Reliability measures for DCS system

The main function of Distributed Control System (DCS) is to control, monitor, manage, and make decisions in the production process. Therefore, it must have high reliability to ensure the safe and economical operation of the factory. With the continuous development of large-scale computer systems and computer communication networks, reliability has become a very important issue, and its theory is constantly developing and improving in this situation. The research content of reliability technology can be roughly divided into four aspects: reliability design, reliability analysis, reliability testing, and reliability management.

1、 Reliability measures for DCS system

In DCS systems, many technical measures have been adopted to improve reliability. These technical measures are based on the following four basic ideas:

① Making the system itself less prone to failure is known as fault prevention.
② Minimizing the impact of system failures as much as possible is known as fault protection and fault weakening.
③ When the system fails, it can continue to operate, which is called fault tolerance.
④ When the system malfunctions, maintenance can be carried out without stopping the system operation, which is called online maintenance.

Based on these four basic ideas, various reliability measures have been adopted in DCS systems to reduce the occurrence of accidents and the resulting losses.

Quality management and improvement of system hardware level

In order to achieve hardware reliability of DCS systems, manufacturers of DCS systems have taken a series of measures to improve hardware quality, such as strict screening of components, downgrading of aging components, full consideration of the impact of parameter changes, use of low-power components, and adoption of noise suppression technology.

2. Reliability measures for on-site design of DCS system

The power supply system of the DCS system is the foundation of its operation, and the power load should not exceed 60% to avoid high load operation of the power supply. At the same time, high-quality power supply should be considered, generally using UPS power supply. It is best to use two UPS units as backup for each other. If one unit fails, the backup unit can switch without disturbance, improving the reliability of the power supply. UPS input power should not use the same electrical busbar. Different reliable busbar segments should be selected according to the electrical plant wiring to ensure that the power supply of the DCS system will not be affected if there is a problem with one section of the electrical busbar.

When installing the DCS power system (UPS, power cabinet, etc.) on site, it should be installed in an electronic equipment room that meets the requirements of dust-free, vibration free, and anti-corrosion. At the same time, after installation, the cable holes should be sealed before powering on to prevent steam leakage from entering the power system through the cable holes and causing a power short circuit. After powering on the DCS power supply, "Equipment Live Operation Prohibited" signs should be hung on equipment such as UPS and power cabinets. It is also not allowed to connect loads unrelated to the DCS system, such as maintenance power supply, maintenance lighting, charging equipment, air conditioning, etc., to the DCS power supply system.

(2) Redundant system

It is necessary to consider the redundancy of important I/O modules on site, while also taking into account the N: 1 redundancy structure of the operator station, in order to avoid equipment shutdown caused by hardware failures of cards or operator stations.

(3) Adopting backup measures

① Manual backup

For important control circuits, manual backup methods can be used to improve reliability. Once the automatic control fails, the manual operation station can be used for direct operation. In this case, the manual operation station directly outputs 4-20mA or 1-5V analog signals to control the actuator or directly ground the equipment for operation, which can manually control the production process.

② Automatic backup

Automatic backup refers to setting up another or several backup control devices in a redundant manner. When the automatic control device in operation fails, the backup control device will automatically activate to maintain the automatic control of the system. Automatic backup is a form of redundant system, which includes main control unit redundancy, power system redundancy, network redundancy, I/O module redundancy, operator station redundancy, server redundancy, etc. When the operating equipment malfunctions, the hot standby equipment will automatically operate without disturbance, without affecting the maintenance of the faulty equipment.

3. Keep the system in a safe state in case of system failure

The DCS system itself continuously performs online fault detection during operation. Once a fault is detected, the faulty equipment is isolated from the system to prevent it from affecting the normal operation of other equipment. After the fault occurs, an audible and visual alarm will be issued simultaneously. Maintenance personnel will analyze the cause of the fault based on the alarm prompt and handle it as soon as possible to avoid the fault from expanding. During the processing, it is necessary to take on-site technical measures and not easily restart the CPU to avoid causing disturbance to the equipment.

If it is necessary to restart the CPU, it is necessary to cooperate with the operator to take preventive measures. Generally, DCS will reset the analog output signal when the CPU is reset. This allows manual switching control of the actuator and frequency converter. The actuator can also be powered off or the analog output card can be unplugged (the actuator has a signal holding function). After the system is normal, the signal will be added to the normal value before powering on and inserting the card into the actuator. But it must be based on the characteristics of DCS itself. Some designs have switch safety outputs (on, off, hold, etc.). If the user selects the safety output as on during configuration, the switch will issue an on command when restarting the CPU.