Ti) 2 / 3 (Formula 2)

[0117] 2oo2 (two out of two): PFD avg =λ DU ×Ti (Formula 3)

[0118] 2oo3 (two out of three): PFD avg =(λ DU ×Ti) 2 (Formula 4)

[0119] PFD avg =PFD S +PFD L +PFD E

[0120] PFD E =PFD 电控+气路 +PFD 执行机构 +PFD 切断阀

[0121] From this formula, we can see that the failure probability of the actuator is 1oo2<2oo3<1oo1<2oo2, and the highest safety is 1oo2, followed by 2oo3, and then 1oo1. Since the failure probability of the valve that cannot be detected after the partial stroke test is usually λ DU It is about 1 / 3 of the no-stroke test, so the reliability of the present invention is close to that of 1oo2 without diagnosis.

[0122] Wherein: 1OO2 structure refers to the conventional two-choose-one structure, 2OO2 structure refers to the conventional two-choose-two structure, and 2OO3 structure refers to the three-choose-two structure mode adopted by the present invention;

[0123] For the electrical circuit involved in the present invention:

[0124]

[0125] Note: DUAS ,λ DUBS ,λ DUBS is the probability of undetectable failure of solenoid valves A, B, and C;

[0126] λ DUAR ,λ DUBR ,λ DUBR is the probability of undetectable failure of relays A, B, and C;

[0127] λ DUDO is the probability of undetectable failure of DO card in SIS system; DUIA ,λ DUIB is the probability of undetectable failure of air control valves A and B;

[0128] Note: In fact, the failure probability of undetectable fault of the two-position five-way solenoid valve is λ DU and the undetectable failure probability λ of the two-position three-way solenoid valve and the two-position three-way air-controlled valve DU There are differences. The air-controlled valve also has a failure probability. However, the failure probability of the solenoid valve and air-controlled valve of the same brand cannot be detected. DU The differences are of the same order of magnitude and can be ignored because the failure probability of SIS channel failure is at least one order of magnitude lower.

[0129] The above formula (simplified): PFD 电控+气路 =(λ DU电磁阀 +λ DU继电器 ) 2 Ti 2 , which is equivalent to a typical 2oo3 electrical circuit;

[0130] Assume that for a certain shut-off valve λ DU电磁阀 =500FIT,λ DU继电器 =160FIT,λDU阀门诊断无诊断 =1600FIT,λ DU阀门带诊断 =500FIT, maintenance frequency is once a year, calculated as follows:

[0131] 1oo1 electrical circuit + shut-off valve: PFD avg =PFD 电控avg +PFD 切断阀avg =2260FIT×4380=0.00946

[0132] 2oo3 electrical circuit + cut-off valve:

[0133] PFD avg =PFD 电控avg +PFD 切断阀avg =(λ DU ×Ti) 2 =(660FIT×8760)

[0134] 2 +500FIT×4380=0.002223

[0135] Therefore, it can be seen that the failure probability of the 2oo3 electrical circuit cut-off valve is much lower than that of the 1oo1 electrical circuit, and it can be used in SIL2 circuits.

[0136] Regarding the availability of the safety instrumented system described in the present invention:

[0137] The simplified formula for calculating the false trip rate STR is:

[0138] 1oo1: STR = λ S (Formula 5)

[0139] 1oo2: STR=2λ S (Formula 6)

[0140] 2oo2: STR=2(λ S ) 2 ×MTTR (Formula 7)

[0141] 2oo3: STR=6(λ S ) 2 ×MTTR (Formula 8)

[0142] Safe failure probability λ S It will affect the normal production of the device. Although the safety failure device will automatically trip, an excessively high safety failure probability will cause the device to trip unnecessarily. The safety failure probability λ S Directly affects the device's false trip rate STR. From the above formula, we can see that the false stop rate 1oo2>1oo1>2oo3>2oo2. Based on the above theoretical basis, we can know that:

[0143] System with a safety failure probability of one in 10 years and a fault recovery time of 8 hours

[0144] 1oo1:STR=0.1

[0145] 2oo3:STR=6×0.01 / 365=0.000164384

[0146] Therefore, it can be seen that the false shutdown rate of the 2oo3 electrical circuit is much lower than that of the cut-off valve of the 1oo1 electrical circuit;

[0147] The present invention achieves the goal of availability and reliability through a three-choose-two structure and online diagnostics. Currently, the three-choose-two structure on the sensor side of the safety instrument system is mature and easy to implement, but it is difficult to implement the three-choose-two structure on the final actuator. The difficulty lies in the structure of the solenoid valve's gas circuit. The present invention takes the final actuator as the research object and solves the problem from two aspects:

[0148] First, the present invention adopts a three-out-of-two failure mode for solenoid valves. When one solenoid valve fails, the device will not trip. When any two or three solenoid valves fail, the system will trip, ensuring the availability of the device. Due to the use of a three-out-of-two redundant structure, the availability and reliability of the valve are increased.

