1. Redundant control system (RCS)
Name: Thierry Bakker
Project Pursuit manager

2. What is Redundancy? Definitions: Common definition:
Surplus to requirements; unnecessary or superfluous
Engineering definitions
“A device that will provide its intended function upon loss of power.” (2007 NFPA-80)
An operation which ensures that a failure of equipment, process, or system does not propagate beyond the immediate environs of the failing entity.

3. Redundant Control System
Safety Instrumented Systems
Process Reliability
Process Valve Diagnostics
CERTIFIED
CAPABLE
SIL 3

4. Redundancy with solenoid valves
++ Safety
- - Reliability (production)
1oo2
One out of two 2 3 1 2 3 1 2 3 1
2oo2
Two out of two
++ Reliability (production)
- - Safety

5. Redundancy with solenoid valves
2oo2D 2 3 1
- Safety
++ Reliability (production)

6. Reasons for RCS design
Redundant SOV commonly used in continuous run processes to prevent spurious trip (Nuisance trip) due to coil failure.
Typical Redundant SOV installations:-
Do not provide indication of SOV safe failure.
Do not provide online maintenance facilities.
Do not provide the ability to automatically test for “stuck” SOVs or plugged vents.
Do not provide ability to automatically partial stroke test the process valve
Have difficulty meeting SIL requirements.

7. Typical 2oo2 SOV Installation
RCS Product Evolution
Typical 2oo2 SOV Installation
3 way – Normally closed - Energized
SOV1 S
Air Supply
2oo2 installation
SOV2 S
vent
Issue: Cannot easily detect failure or its location
Block Valve

8. Addition of pressure Switches – Status Indication
RCS Product Evolution
Addition of pressure Switches – Status Indication
SOV1
PS1
Air Supply S
vent
Block Valve
SOV2
PS2
Limit Switches could have been used but they would only indicate that the valve shifted, Could not confirm that the valve vented
Issue: How do you repair the problem without shutting down the process ?

9. Addition of maintenance bypass
RCS Product Evolution
Addition of maintenance bypass
Isolation Valves
SOV1
PS1 S
Air Supply
SOV2
PS2 S
vent
Block Valve
By-Pass valve
Issue: 1) How do you know when you are in by-pass ?
2) How do you know when repair is complete ?

10. Addition of maintenance bypass PS indication
RCS Product Evolution
Addition of maintenance bypass PS indication
SOV1
PS1 S
Air Supply
SOV2
PS2 S
vent
PS3
Block Valve

11. RCS Product Evolution The ASCO RCS Product SOV1 S Air Supply SOV2 PS2
RCS Product Evolution
The ASCO RCS Product
Air Supply S
vent
Block Valve
SOV1
SOV2
PS1
PS2
PS3

12. RCS Concept ASCO’S RCS package consolidates many of the
components using known technology to create a more
complete package with unique features to meet today's needs…

13. RCS Product Features Ground Din Mounted Terminal
Accommodates up to 14 AWG wiring
Keyed Maintenance Bypass
Permits user to service unit without
disturbing the process
ISO-3 Low Power Solenoids (2)
4 bolts permit quick replacement
1.4 watts (24vdc)
Class 1, Div 2 solenoids (non incendive)
Pressure Switches (3)
Monitors solenoid valve position
(diagnostics)
Class 1, Div 2
Stainless Steel
Air-operated Bypass Valve(1)
Maintains process while main solenoid
valves are serviced during bypass
Enclosure
304 or 316 Stainless Steel or Fiberglass
UL Type 4, 4X
Breather vent
Limits condensation build-up
Pneumatic connections

