Shutdown corrective action

It generally is recommended, and often required, that gas dcicciiuii systems be installed in a fail-safe manner. That is, if power is disconnected or otherwise interrupted, alarm and/or process equipment shutdown (or other corrective action) should occur. All specific systems should be carefully reviewed, however, to ensure that non-anticipated equipment shutdowns would not result in a more hazardous condition tlian the lack of shutdown of the equipment. If a more hazardous situation would occur with shutdown, only a warning should be provided. As an example, a more hazardous situation might occur if blowout preventers were automatically actuated during drilling operations upon detection of low levels of gas concentrations than if drilling personnel were only warned. 

Concentration levels where alarm and corrective action. should occur vary. If no levels are specified by the authority having jurisdiction, most recommend alarming (and/or actuating ventilation equipment) if combustible gas concentrations of 20 percent LEL (lower explosive limii ) or more are detected. Equipment shutdowns, the disconnecting of dccirical power, production shut-in, or other corrective actions usually are recommended if 60 percent LEL concentrations of combustible gas are detect... 

Active—using controls, safety interlocks, and emergency shutdown systems to detect potentially hazardous process deviations and take corrective action. These are commonly referred to as engineering controls. 

For several months before the accident, conditions at the plant had been deteriorating. Procedures were not carefully followed and several mechanical features were either shutdown or compromised. Examples include the refrigeration circuit that was depleted of coolant and the vent gas scrubber that was out of service. The temperature indicator on one tank was defective. The temperature in one of the tanks had been allowed to exceed the maximum limit by as much as 15°C with no corrective action. 

In either type of collector, the location of the broken bag or bags has to be determined and corrective action taken. In a noncompartmentalized unit, this requires system shutdown and visual inspection. In inside collectors, bags often fail close to the bottom, near the tube sheet. Accumulation of dust on the tube sheets, the holes themselves, or unusual dust patterns on the outside of the bags often occurs. Other probable bag failure locations in reverse-air bags are near anticollapse rings or below the top cuff In shaker bags, one should inspect the area below the top attachment. Improper tensioning can also cause early failure. 

Use of PSA. The results of an adequate PSA that is acceptable to the regulatory body may be used as a measure of the risk posed by any of the unresolved shortcomings. Information from a PSA is clearly helpful, but the uncertainties in data and techniques do not allow decisions on continued operation or plant shutdown to be made on the basis of PSA results alone. However, PSA results may provide an acceptable basis for determining, in the framework of a cost-benefit analysis, whether a corrective action is a mandatory prerequisite for continued operation. 

Demobilization Costs - Site demobilization will include shutdown of the q>erati(Hi, final decontamination and removal of equipment, site cleanup and restoration, permanent storage costs, and site security. Site demobilization costs will vary depending on whether the treatment operation occurs at a Superfimd site or at a RCRA-corrective action site. Demobilization at the latter type of site will require detailed closure and post-closure plans and permits. Demobilizaticxi at a Superfund site does not require as extensive post-closure care for example, 30-year monitoring is not required. This analysis assumed site demobilization costs are limited to the removal of all equipment and facilities from the site. It is estimated that demobilization would take about two weeks and consist primarily of labor charges. Labor costs include salary and living expenses. Demobilization is estimated to be 10,000. 

Operation, (i) The required airflow shall be maintained at all times during which gas, mist, or vapor is emitted from the tank, and at all times the tank, the draining, or the drying area is in operation or use. When the system is first installed, the airflow from each hood shall be measured by means of a pitot traverse in the exhaust duct and corrective action taken if the flow is less than that required. When the proper flow is obtained, the hood static pressure shall be measured and recorded. At intervals of not more than 3 months operation, or after a prolonged shutdown period, the hoods and duct system shall be in-... 

Minimizing required operator actions. Each module is designed for 5 years of continuous operation at base load conditions. The main role of the operator is one of monitoring and verifying that the plant operates as intended. The operator is only required to initiate plant start-ups, plant shutdowns, set or correct set points that control plant operation, and take corrective actions if the plant or systems do not operate as intended. 