[0149] The two-out-of-three redundancy structure of solenoid valves is only used in SIL1 applications. For most valves with SIL certification on the market, it can basically meet the production requirements of enterprises. However, it is difficult to meet the requirements by using a single shut-off valve to perform SIL2 safety instrument functions. This is because the failure probability of the shut-off valve and pneumatic actuator accounts for more than 80% of the entire circuit.

[0150] Secondly, since the safety instrument system is in a silent state during normal production, when the device encounters a dangerous working condition, it is impossible to determine whether the actuator can operate, and the actuator that has not been running for a long time is also very likely to be in an undetectable dangerous failure state. Therefore, for the entire loop, the biggest factor affecting the safety of the SIL loop is the actuator. To solve this problem, the present invention adds a partial stroke test function to the actuator. The present invention uses an electric valve positioner to perform partial stroke detection on the valve. If the valve can operate at a small opening, it can be determined whether the valve is stuck, thereby reducing the probability of undetectable fault failure of the valve λDU. The probability of undetectable failure of valves and actuators tested with partial stroke is approximately 0.3 times higher than the original value, making it very easy for most valves on the market to pass SIL2 verification. Since the electric valve positioner does not affect the execution of the safety function under non-fault conditions, if the valve positioner is connected in series in the gas circuit, its failure probability will increase the average failure probability of the entire circuit. Therefore, in order to reduce the superimposed impact of the undetectable failure probability of the electric valve positioner on the safety integrity level, the present invention creatively adopts a bypass switching method, that is, the electric valve positioner is only cut in during testing, and does not participate in the execution of the safety instrument interlock during normal operation.

[0151] Since the present invention adopts a partial stroke test function, it is used to reduce the probability of undetectable fault failure of the valve and the actuator; thus, a single cut-off valve can meet the SIL2 level requirements;

[0152] According to the standard specifications, the SIL3 level safety instrument function requires redundant settings, and the high-demand mode SIL2 level requires redundant settings. Therefore, when the shut-off valve is redundantly set, the present invention can also be applied to the high-demand mode SIL2 level working condition and any mode SIL3 level working condition.

[0153] The above contents are merely examples and explanations of the present invention. Those skilled in the art may make various modifications or additions to the described specific embodiments or replace them in similar ways. As long as they do not deviate from the invention or exceed the scope defined by the claims, they should all fall within the scope of protection of the present invention.

Claims

1. A safety instrument system with diagnostic function, characterized in that: It includes a filter pressure reducing valve, the input end of which is connected to the air pipe network of the whole plant, and the output end of which is connected to the inlet of the second three-way joint; The first outlet of the second three-way connector is connected to the P port of the solenoid valve T, and the second outlet of the second three-way connector is connected to the electric valve positioner. The air signal outlet of the electric valve positioner is connected to the 2 port of the solenoid valve T. The electric valve positioner receives the control signal from the logic controller and feeds back the valve position signal. The 1st port of the solenoid valve T is connected to the inlet of the first three-way joint; the 1st outlet of the first three-way joint is connected to the P port of the solenoid valve B, and the 2nd outlet of the first three-way joint is connected to the P port of the solenoid valve A; Port 1 of solenoid valve B is connected to the inlet of the third three-way connector; the first outlet of the third three-way connector is connected to port 2 of solenoid valve A, and the second outlet of the third three-way connector is connected to port P of air control valve B; port 1 of air control valve B is connected to port P of air control valve A; Connect port 1 of air control valve A to port 2 of solenoid valve C; Port 1 of solenoid valve A is connected to port P of solenoid valve C, port 3 of solenoid valve A is connected to the inlet of the fourth three-way joint, the first outlet of the fourth three-way joint is connected to the control air source interface of the air control valve A, and the second outlet of the fourth three-way joint is connected to the control air source interface of the air control valve B; port 1 of solenoid valve C is connected to the pneumatic actuator.

2. A safety instrument system with diagnostic function according to claim 1, characterized in that: The logic controller includes: a SIS analog input card, a SIS analog output card, a first SIS switch output card, a second SIS switch output card, a third SIS switch output card, and a fourth SIS switch output card; The solenoid valve and each switching output card are isolated by the first to fourth relays respectively; The SIS analog output card in the logic controller controls the valve opening, and the SIS analog input card receives the actual opening signal fed back by the valve.

