Automatic shutdown devices

Some of the more common engineering controls are fire alarms and detection systems, toxic gas alarms and detection systems, redundant alarms and shutdown devices, automatic shutdown devices, and process containment systems. 

Stopping electrolysis for every small upset elsewhere in the process is clearly undesirable. In order to provide a degree of redundancy to automatic shutdown devices, then, normal practice is to provide relief in the form of a water seal that allows the cell gas to vent at a rate equal to its production. The chlorine in this vent must not he allowed to enter the atmosphere. Its confinement is the subject of Section 9.1.10.3. 

It Is reassuring that a simultaneous failure of all automatic shutdown devices during a maximum startup excursion leaves about 1 seconds after the initial power turnaround by the temperature coefficients to manually scram the reactor before boiling commences. 

Normal Operation. The designer of a chemical plant must provide an adequate interface between the process and the operating employees. This is usually accompHshed by providing instmments to sense pressures, temperatures, flows, etc, and automatic or remote-operated valves to control the process and utility streams. Alarms and interlock systems provide warnings of process upsets and automatic shutdown for excessive deviations from the desired ranges of control, respectively. Periodic intermption of operations is necessary to ensure that instmments are properly caUbrated and that emergency devices would operate if needed (see Flow measurement Temperaturemeasurement). 

Test safety device (automatic shutdown and general safety equipment) for proper operation. 

The term engineered safety covers the provision in the design of control systems, alarms, trips, pressure-relief devices, automatic shutdown systems, duplication of key equipment services and firefighting equipment, sprinkler systems, and blast walls, to contain any fire or explosion. 

Reactor Instrumentation categorizes Itself Into three basic classifications. Hie first division can be defined as Reactor Safety Circuit Instrumentation. Instruments In this classification provide Information on the status of the process by visual readout devices auid are connected directly Into the reactor safety circuits for automatic shutdown If preset limits are exceeded. They are responsible for maintaining the stemdards of reactor and nuclear safety at all times. The second category Is Reactor Procet... 

Safety devices are testable on power, without risk of a spurious shutdown. All critical components of a safety system are fail-safe or have independent back-up. Two independent and diverse shutdown systems are provided unless automatic shutdown can be guaranteed by inherent physical or chemical properties. 

Answer The Ho. 1 safety circuit will cause an automatic shutdown upon receiving a signal from any of the following devices which constantly monitor pile conditions ... 

Another concern with internal combustion engines is that they could possibly overspeed from the intake of additional combustible vapors during an unexpected combustible vapor cloud release at a facility The engines may accelerate and overspeed, but most are provided with protection devices to protect against this occurrence and additionally those engines who drive electrical generators would have an increase in voltage frequency that would also cause them to automatically shutdown. 

A simple instrumented shutdown device would require the features shown in the above diagram i.e. a level switch set to detect extra high level in the tank causes an automatic shutoff valve to close off all liquid feed to the tank. The shutoff valve remains closed until the defect in the process control system has been rectified. 

Two units are routinely used in Jackson Laboratory of Du Pont, and during their 30-year history, no serious incidents have occurred. Although the mixture of oxygen and hydrogen is potentially hazardous, elaborate safety devices, such as automatic shutdown valves built into the apparatus, assure a safe operation. 

Flammable gas detection systems are typically used to initiate an alarm at a concentration level below the lower flammable limit (LFL). Two gas alarm levels (low and high) are often utilized to allow early warning prior to taking automatic actions. Detection systems may also be used to stop electrical power and initiate process shutdown. The low alarm setpoint should be —20% LFL and the high alarm level set point should be between 40%-60% LFL. Where these devices are used to initiate process shutdown or activate fire protection systems, it is common practice to use some form of voting, typically 2 out of 2, such that the frequency of spurious shutdowns or system activation is minimized. 

Active for example, safety shutdown systems to prevent accidents (e.g., a high level alarm in a tank shuts automatic feed valves) or to mitigate the effects of accidents (e.g., a sprinkler system to extinguish a fire in a building). Active systems require detection of a hazardous condition and some kind of action to prevent or mitigate the accident. Multiple active elements involve typically a sensor (detect hazardous condition), a logic device (decide what to do) and a control element (implement action). 