14. RCS 1oo1HS

15. RCS 2oo2D

16. Normally Closed Version
Normally Closed RCS operates like a 3 way Normally Closed valve
In the de-energized state the unit is venting the process valve actuator
As long as one solenoid valve is energized air is supplied to the process valve.
When both solenoid valves are de-energized the process is vented.
Typical application: “ESD systems” (Emergency Shut-down valve) – Fail Safe
SOV1 and SOV2 are de-energized. The process shutoff valve is in the closed position. The contact for PS1 is closed indicating that SOV1 is in the de-energized state and the contact for PS2 is closed indicating that SOV2 is in the de-energized state. The contact for PS3 is closed indicating that the bypass valve is not in the bypass state.
Normally Closed Version
Operation: The normally closed 2oo2D-SOV operates like a standard normally closed three way solenoid operated valve, where, in the de-energized state, the solenoid is venting the process valve actuator. Both solenoid operated valves must be de-energized to vent the process valve actuator. As long as one of the two solenoid operated valves is in the energized state, the process valve actuator will not be vented and the process valve will remain in the normal position (typically open).
Application: The majority of ESD valves are required to close in order to achieve the specified safe state for the process under control (i.e. shut off flow) and they are specified “fail safe” (spring to the safe state) which requires that the solenoid operated valve vent the process valve actuator allowing the process valve move specified safe state on loss of power.
Status:SOV1 & SOV2 de-energized

17. Normally Open Version
Normally open RCS operate like a 3 –way normally open.
In the De-energized state, air is supplied to the process valve
As long as one solenoid valves is energized the process valve will be open to
exhaust and remain in the normal position.
Typical application: “vent valves”
PS1
PS2
PS3
SOV1
SOV2
B/P
Exhaust
Air Supply
SOV1 and
SOV2 de-energized
Bypass (B/P) valve shown
in the normal state
Outlet
Valve
Open ps
out in e
plug
Contact
Closed
SOV1 and SOV2 are de-energized. The process shutoff valve is in the open position. The contact for PS1 is open indicating that SOV1 is in the de-energized state and the contact for PS2 is open indicating that SOV2 is in the de-energized state. The contact for PS3 is closed indicating that the bypass valve is not in the bypass state.
Normally Open Version
Operation: The normally open 2oo2D-SOV requires that both solenoid operated valves be de-energized to apply air to the process valve actuator. As long as one of the two solenoid operated valves are in the energized state, the process valve actuator will not have air applied to it and the process valve will remain in the normal position (typically open).
Application: The majority of emergency vent valves are required to open in order to achieve the specified safe state for the process under control (i.e. vent off pressure). In order to prevent opening of the process valve due to loss of instrument air, the user may chose to specify the process valve as air to open spring return closed. To move the process valve to the safe state requires the solenoids to apply air to the process valve actuator when they are de-energized. This configuration also fulfills the requirement that the process valve move specified safe state on loss of power.
Status: SOV1 & SOV2 de-energized

18. Double Acting Version
Similar to having one 3 way normally closed valve & 3 way normally open
When both solenoid valves are de-energized one side of the actuator is venting while
the opposite side is being pressurized
Customer must define desired position “Fail close / fail open”
If the event of single SOV failure
actuator becomes balanced – actuator
maintains last position
Available only in 2oo2 operation
SOV1 and SOV2 are de-energized. The process shutoff valve is in the closed position. The contact for PS1 is closed indicating that SOV1 is in the de-energized state and the contact for PS2 is closed indicating that SOV2 is in the de-energized state. The contact for PS3 is closed indicating that the bypass valve is not in the bypass state.
Double Acting Version
Operation: The double acting 2oo2D-SOV operates similar to a standard normally closed three- way solenoid operated valve and a standard normally open three-way solenoid operated valve with each controlling air pressure to one side of a piston type actuator. In this configuration, when both solenoid operated valves are de-energized, one solenoid operated valve is venting its associated cylinder side of the process valve actuator, while the second solenoid operated valve is applying pressure to its associated cylinder side of the process valve actuator.
The user must determine the desired position (open or closed) for the process valve on loss of power (i.e. fail close/fail open). If the desired “fail” state for the valve is open, the normally open solenoid valve of the double acting 2oo2D-SOV will control the air to the side of the process valve actuating cylinder that will drive the process valve shut and the normally closed solenoid operated valve of the double acting 2oo2D-SOV will control the air to the side of the process valve actuating cylinder that will vent and allow the process valve to shut.