3. A safety instrument system with diagnostic function according to claim 1, characterized in that: In the non-test state, solenoid valve T is not energized, and solenoid valves A to C are normally energized. The instrument air passes through the filter pressure reducer, solenoid valve T, solenoid valve A and solenoid valve C in sequence and enters the pneumatic actuator to drive the shut-off valve to open.

4. A safety instrument system with diagnostic function according to claim 1, characterized in that: In the non-test state, the solenoid valve T is not energized. When any of the solenoid valves A, B, or C fails and the other solenoid valves are energized normally: If the fault is caused by solenoid valve A, the instrument air enters the pneumatic actuator through the filter pressure reducer, solenoid valve T, solenoid valve B, solenoid valve A, and solenoid valve C in sequence, driving the shut-off valve to open; If the fault is caused by solenoid valve B, the instrument air enters the pneumatic actuator through the filter pressure reducer, solenoid valve T, solenoid valve A, and solenoid valve C, driving the shut-off valve to open; If the solenoid valve C fails, the instrument air enters the pneumatic actuator through the filter pressure reducer, solenoid valve T, solenoid valve B, air control valve A, air control valve B, and solenoid valve C, driving the shut-off valve to open.

5. The safety instrument system with diagnostic function according to claim 1, characterized in that: In the non-test state, solenoid valve T is not energized, solenoid valves A and B are de-energized, solenoid valve C is normally energized, and the instrument air is discharged to the atmosphere through the pneumatic actuator, solenoid valve C, solenoid valve A, and solenoid valve B in sequence. After the cylinder loses air, the spring in the cylinder drives the shut-off valve to close.

6. A safety instrument system with diagnostic function according to claim 1, characterized in that: In the non-test state, solenoid valve T is not energized, solenoid valves A and C are de-energized, solenoid valve B is normally energized, and instrument air passes through the filter pressure reducer and solenoid valve A into the actuator end of air control valve A and air control valve B, making ports 1-2 of air control valve A and air control valve B open; When the air control valve B is normal, no matter whether the air control valve A fails to operate or not, the instrument air is exhausted to the atmosphere through the pneumatic actuator, solenoid valve C, and air control valve B. After the cylinder loses air, the spring in the cylinder drives the shut-off valve to close. If the air control valve B fails and refuses to operate, the instrument air is discharged to the atmosphere through the pneumatic actuator, solenoid valve C, and the 1-2 port of the air control valve A. After the cylinder loses air, the spring in the cylinder drives the shut-off valve to close.

7. The safety instrument system with diagnostic function according to claim 1, characterized in that: In the non-test state, solenoid valve T is not energized, solenoid valves B and C are de-energized, solenoid valve A is normally energized, and instrument air is discharged to the atmosphere through the pneumatic actuator, solenoid valve C, air control valve A, air control valve B, and port 1-2 of solenoid valve B. After the cylinder loses air, the spring in the cylinder drives the shut-off valve to close.

8. The safety instrument system with diagnostic function according to claim 1, characterized in that: In the non-test state, the solenoid valve T is not energized, the solenoid valves A, B, and C are de-energized, and the instrument air is exhausted to the atmosphere through the pneumatic actuator, solenoid valve C, and ports 1-2 of the air control valve A; At this time, if the air control valve A refuses to act, the atmosphere will be exhausted through the 1-2 port of the air control valve B. After the cylinder loses air, the spring in the cylinder drives the shut-off valve to close.

9. The safety instrument system with diagnostic function according to claim 1, characterized in that: When in the test state, solenoid valve T is energized, solenoid valves A to C are all energized, and instrument air enters the pneumatic actuator through the filter pressure reducer, electric valve positioner, 2-1 port of solenoid valve T, solenoid valve A and P-1 port of solenoid valve C, driving the shut-off valve to open, and outputting the opening α% from the safety instrument system logic controller to the electric valve positioner. The electric valve positioner converts the electrical signal into a gas signal to make the valve reach a certain opening. The feedback signal of the electric valve positioner is detected to determine whether the opening feedback of the shut-off valve is α%. If so, it indicates that the shut-off valve and pneumatic actuator are operating normally. If not, it indicates that the shut-off valve and pneumatic actuator are operating abnormally, and the test is completed, where α is a preset value.

10. A safety instrument system with diagnostic function according to any one of claims 1 to 7, characterized in that: Hydraulic devices are used to replace pneumatic actuators.

Images