Shutdown Function

With this system, plasticizer is mixed into the polymer before extrusion. Phase separation between the plasticizer and the polymer occurs in microscopic regions within the molten bulk during cooling after extrusion, and the pores are formed by removing the plasticizer. This process is called wet because solvent is used to remove the plasticizer, and the term two-component indicates that the polymer and plasticizer are present in the extruded mass. This system enables control of pore size and pore structure by selecting different polymer and plasticizer materials, which in turn allows the production of separators with a wide range of physical characteristics. 

This is similar to the system described above except that particles of inorganic filler are also mixed into the polymer before extrusion. The particles of filler are removed together with the plasticizer. The advantage of this system is that it is able to form larger pores than the other two systems, providing greater ion mobility. 

Many separators are designed to have the physical characteristics that endow them with a shutdown function, a safety feature in which the polymer melts to close the micropores and prevent ion transport between the electrodes in the case of abnormal heat generation caused by short circuit or other reasons. This function prevents battery overheating and therefore greatly improves battery safety. 

FIGURE 1.13 Shutdown temperature for polyethylene separators. Impedance (1 kHz AQ change of electrolyte-penetrated separators at elevated temperature, (a, b) Polyethylene and (c) polypropylene. 

It is worth noting that in this graph you can see that one of the polyethylene separators maintains high impedance even when temperature continues to increase, while the impedance for the other one falls off quickly after an initial spike, indicating a rupture of the membrane. The difference between these two different behavior characteristics depends on a complex combination of factors such as pore size, pore structure, and molecular weight of the polymer. 

---

There are three basic requirements that Hquid level control devices are designed to satisfy alarm functions, pump/valve control, and transmitted output signal to track level continuously. Alarm devices provide warning or shutdown functions when process levels pass a predeterrnined point in the vessel pump /valve control devices turn on/off pumps or open/close valves at predeterrnined levels in the vessel and transmitters provide a proportional output signal over a predetermined span to send to a local meter or signal back to a control room. 

Safety systems are typically divided into emergency trip/shutdown functions, controlled (slow) shutdown, alarm activation, or startup annunciation of auxiliary equipment such as oil pumps. 

The balance of the controls consists of the required pressure switches and/or transmitters to provide monitoring of the system and alarm and shutdown functions for the critical buffers. Filter differential normally is also monitored and alarmed on high filter differential pressure. 

The control, low-level, and high-level probes provide computer inputs and trigger the appropriate shutdown functions. The level is controlled over a range of about 2 mm. 

The PVdF—HFP separators used in PLION cells were around 3 mil thick, and had poor mechanical properties. It has been reported that the major source of rate limitation in PLION cells was the separator thickness. The rate capability of these cells can be significantly improved by decreasing the separator thickness to that typically used in liquid electrolyte system. Moreover, in the absence of shutdown function. the separator does not contribute to cell safety in any way. Park et al. reported that the HFP content in separators did not have any significant impact on cell performance. The Bellcore process has proven to be an elegant laboratory process but is difficult to implement in large-scale production. 

At PPG Industries in Lake Charles, Louisiana, numerous instrument loops provide critical safety, alarm, and shutdown functions. These protective instruments are located on reactors, oil heaters, incinerators, cracking furnaces, compressors, steam-heated vaporizers, kettles, distillation columns, boilers, turbines, and other critical equipment. Process analyzers and flammable vapor detectors also enhance the overall process safety environment. [8]... 

Many of PPG s high-pressure and high-temperature alarms are tested every six months. A significant number of the PPG Lake Charles Complex test frequencies have been developed using detailed reliability studies that consider the hazard rate (the acceptable probability of a process accident) and the demand rate (the number of times the critical alarm or shutdown function is required in service). [8]... 

