Emergency stop testing

Verify correct operation of process sequences during water simulations tune control loops. Ensure all process paths are tested, including any emergency stop and hold conditions. Verify correct operation of any recipe management and batch data recording during these tests. 

Emergency stop push button next to a sight port on a test furnace. 

Today, it is more and more evident that effective mitigation and control of corrosion phenomena requires the combined efforts of a team of experts that represents managment, conceptual and executive projects, research and laboratory testing, materials production, quality control, storage of materials, plant construction, controls and start-up, plant operation and corrosion monitoring, maintenance and emergency stops of a plant, and finally, plant decommissioning. 

The operators deliberately avoided tripping the reactor, as it had been in the earlier alternator tests, when the emergency stop valve to the turbine was shut to start the test. Automatic insertion of some control rods in fact commenced. 

ANSI/ISA-84.00.01-2004 contains several references to the need to provide a manual shutdown backup for the logic solver. The main reference is clause 11.2.8, which states, Manual means (for example, emergency stop push button), independent of the logic solver, shall be provided to actuate the SIS final elements unless otherwise directed by the safety requirement specifications. This clause outlines a specific way a manual shutdown may be implemented, but allows the user to specify other ways to provide a manual shutdown. Manual shutdown can be initiated by the operator using the BPCS, remote or local pushbuttons and switches, or directly with process equipment, e.g., manual closure of valves. Manual shutdown capability should be provided for any SIS where maintenance bypasses are used to support online equipment repair, maintenance, and proof test. 

OSHA does not address e-stop inspection or testing. However, in the absence of clear requirements, the agency can and does cite employers under The General Duty Clause and has cited employers for failure to ensure that emergency stop buttons functioned as intended. For example, in an March 22, 2007 General Duty Clause citation, the agency noted the following ... 

Functional tests of safety-related control systems, such as emergency stops... 

For site tests, eaeh safety function is tested on each IIS by the generation of a physical event triggering the function, e.g. intrusion by activation of the emergency passage, triggering an emergency stop, etc. Comprehensive tests are conducted for each operating mode. 

What, then, is the conscientious executive to do The most reasonable course for him would be to employ a heavy additional risk premium when evaluating any chemical that meets all presently known tests and that shows strong commercial potential. If the product passes even this hurdle, it may still eventually encounter regulatory difficulties, but the chances are high that it will have repaid its development cost and produced a profit for the company by the time these difficulties emerge. The impact of such a "regulatory risk premium" would be to slow—but not necessarily stop—new product development. 

Some DMCs establish a boundary more extreme than futility but less extreme than the symmetric bound. Still, another attractive theoretical approach is to define an a priori balance of risk and benefif if the ongoing data show that the balance has changed importantly in the direction of excess risk, the DMC may recommend stopping the trial for safety. If the emerging event was previously unreported, the DMC may hypothesize an excess and use the remainder of fhe trial to test whether the excess is real (Wittes et al. 2004). 

---