Safety System Implementation

The architecture of most of the safety systems implemented by Schneider Electric and Framatome includes a redundancy of identical I C channels, i.e. using the same hardware and software design. When performing safety analyses on such architectures, software is identified as a potential source of Common Cause Failure (CCF). 

A simple 0 to 5 ranking scale can be allocated to each of the progress questions, and a total score can be calculated as a percentage of completion. When applied to the entire system, the individual and total scores will give an overall picture of the safety system implementation progress. This progress report shonld be included in various safety reports and communications. 

The method proposed in this paper refers to a safety system implemented by a single layer of protection. The purpose is to give a methodology... 

In summary the result of the step-by-step verification of life cycle phases leading to final validation is combined with continuing assessment of functional safety practices to deliver the complete QA package for the safety system. Implementation of the overall scheme will require considerable diligence and discipline. 

The design and implementation of safety systems must be undertaken with a view of two issues ... 

The purpose of the logic within the safety interlock system is veiy different from the logic within the process controls. Fortunately, the logic within the safety interlock system is normally much simpler than the logic within the process controls. This simplicity means that a hardwired implementation of the safety interlock system is usually an option. Should a programmable implementation be chosen, this simplicity means that latent defects in the software are less likely to be present. Most safety systems only have to do simple things, but they must do them very, very well. 

The individuals and firm most familiar with the technology should review the intermediate and final procedures to assure both safety and commercial interests are satisfied. In many batch operations the procedure(s) can be a substantial portion of the process technology package. The procedures represent both a major safety system as well as a propriety technology. The pre-startup review should assure both PHA related and other changes proposed to the procedures have been approved and implemented. 

At Three Mile Island, the safety devices operated as planned and prevented any serious injury. This accident resulted in improved procedures, instrumentation, and safety systems being implemented. The Three Mile Island Unit 2 core has been cleaned up and the radioactive deposit stored. The Three Mile Island Unit 1 is still operating with a clean record. 

Develop and implement a program for reporting reactive incidents that includes the sharing of relevant safety knowledge and lessons learned with your membership, the public, and government to improve safety system performance and prevent future incidents. 

The focus of the new chemicals policy should be on the practical feasibility and the transparency of systems and also must effectively transfer responsibility to the industrial sector. On the other hand, it would not be expedient to implement an extensive safety system based on scientific information and the blanket imposition of state control mechanisms. 

Operating Procedures. Employers must develop and implement written operating instructions for safely conducting activities involved in each covered process consistent with the process safety information. The written procedures must address steps for each operating phase, operating limits, safety and health considerations, and safety systems and their functions. Included must be normal... 

An engineering evaluation should then be made of the worst case consequences with the goal that the plant will be safe even if the worst case occurs. When the process designers know what the worst case conditions are, they should try to avoid worst case conditions, be sure adequate redundancy of safety systems exists, and identify and implement lines of defense. These lines of defense could be preventive measures, corrective measures or sometimes as a last resort, containment or possibly abandonment of the process if the hazard is unacceptable. It is important to note that the worst case should be something that is realistic, not something that is conceivable but extremely unlikely. 

In a computerized plant, it is best to avoid putting redundant inputs on or in the same slot, cluster, or board in the computer. The safety system should be continuously exercised. An independent safety system suffers from a major drawback, particularly if it is implemented using relays. This drawback is that the safety system usually remains inert for long periods of time. Electronic circuits or relays are subject to failures such that when the safety system is called on to operate, it may be incapable of doing so. The best way to ensure that the safety system has not suffered a fault is to continuously exercise it. This is best done if the safety system is also responsible for control calculations and is constantly in use (Wensley, 1986). 

---