Safety shutdown systems

N. L. Conger, "Designing Safety Shutdown Systems A Systematic Approach," Proceeding of Instrument Society of America Conference, ISA/73, Paper 73-756, Houston, Tex., 1973. 

Gruhn, P. and Cheddie, El. 1998, Safety Shutdown Systems Design, Analysis and Justification, ISA. 

Green, D. L., and A. M. Dowell (1996). Cookbook Safety Shutdown System Design. i996 Process Plant Safety Symposium, Volume 1, April 1-2,1996, Houston, TX, ed. H. Cullingford, 552-565. Houston, TX South Texas Section of the American Institute of Chemical Engineers. 

To develop a safe design, it is necessary to first design and specify all equipment and systems in accordance with applicable codes and standards. Once the system is designed, a process safety shutdown system is specified to assure that potential hazards that can be detected by measuring process upsets are detected, and that appropriate safety actions (normally an automatic shutdown) are initiated. A hazards analysis is then normally undertaken to identify and mitigate potential hazards that could lead to fire, explosion, pollution, or injury to personnel and that cannot be detected as process upsets. Finally, a system of safety management is implemented to assure the system is operated and maintained in a safe manner by personnel who have received adequate training. 

Gruhn, P., et al., Safety Shutdown systems Design, Analysis, and Justification, ISA,... 

In general, the safety of a process relies on multiple layers of protection. The first layer of protection is the process design features. Subsequent layers include control systems, interlocks, safety shutdown systems, protective systems, alarms, and emergency response plans. Inherent safety is a part of all layers of protection however, it is especially directed toward process design features. The best approach to prevent accidents is to add process design features to prevent hazardous situations. An inherently safer plant is more tolerant of operator errors and abnormal conditions. 

Serious Consequences—Class 2. Equipment or the critical instruments serving equipment whose failure could possibly cause, or fail to warn of upset conditions, uncontrolled releases of dangerous materials, situations that could result in accidental fires and explosions. Furthermore these failures could result in serious conditions involving environmental releases, property or production losses, or other non-life-threatening situations. These particular pieces of equipment, the safety shutdown systems and the alarms that serve this equipment are given a slightly lower priority. However, they are also inspected, tested, or prooftested on a regular schedule, but may be allowed to have some leniency in compliance. 

The loop does not have a PLC in the safety shutdown system... 

This is a check of all the standard panel alarm lights and a review of any work that remains to be accomplished. (This panel alarm light audit is not for the new technology of distributed control instrumentation.) As a cross-check, a review of all the out-of-service tags of the previous week will be made. Each of the safety shutdown system valves that have been bypassed during the previous week will be inspected in the field to ensure that they are neither blocked nor operating with the bypass open. 

Active for example, safety shutdown systems to prevent accidents (e.g., a high level alarm in a tank shuts automatic feed valves) or to mitigate the effects of accidents (e.g., a sprinkler system to extinguish a fire in a building). Active systems require detection of a hazardous condition and some kind of action to prevent or mitigate the accident. Multiple active elements involve typically a sensor (detect hazardous condition), a logic device (decide what to do) and a control element (implement action). 

Special logic is required, for example, safety shutdown systems. 

The instmment expert provides expertise on the instmments, the cause and effect charts, the control systems, and the safety shutdown systems. He or she should be a full-time member of the team. 

Gruhn, P., and Cheddie, H., Safety shutdown systems, design, analysis and justification, Instrument Society of America, Research Trirngle Park, NC, 1998. 

The calandria is penetrated vertically and horizontally by flux measurement and reactivity control devices, and by the in-core components of two safety shutdown systems. All reactivity control devices function in the low-pressure moderator. No reactivity control devices penetrate... 

On-power refuelling provides the principal means for controlling reactivity in the CANDU 6. Additional reactivity control, independent of the safety shutdown systems, is achieved through use of reactivity control mechanisms. These include light-water zone compartments, absorber rods, and adjuster rods all are located between fiiel channels within the low pressure heavy water moderator and do not penetrate the heat transport system pressure boundary. The reactor is controlled by the dual redundant computer control system. The overall station control system is described in Section 5.7.2.3. 

Firstly, there are two independent safety shutdown systems, each equally effective in handling accidents. 

Additional shutdown systems Two independent passive safety shutdown systems 28 shut-off rods and 6 liquid poison injection circuits... 

Changes in technology also lead to shifts in perception as to what can be done to control risk. For example, the use of sophisticated, high-integrity safety shutdown systems has become more commonplace as instrumentation technology has developed and costs have come down. Such technological and economic shifts need to be reflected in updates to the Safety Case. 

Safety instrumented system (SIS) SIS is meant to prevent, control, or mitigate hazardous events and take the process to a safe state when predetermined conditions are violated. An SIS can be one or more SIFs, which is composed of a combination of sensors, logic solvers, and final elements. Other common terms for SISs are safety interlock systems, emergency shutdown (ESD) systems, and safety shutdown systems (SSDs). So, SIS is used as a protection layer between the hazards of the process and the public. SIS or SIF is extremely important when there is no other non-instrumented way of adequately eliminating or mitigating process risks. As per recommendations of standards lEC 61511 2003 (or ANSI/ ISA-84.00.01-2004), a multi-disciplinary team approach following the safety life cycle, conducts hazard analysis, develops layers of protections, and implements an SIS when hazardous events cannot be controlled, prevented, or mitigated adequately by non-instrumented means. 

For any reliability assessment to be meaningful it is vital to address a specific system failure mode. Predicting the spurious shutdown frequency of a safety (shutdown) system will involve a different logic model and different failure rates from predicting the probability of failure to respond. ... 

Safety Instoumented System system composed of sensors, It c solvers, and final elements for the purpose of bringing a process to a safe state when predetermined conditions are violated. Other terms commonly used included emergency shutdown system (BSD, ESS), safety shutdown system (SSD), and safety interlock system... 

Safety Shutdown Systems Design, Analysis and Justification, ISBN 1-55617-665-1 Paul Gmhn P.E. and Harry CheddieP.E., 1998 ISA, PO Box 12277, Research Triangle Park NC 27709, USA www.isa.org... 

Alarm systems have a very close relationship to safety shutdown systems but diey do not have the same function as a safety instrumented system. Essentially alarms are provided to draw the attention of operators to a condition that is outside the desired range of conditions for normal operation. Such conditions require some decision or intervention by persons. Where this intervention affects safety, the limitations of human operators have to be allowed for. 

The final protection layer is the safety shutdown system in which automatic and independent action is taken by the shutdown system to protect the personnel and plant equipment against potentially serious harm. The essence of a shutdown system is that it is able to take direct action and does not require a response from an operator. 

---