An upset on a process unit can cause a shutdown if prompt, corrective action is not taken. Even worse is the possibility that the unit I may self-destruct if an abnormal condition is allowed to continue. An alarm alerts the operators that something has gone awry in the process. A trip shuts down an endangered piece of equipment when it is too late for human intervention. When a trip fails to function, severe damage to a refinery process unit can result. 

Inspectors should locate hazctfds, identify them in detail, and classify or rank them by seriousness. Immediate action, including equipment shutdown, is appropriate when there is imminent danger. Comprehensive inspection reports allow management to understand and evaluate each situation, so that corrective action decisions can be made promptly. 

In shutdown conditions, there are less barriers and levels of protection available to prevent an event from developing into an accident. This is somewhat offset by the lower decay heat rate in the core which can allow longer times for operators to take corrective actions. All main safety functions can be affected as seen from generic observations of PSA studies made for different plant types. 

The safety system (Fig. 20.21) of SMART includes a shutdown cooling system, residual heat removal system, safety injection system, reactor overpressure protection system, and emergency boron injection tank. Each of the four independent passive residual heat removal systems with 50% capacity can remove the core decay heat through natural circulation at any design basis events. This feature can keep the core undamaged for 72 h without any corrective action by operators in a design basis accident (Kim et ah, 2014). 

The failure may be such that existing equipment can be used to compensate for or work around the failure, delaying maintenance until a scheduled shutdown occurs or until the mission is complete, while the system still operates, albeit with reduced performance. This is often an attractive option if some loss of performance can be tolerated until corrective action can be taken however, some limits will usually need to be set on the length of time that such reduced performance is allowed. (Note that this case is distinct from that of using compensation while a repair is made.)... 

Like shut-down, this is usually determined by safety and operating requirements and little can be done to reduce it. The best strategy, as discussed in connection with shutdown, is to minimise the problem by designing to avoid a complete shutdown, leaving the system in a safe state while corrective action takes place. 

The fourth layer consists of a safety instrumented system (SIS) and/or an emergency shutdown (ESD) 5 y5 -tem. The SIS, formerly referred to as a safety interlock system, automatically takes corrective action when the process and BPCS layers are unable to handle an emergency. For example, the SIS could automatically turn off the reactant and catalyst pumps for a chemical reactor after a high temperature alarm occurs. The SIS is described in Section 10.1.4. 

Safety instrumented systems (SISs) should be completely separate from the normal control system. AU elements in the safety loop (measurement devices, logic systems, and actuators) must be highly reliable. This alarm system protects the facility against major catastrophes and will often take corrective actions to safely shutdown and isolate a piece of equipment or a facility, using emergency shutdown (ESD) systems that activate emergency block valves and emergency isolation valves. 

Safety interlock systems should have pre-shutdown alarms to warn that a trip is impending. This enables the operator to take corrective action if time permits before the shutdown actually occurs. 

The abnormal condition control procedures, including corrective action performance time sequences (as appropriate), shall be prepared to address the limiting-worse case shutdown scenarios. 

At the time of shutdown, the SRS operating experience feedback program was focused almost exclusively on internal operating experience. Operational events were documented however, corrective actions were not incorporated in a timely manner. In addition, little attention was given to external operating experience. 

All gas-fired plant should be provided with operating instmctions for shutting down as well as starting up. Such instmctions will ensure that the correct sequence of operations is carried out to both avoid a hazard during the shutdown and to leave the plant in a safe condition. These procedures should also contain instmctions for actions to be carried out in emergencies. Such actions may differ from the normal shutdown. 

Active controls use engineering controls, safety interlocks and emergency shutdown systems to detect process deviations and take appropriate corrective or remedial action. Their effectiveness depends on proper selection, installation, testing, and maintenance. 

---