Manual shutdown requirements

ANSI/ISA-84.00.01-2004 contains several references to the need to provide a manual shutdown backup for the logic solver. The main reference is clause 11.2.8, which states, Manual means (for example, emergency stop push button), independent of the logic solver, shall be provided to actuate the SIS final elements unless otherwise directed by the safety requirement specifications. This clause outlines a specific way a manual shutdown may be implemented, but allows the user to specify other ways to provide a manual shutdown. Manual shutdown can be initiated by the operator using the BPCS, remote or local pushbuttons and switches, or directly with process equipment, e.g., manual closure of valves. Manual shutdown capability should be provided for any SIS where maintenance bypasses are used to support online equipment repair, maintenance, and proof test. 

Why is a manual shutdown needed at all The process requirements specification defines how manual shutdown should be executed from the process perspective. Operators are often provided with manual pushbuttons to initiate equipment shutdown. Operators are expected to initiate trained responses to a variety of shutdown indicators, such as process indications, process alarms, observed events, protective alarms, emergency alarms, or procedures. 

No reproduction or networking permitted without license from IHS 

The ability to shutdown the process, independent of the BPCS controller and SIS logic, solver may be required for some applications. The current editions of NFPA 85 and NFPA 86 require independent means for equipment covered by these practices. The SIS logic solver has a very low failure rate, but what will you do when it fails Even with the very low failure rate, programmable electronic systems can fail. Equipment safety manuals may specifically require independence, especially for SIL 3 applications. When non-fail-safe design is used, e.g., energize to shutdown, independent shutdown facilities should be provided that do not require the SIF support system to be operational. 

The potential for systematic failure in the process specification, programming, and checkout of the SIS is not considered in the safety system PFDavg calculation. That failure rate may have a significant contribution to the potential for loss of the ability to bring the process to a safe state. When there is a failure, whether you have redundancy or not, you need to provide a way to bring the process to a safe state. Clause 11.3 presents requirements for system behavior when a fault is detected. The manual shutdown does not have to be an emergency stop button, which activates the final elements of the SIS, Independent of the logic solver, but some alternate shutdown method should be provided. 

---

SIS measurement and trip point and output action Functional relation between process I/O and logic solver Manual shutdown requirements Energize/de-energize to trip requirements Resetting after SIS shutdown Allowable spurious trip Failure mode and desired SIS response Interface between SIS and other systems... 

Response time of SIS for safe state Manual shutdown requirements Maximum allowable spurious trips Action to bring to safe state in case of fault detection... 

Description of SIS process output action and criteria for successful operation Functional relationship among process input and output including logic, mathematical functions, and permission Requirements for manual shutdown Requirements for energize/deenergize to trip... 

Manual means that are independent of both the SIS logic solver and the BPCS control system may be provided to allow the operator to initiate a shutdown in an emergency. The requirements for manual shutdown are normally defined in the SRS. 

Where bypasses are required, they are designed and installed such that alarms and the manual shutdown are not disabled... 

In the event of BPCS failure, is sufficient information given to the operator to allow manual shutdown if required ... 

Manual shutdown, to energize or de-energize to trip requirements. Post-shutdown SIS reset requirement. 

SIS documentation consistent with installed system SIFs perform as specified with invalid process variables Proper shutdown sequence activated Proper alarm and display by SIS Correct computations included in SIS Bypass and manual shutdown function correctly Reset of SIS functions as per SRS Proof test interval included in maintenance procedure Diagnostic alarm performs as required SIS performs as required in case of loss of power SIS goes to desired state on power resumption SIS EMC immunity as per SRS... 

Operational performance and modes of operation Behavior under fault conditions Start-up and reset requirements Input ranges and trip values, outputs, overrides Manual shutdown details Behavior under power loss Interfaces with other systems and operators... 