19. RCS Versions Series 5R – No on-board diagnostic processor (AC or DC)
Series 5L – with on-board diagnostic processor (DC only)
Main Components
2 - Solenoid Valves = 2 Digital Output D/O
1- Maintenance By-Pass
3- Pressure switches = 3 Digital inputs D/I
Key function Monitor status of SOV’s & bypass
Functional testing capabilities
Automated through PLC or DCS
Manually initiated test
Optional panel mount push button and lights
Initiates program test
Main function - Redundant Solenoid valve package with maintenance bypass switch`

20. RCS Versions Series 5L – with on-board diagnostic processor (DC only)
Siemens PLC - main Function
reduce programming and total I/O count
Controls outputs to SOV’s
Receives diagnostic input from pressure switches
Provides testing and diagnostic information
Power is supplied to Siemens PLC via the users controller
Testing and diagnostic reporting to any human machine interface (HMI)
can be facilitated via MODBUS 485
IMPORTANT:
Onboard PLC provides testing and diagnostic information only.
Siemens PLC is benign to the safety action
Power is supplied to the on-board PLC by users controller
User’s controller is always responsible for the safety action
Safety action is executed by de-energizing the output power to Siemens PLC

21. RCS Versions Series 5L – with on-board diagnostic processor (DC only)
In the event of a PLC failure
Watch Dog Relays
Watchdog relays are provided to prevent de-energizing the SOV’s due to a failure
Of the on-board PLC outputs.
Each SOV receives power through a separate normally closed relay contact on
separate watchdog relays .
Watchdog relays are energized by a output from on-board PLC
This keeps normally closed contact in the open position
If on-board PLC fails the watchdog relay close and SOV 1 & SOV 2 are connected to
controller allowing the controller to have supervisory control over SOV 1 & SOV2
Power to SOVs is maintained avoiding accidental shutdown
Loss of PLC will be detected and annunciated ``

22. RCS Product – 1oo1 HS
In the 1oo1HS operational mode one SOV is selected as primary and is
normally energized.
2. The Hot Standby SOV is normally de-energized and its associated PS verifies
the vented state. With only one SOV energized position the safety availability
is increased.0
Air Supply
vent
Block Valve
SOV1
Primary
SOV2
Hot Standby
PS1
PS2
PS3 S
ZSO
= Closed contact
= Open contact

23. RCS Product – 1oo1 HS
If the primary SOV shifts to the vented state (coil failure) its associated PS
identifies the failure and the Hot Standby SOV is energized.
2. The Hot Standby prevents the closure of the process valve
3 The reliability of the 1oo1HS is the same as 2oo2 operation.
Air Supply
vent
Block Valve
SOV1
Primary
SOV2
Hot Standby
PS1
PS2
PS3 S
ZSO
= Closed contact
= Open contact

24. RCS ATEX Certification
CERTIFIED
CAPABLE
SIL 3

25. RCS SIL Certification
Certified SIL 3 Capable by Exida for 1oo1HS, 2oo2D
Available as an optional feature on configurator
SIL certified units will have a different catalog number than non-SIL units
If required, must be identified at the time of part number configuration
Currently SIL certification is only available on units without onboard PLC
Supporting documentation for certified units:
Exida Certificate
FMEDA
IEC61508 Assessment
Safety Manual

26. RCS in the field

27. The RCS solution combines the benefits of safety and reliability in a single package.
“it’s the only pilot valve system that has no single point of failure that can result in an unwanted closure of the process valve. With the RCS, customers will benefit from higher asset availability, less risk of spurious trips, and safe shut downs of mission critical systems, time after time.”
The RCS achieves higher levels of safety by incorporating a redundant, fault-tolerant architecture,
high diagnostic coverage, and automated testing. Its self-diagnostic capabilities test both the safety
system and process valve to ensure continuous proper operating performance.
The ASCO RCS was designed to meet the expanding national and international hazardous
location requirements for safety systems, high reliability, and critical control applications. It allows the
end-user to specify a normally closed, normally open or double acting configuration in redundant
control “2oo2” (two-out-of-two) or single solenoid with back-up “1oo1” (one-out-of-one)
operation.
All types of RCS are available with “automatic on-line testing” of the solenoid valves and “partial
stroke testing” of the process valve. The RCS also provides users with a maintenance/ by-pass mode,
which permits service to the device without taking the process valve off line. This allows the plant to
maintain production without jeopardizing its safety.

28. RCS Information RCS Brochure Available online @ www.ascovalve.com
Contains:
Product specifications
Technical details on
RCS operation
Optional features
Introduction to the
RCS Configurator
Available

29. RCS Configurator

30. Redundant Control System
“LIVE” demonstration
Redundant Control System
Safety Instrumented Systems
Process Reliability
Process Valve Diagnostics
CERTIFIED
CAPABLE
SIL 3