Emergency shutdown levels

HIPS is considered at just above the emergency shutdown level on the Layers of Protection Analysis (see Figures 10.2 and 10.3). 

Active—Using controls, safety interlocks, and emergency shutdown systems to detect and correct process deviations e.g., a pump that is shut off by a high level switch in the downstream tank when the tank is 90% full. These systems are commonly referred to as engineering controls. 

Plants are particularly vulnerable to human error during shutdowns for repair and maintenance. Tfiis is partly due to the higher level of direct human involvement with the plant, when errors are likely if procedures and supervisory systems are poor. Errors also occur during high stress situations such as emergency shutdowns. Workers need to be trained in how to handle these situations so that less stress is experienced (see Chapter 3). 

There are three safety integrity levels (SILs) that are generally accepted in the chemical process industry for emergency shutdown systems ... 

The control rod system provides for automatic control of the required reactor power level and its period reactor startup manual regulation of the power level and distribution to compensate for changes in reactivity due to burn-up and refuelling automatic regulation of the radial-azimuthal power distribution automatic rapid power reduction to predetermined levels when certain plant parameters exceed preset limits automatic and manual emergency shutdown under accident conditions. A special unit selects 24 uniformly distributed rods from the total available in the core as safety rods. These are the first rods to be withdrawn to their upper cut-off limit when the reactor is started up. In the event of a loss of power, the control rods are disconnected from their drives and fall into the core under gravity at a speed of about 0-4 m/s, regulated by water flow resistance. 

It is easy to criticize both these persons, but the organizational stmcture offshore is quite like the mUitary—a person does not disobey orders lightly. More fundamentally, a junior-level employee may not understand all the ramifications of initiating an emergency shutdown of a large industrial facility. 

Centralized control approach. DCS, distributed control system ESD, emergency shutdown system HMJ, human—machine interface MIS, management information system PU, pro cessing unit SIL, safety integrity level SIS, safety instrumentation system. 

In general the fuel channels contain fiiel elements in a uniform array, but tiie occupancy of a control rod channel may vary in accordance with its purpose for core control. It may contain either a fine or coarse control rod at an appropriate insertion level, an emergency shutdown device (ESD) or other core viewing or monitoring devices. Tlie possible occupancy of the 185 control rod channels is given below ... 

SIF description Detection of low low level by LT-4011 initiates an emergency shutdown and valve SDY-4012 closes to prevent high pressure gas flow to downstream equipment. ... 

Inputs and outputs to the facility are noted, production, manning levels, basic process control system (BPCS), emergency shutdown (ESD) arrangements, fire protection philosophy, assumptions, hazardous material compositions, etc. 

The use of high or low limits for process variables represents another type of selective control called an override, where a second controller can override or take over from the first controller. This is a less extreme action than an interlock, which is used for emergency shutdown of the process (see Chapter 10). The anti-reset windup feature in feedback controllers (cf. Chapter 8) is a type of override. Another example is a distillation column that has lower and upper limits on the heat input to the column reboiler. The minimum level ensures adequate liquid inventory on the trays, while the upper limit exists to prevent the onset of flooding (Buckley et al., 1985 Shinskey, 1996). Overrides are also often used in forced draft combustion control systems to prevent an imbalance between air flow and fuel flow, which could result in unsafe operating conditions (Singer, 1981). 

Allow 3 minute liquid surge time from LLL to low low liquid level (LLLL), and 3 minute su e time from ULL to high high liquid level (HHLL). It is assumed that at HLL or LLL, liquid level alarm will be sounded to alert the operator, and at HHLL or LL1.L, the feed flow or liquid outlet flow will be stopped by an emergency shutdown valve. HHLL and LLLL is user s option to have them or not. 

Per application flow control valve, pressure control valve, temperature control valve, level control valve, on- ofT control valve, manual control valve, emergency shutdown valve. 

The basic approach is to direct the system to the safest operating level relative to people or the environment when any emergency condition is detected, including power loss. An important concept of process control safety is to have adequate redundancy to reduce unwanted shutdowns and maintain an adequate level of certainty that a safe state will result if a real emergency does occur. As far as possible, instruments should be of the fail-safe type. 

Lubrication skid. The gas turbine lubrication skid is usually independent of the steam turbine skid as the lubrication oil is usually synthetic due to the high temperatures in the gas turbine. Another reason is due to water contamination of the lubrication oil from the steam turbine. It is advisable to have the lubrication system be totally independent. The gas turbine lubrication skid would report to the gas turbine controller. Since the lubrication system is also used for providing cooling, it is usually operated for about 20 minutes after the gas turbine is shutdown. The lubrication skid contains at least three pumps, two pumps in which each can provide the head required and a third pump, which is usually recommended to be a DC drive for emergency use. These pumps and their control fall under the drive level hierarchy. 

The activation logic for and ESD system should be kept as simple at possible. Typically most facilities specify plateaus or levels of ESD activation. These levels activate emergency measures for increasing amounts or areas of the facility as the emergency involves a larger and larger area or the degree of hazard from the initial event. Low hazards or small area involvement would only require a shutdown of individual equipment while major incidents would require a facility shutdown. The shutdown of one of a facility should not present a hazard to another portion of the facility otherwise both should be shut down. Typical levels utilized in the petroleum and related industries are identified in Table 12. 

---