Some contents which are related to SIF, safe state, proof test interval, response time, manual shutdown, and etc. are commonly included as main requirements in all projects. However, safe process state, additional action, normal/abnormal mode and major accident event are sometimes dropped. There are some occasions that new requirements are often added to SRS such as design intent, consequence of failure and so on. 

Manual shutdown stations should use a two-stage operation to avoid inadvertent operation. For example, a push button could be covered with a flap guard thus requiring that the operator take two actions (open the flap then press the button) before the shutdown takes place. 

The intent of this standard is to eover the normal requirements of the majority of applieations, reeognizing that eeonomie trade-offs and reliability implieations may differ in some applieations. The user may desire to add, delete, or modify the requirements in this standard to meet his speeifie needs, and he has the option of doing so in his own bid speeifiea-tion. The gas turbine eontrol system shall inelude sequeneing, eontrol, proteetion, and operator information, whieh shall provide for orderly and safe start-up of gas turbine, eontrol of proper loading, and an orderly shutdown proeedure. It shall inelude an emergeney shutdown eapability, whieh ean be operated automatieally by suitable failure deteetors or whieh ean be operated manually. Coordination between gas turbine eontrol and driven equipment must be provided for startup, operation, and shutdown. 

As with any power equipment, gas turbines require a program of planned inspections with repair or replacement of damaged components. A properly designed and conducted inspection and preventive maintenance program can do much to increase the availability of gas turbines and reduce unscheduled maintenance. Inspections and preventive maintenance can be expensive, but not as costly as forced shutdowns. Nearly all manufacturers emphasize and describe preventive maintenance procedures to ensure the reliability of their machinery, and any maintenance program should be based on manufacturer s recommendations. Inspection and preventive maintenance procedures can be tailored to individual equipment application with references such as the manufacturer s instruction book, the operator s manual, and the preventive maintenance checklist. 

These valves isolate the compressor. Most operators require both shutdown valves to be automatic. Some operators use manual valves on small onshore compres,sors. If the compressor is in a building it is preferable to locate the valves outside the building. 

All electrical equipment for the water-level and firing controls should be designed so that any fault will cause the boiler to shutdown and require manual resetting before the boiler may be restarted. 

Most state laws and safe practice require a safety relief valve ahead of the first stop valve in every positive displacement compressed air system. It is set to release at 1.25 times the normal discharge pressure of the compressor or at the maximum working pressure of the system, whichever is lower. The relief valve piping system sometimes includes a manual vent valve and/or a bypass valve to the suction to facilitate startup and shutdown operations. Quick line sizing equations are (1) line connection, (i/1.75 (2) bypass, ii/4.5 (3) vent, dl63 and (4) relief valve port, cU9. 

Some manufacturers of this type of boiler claim that water treatment of any kind is not necessary and that no chemicals are required, especially with smaller units below, say, 240 kWh (800 lb/hr). Instead they rely on the on-off expansion-contraction cycles within the vessel to drop scale from the heating elements, or on a daily manual flush of the boiler vessel together with frequent replacement of elements and periodic acid cleaning. (Some improved design models thankfully have an automatic flush system that is actuated upon boiler shutdown.)... 

Labor and maintenance costs can usually be kept to the order of a few cents per pound of metal produced. However, where a circuit has been improperly designed and several manual operations are required, then labor and maintenance costs can be high. Excessive solvent entrainment losses, mentioned earlier, are added to labor costs. Any crud that forms and has to be removed can result in additional costs from labor requirements. For example, if incorrectly designed contacting equipment is chosen, which results in periodic shutdowns necessary for cleaning because of formation of cruds and precipitates, a major maintenance problem could arise. 

Flame arrestor plugs. Insufficient eonfcustior sir Loss of heater equipment shutdown, possible equipment Air intake designed 3 feet above ground Place in operator manual requirements for... 

A safety shutdown of the oxy/fuel combustion equipment system by any of the prescribed safety features or devices shall require manual intervention of an operator for reestablishment of normal operation of the system, per NFPA 86 (sect. 5-2.3). 

---