Emergency shutdown systems functional safety

The concept of PFD is also used when designing emergency shutdown systems called safety instrumented functions (SIFs). A SIF achieves low PFD figures by... 

The control of the nuclear and chemical reactivity in case of accidents is insured by the emergency shutdown systems. The safety function devoted to the thermal power extraction from the HYPP is directly linked to the control of the chemical reactivity because the kinetics of chemical reactions increases with the temperature. The HYPP must be cooled by emergency systems, water streaming on equipments, spraying systems, and so on. 

In case of incorrect diagnosis or no reaction on time against abnormal event occurred due to fast dynamic of the process, the SIS/ESD (emergency shutdown) system will operate without operator intervention to stop technological process executing defined safety instrumented functions (Fig. 3) to mitigate consequences. 

A HIPPS is installed to keep system safety against abnormal pressure rising, which is a completely independent of other emergency shutdown system or control system in offshore production facihties. The high pressure protective function is designed to protect all pipe work and equipment from the well shut in pressure including all wellhead tower topsides pipe work, pig launching equipment, production gas export pipelines and the downstream systems. 

Operational barriers are the part of the Safety Barrier System (SBS) that involves specific human actions related to the barrier function detection, control, mitigation or emergency shutdovm. Examples of operational barriers could be a manual activation of emergency shutdown systems, firefighting and evacuation. A specific lookout or visual check of an operator that is performed only for safety reasons may be seen as an operational detecting barrier. 

The following example shows how a piece of control equipment might be justified to be not safety-related. Assume that this programmable distributed control system (say a DCS for a process plant) causes various process shutdown functions to occur. In addition, let there be a hardwired emergency shutdown (presumably safety-related) system which can also independently bring about these shutdown conditions. 

Regarding the control of accidents within the design basis (Level 3 in Table 4), all water cooled SMRs rely on certain inherent safety features (such as the reactor vessel penetrations located in the upper, steam part of the reactor pressure vessel to ensure that the leakage rate is low and the core is not uncovered in loss of coolant accidents ) and incorporate various combinations of passive and active systems. Most of the designs target an increased reliance on passive systems, as benefiting from smaller reactor size. In different water cooled SMRs, passive systems shoulder the functions of back up or main shutdown systems, emergency core... 

Figure 1-2 shows the simplified schematic diagram of the SMART nuclear steam supply system (NSSS) and exhibits the safety systems and the primary system as well as auxiliary systems. The engineered safety systems designed to function passively on demand consist of a reactor shutdown system, passive residual heat removal system, emergency core cooling system, safeguard vessel and reactor overpressure protection system. 

NRC requirements establish that all SSCs can be evaluated to verify the pertinence of their inclusion in MR. If the SSC is directly related to safety, can mitigate accidents or transients, is part of Emergency Operational Procedures (EOPs), can prevent other SSC of performing their safety functions, or causes a reactor shutdown or a safety system actuation, the SSC will be put within the MR scope. Otherwise, it remains under the existing maintenance program, outside the MR scope. The MR simplified flowchart may be found in (NRC, 2014). 

Although the BSD function is essential for safe process operation, unnecessary plant shutdowns and startups should be avoided, because they result in loss of production and generate off-specification product during the subsequent plant startup. Also, the emergency shutdowns and startups for a process unit involve risks and may activate additional safety systems that also shutdown other process units. Such nuisance shutdowns can create additional hazards. The use of redundant sensors can reduce unnecessary shutdowns. 

The I C safety systems include those systems that provide the protection functions. These functions are typically provided by a system known as the reactor protection system, or by the I C subsystems of special safety systems, such as reactor shutdown systems, the emergency core cooling system and containment isolation systems. I C safety systems may also fulfil post-accident monitoring functions and support functions (for example, essential data communication systems for the protection systems or the special safety systems). 

Safety systems are typically divided into emergency trip/shutdown functions, controlled (slow) shutdown, alarm activation, or startup annunciation of auxiliary equipment such as oil pumps. 

Figure 4-34. Function diagram of the safety systems for emergency and slow shutdowns, and of the speed regulating devices.

Accidents must be shown to have acceptable consequences, not only if the safety systems work, but also if any safety system is unavailable or impaired. For example, in most other reactors, a loss-of-coolant accident coupled with prolonged unavailability of the emergency core cooling system, would result in melting of the reactor fuel. In CANDU this sequence would lead to damaged fiiel but no meltdown. This overall safety approach is achievable because there are at least two ways of providing the safety functions of shutdown and decay heat removal. 

The economic impact of a spurious or nuisance trip of an ESD system can be disastrous. An ESD system is an important layer of protection to prevent and prevent hazardous situations from occurring. So, it is needless to mention that the ESD system must be extremely reliable and function on demand. During an emergency, it must put the process in a safe state in orderly fashion. Also ESD systems design shall be based on a fail safe independent system, that is, ESD systems are such that during a failure of a component the process reverts to a condition considered safe and not a vulnerable serious hazardous event. Reliability and availability are major parameters for ESD system performance. Reliability is a function of system failure rate (its reciprocal) and mean time between failures. Spurious trip conditions may initiate a so-called fail safe incident that may result in accidental shutdown of equipment or processes. However, undetected process design errors or operations may initiate dangerous incidents that may disable the safety interlock and may even cause accidental process... 

---