Protective systems should not reset themselves

The operator expected the system to function as soon as he operated the switch. When it did not, he assumed it was faulty. Unfortunately, after operating the switch several times, he left it in its normal position. 

The operator had tested the system on several occasions, as it was used at every shutdown. However, it was tested in conditions of no stress, and he did not notice that it took a minute or so to operate. The solenoid valve should have been fitted with a latch so that once the switch had been operated, the solenoid valve could not return to its normal position until it was reset by hand. 

One day the temperature-measuring device gave a false indication of high temperature. The air valve closed, and the drain valve opened. The temperature indication fell, perhaps because the reactor was now empty. The drain valve stayed open, but the air valve reopened, and a flammable mixture was formed in the reactor. Fortunately it did not ignite. 

The air valve reopened because the solenoid valve in the instrument air line leading to the air valve would not stay in the tripped position. It should have been fitted with a latch. 

---