Interlocks are commonly used safety devices. The function of an interlock is to prevent the occurrence of an event in the piesraice of certain conditions. Some interlocks prevent action or motion, others send signals to other devices that prevent the action or motion. They automatically reconfigure or interrupt final control devices if monitored variables deviate significantly from specifications. Typical process variables monitored are flow, pressure, level, and temperature. Typical machine variables monitored are coolant level and temperature, lubricant level and temperature, vibration, speed, etc. Interlocks allow equipment to start and operate only when monitored variables are within designed specifications. Interlocks inhibit unanticipated actuation of equipment and ensure correct startup/shutdown sequences are followed. A permissive interlock will not allow a process or equipment to startup unless certain conditions are met. There ate two types of interlocks—safety and process interlocks. Each serves a different function. 

Any spray dryer control system can be run either automatically or semiautomatically. A fully automatic control system is recommended when the product quality should meet very stringent requirements and when lower operating costs are essential. A timing device starts up the dryer in a predetermined sequence. In case of failure in the control equipment it is always possible to employ manual control and to continue production without interruption. The shutdown and cleaning operations are programmed and controlled by means of timing equipment. The ACS must include a control system for fire detection, a system for fire or explosion prevention, and a programmable system for countermeasures. 

If computer-integrated resin handling systems are considered, one must compare their operating procedures with one s process requirements. These process requirements describe the flow of resin and product through the system, which determines the system s electronic architecture. Pertinent considerations include batch vs. continuous operations, the type and number of conveying lines, resin storage and distribution, quality control means and procedures, inventory control, the type and quantity of process parameter sensors, the type and quantity of controlled devices, modes (automatic, semiautomatic, manual, and/or shutdown modes), process information, process management controls, and centralized vs. local operation (Fig. 9-1). 

The barometric leg represents one way to prevent process material from flowing back into the vaporizer. The height of the leg should suit the density of the process fluid. When the process operates under pressure or when chlorine enters the process against a substantial head of process fluid, a barometric leg may be impractical. Other devices used include low-pressure shutdown systems, power-operated control valves, backpressure regulators, and vacuum breakers. Check valves are another possibility, but they are not widely recommended and must be used with discretion and with some assurance that they provide positive shutoff. A variation is the use of an automatic value that shuts when the differential pressure between two points in the transfer line reverses, indicating the potential for backflow. 

The system is intended to prevent inadmissible increase of pressure in the primary circuit if all subsystems for residual heat removal fail following the reactor shutdown. Primary circuit emergency pressure decrease is provided by two systems. The first system consists of two sets of safety devices (SD) and of a 1.6 m cooled dump tank. When the primary circuit pressure reaches 19.6 MPa the SD actuates automatically and discharges a portion of coolant into the dump tank. The system can be used repeatedly following dump tank drainage. Automatic membrane safety devices (ASD) are provided to protect the primary circuit against damage in case... 

Reactor shutdown due to simultaneous insertion of all absorber rods into the core by gravity if the CRA drives are de-energized. CRA drive de-energization is provided automatically or manually in the case of abnormal conditions (e g. in the event of pressure rise in the primary circuit). The number of self-actuated devices corresponds to the number of CRA drives. Their design and location in the GV decreases the possibility of spurious and subversive actions causing the devices to fail. 

When the demand frequency is more than twice the periodic proof-test frequency, the application should be considered a high-demand mode application. Therefore the equations and techniques that use test interval as a key variable are not valid. In effect, one cannot take credit for periodic inspection unless it is done very frequently. Credit may be taken for diagnostics that cause the device to fail to the safe state (i.e. automatic process shutdown on any detected dangerous failure) in the high-demand case, as long as the diagnostic time period plus the time necessary to safely return the process to a safe state is less than the available process safety time (the time period between initiation of a demand and the hazard). 

The reactor protection system (RPS) is a safety-related system that is designed to monitor key operating plant variables and to cause alarms, control rod insertions, or scram, as the occasion may require when off-normal conditions occur. The reactor trip system (RTS) is part of the RPS and includes those power sources, sensors, initiation circuits, logic matrices, bypasses, interlocks, racks, panels, control boards, actuation devices, and actuated devices, that are required to initiate reactor shutdown. The RTS automatically initiates control rod insertion when required to assure that acceptable fuel design limits are not exceeded. It is designed to fail safe for most internal component failures. The RTS can also be actuated manually by operator action. 

---