Safety systems, redundant/backup

Redundant or backup safety systems (mechanical or electronic)... 

For the basic concept of CHAZOP Fig. IV/1.5-1 may be referred to see that the safety system has been kept separate from BPCS, to give backup in case of BPCS failure. At lower levels, redundancies with fallback facilities have been considered at controller as well as at field level. There are a few issues such as ambiguity, incompleteness, nonsensicality, and redundancy that are very much present in conventional HAZOP and should be avoided prior to applying data from HAZOP directly to CHAZOP. On a case-by-case basis, there may be additional factors to be considered for CHAZOP. It will be prudent to consider only those combinations that will give meaningful deviation, and repetitive combinations should be avoided to limit the time and fatigue in discussions. 

Since the off-gas fans are of major importance to the safety of the system redundant fans should be provided. As an alternative to a fully redundant design, the use of two 50% capacity fans or a smaller backup fan, which is sufficient to ensure a safe plant shutdown and to maintain negative pressure in the system, may be considered. 

The first method of preventing accidents is to strive for such high quality in plant design, construction and operation that deviations from normal operational states are infrequent. Safety systems are used as a backup to feedback in process control to prevent such deviations from developing into accidents. Safety systems make use of redundancy and diversity of design and the physical separation of parallel components, where appropriate, to reduce the likelihood of the loss of a vital safety function. Systems and components are inspected and tested regularly to identify... 

The event tree for the modified process is shown in Figure 11-11. The additional safety function provides a backup in the event that the high-temperature alarm fails or the operator fails to notice the high temperature. The runaway reaction is now estimated to occur 0.00025 time per year, or once every 400 years. This is a substantial improvement obtained by the addition of a simple redundant shutdown system. 

Use intrinsically-safe and redundant safety control designs when using hydrogen. Intrinsically-safe and redundant control systems help to minimize operator mistakes, such as venting, door opening, air releasing, and backup safeties in the event of a hardware failure. 

Critical interlock While identifying the hazards it is important to categorize critical interlocks (for new plants, data/experience from similar plants may be helpful) for which sufficient backup may have to be arranged as a safety measure. In many of these cases, in addition to software interlock, hardware interlocks are also provided. In some cases, even mechanical protection is provided. A critical trip interlock pertinent to a turbine is an example. For turbine overspeed, condenser vacuum, etc., in addition to electronic interlock (with sufficient hardware/software redundancy), mechanical interlocks are provided so that the equipment is saved. Choke and kill in offshore is also an example of this. Regulations To meet the requirement of a regulatory board or company standards, measures are taken to enhance overall safety. Incorporation of these safety measures does not always mean that risk is adequately reduced. These measures could make the system acceptable for use, and a local regulatory board may require additional precautions. An example will elaborate the situation. Many turbine manufacturers give low forward power relays or reverse power... 

Redundant or backup components shall be provided for those parts of the system that are necessary for safe system shutdown and for returning the system to a stable condition from all the hypothetical situations considered in the safety analysis. Examples of components that should be redundant or have backups are exhaust fans, high efficiency particulate air (HEPA) filters, and thermocouples in the combustion chamber. 

To determine which is better from a safety standpoint, consider the example system shown in Figure 2.77, which is a hypothetical SCF where successful safe operation requires successful operation of components A and B. There is only one component A, but there are two redundant components of type B, only one of which must function for system success. Figure 2.77 contains an FTA of this system for the UE SC function fails. This FT clearly depicts that component A is an SPF for this system. There is only one component A, and its failure directly causes the UE. If component B1 fads, there is still a backup type B component B2 thus, B1 and B2 are redundant and prevent vulnerability due to an SPF. 

---