It is required that the structural integrity and the safe shutdown functions of the neutron control assemblies are maintained for the OBE and SSE events. At the OBE level, the neutron control assemblies must be able to perform their safety function. Additionally, the ability to perform their power generation function during and after the earthquake should also be oiaintained. Their operation must be unaffected by any credible misalignment of the core control channels due to core deflections as a result of the seismic disturbance. A maximum misalignment of 7.6 cm (3 in) is allowed. At the SSE level, the neutron control assemblies must retain their safety function during and after the earthquake. The failure modes which could cause the seismic requirements not to be satisfied are identified as follows ... 

The electrical panels associated with the safe shutdown function of the Neutron Control Subsystem control equipment will be seismically qualified by test. (Ref. 9)... 

The "safety-related" design conditions (SRDCs) are discussed in detail in Chapter 15. As in the DBEs, the NCSS performs its detection and shutdown functions early on, before conditions progress to a point where the capability of the NCSS equipment to perform its "safety-related" functions is threatened and none of the SRDCs cause a significant rise in the temperature of the control rod drives prior to their being tripped. The same is true of the reserve shutdown control equipment. Also, these two sets of equipment are not affected by pressure changes or other changes in environment that occur prior to their being called upon to perform. 

The definition tells us that a SIS may be responsible for shutdown functions, permissive functions, and even consequence reduction (mitigation) functions. AU these functions have a common attribute — they aU reduce risk. One common interpretation of a SIS definition is, therefore, "automatic risk reduction systems." In some cases the function is designed to reduce risk by decreasing the likelihood of a potential hazard. In some cases the function will decrease risk by reducing the magnitude of the consequence. 

A gas detector used in a flammable gas shutdown function falsely indicates the presence of flammable gas. How would that failure mode be classified ... 

Figure 13-3 shows a block diagram of the proposed design for the safety instrumented function of the high line pressure. It consists of two separate and independent shutdown functions in two separate and independent systems (ESDI and ESD2). The components associated with the two systems for this function are ... 

Most designers would choose a completely separate BPCS and SIS as shown in Figure 15-1. In this design option, the BPCS could be used as an independent layer of protection, assuming that a shutdown function was included in the control logic. Although the BPCS can only provide a risk reduction factor of 10, it effectively lowers the SIL requirement for the SIF. The SIF itself can be analyzed for risk reduction. For comparison, a combined risk reduction factor can be calculated. The results are shown in Table 15-5. 

In a loo2 architecture, two elements are available to perform the shutdown function and only one is required. This can be represent by an AND gate for probability of dangerous failure (Figure C-10). 

In modelling ATWS accidents, it is essential to determine the critical points in time for intervention, i.e. when the recovered shutdown function is able to reduce the consequences to an acceptable level. It is necessary to determine the time when FPR and emergency protection signals are generated and when the set points are reached for warning signals to appear at the operator s console. 

The shutdown function in PHWRs is achieved by the reactor protection system which is capable of completely terminating any of the postulated reactivity transients in the most reactive state of the core. The characteristic design parameters specified for the system are ... 

The temperature at which the shutdown function engages is determined by the melting point of the polymer of which the separator is composed. Figure 1.13 shows the... 

By laminating conventional polyethylene and polypropylene microporous membranes together, it is possible to obtain a separator with the desired shutdown function together with protection from rupture. Microporous membrane of liquid crystalline polyester, polyphenylene ether, aromatic polyamide, polyimide, polyamide imide resin, acrylic resin, and cross-linked polymer are now being studied as candidates for lamination with polyethylene in order to gain even greater heat resistance. 

Apart from this automatic shutdown function which is an "ultimate safety" feature, there is a conventional protection system which initiates scram when operation limits are exceeded. Such scrams are performed by means of a scram valve, letting pool water in to the recirculation pump suction side. In addition, the reactor can be shut down by boron Injection via the normal control system. 

This small BWR concept (Figure 1) uses an isolation condenser to improve transient response. Gravity-driven control rods and gravity-driven borated water injection are used to simplify and provide diversity to the shutdown function. Core cooling and decay heat removal are provided by depressurizing the reactor to an elevated suppression pool. The drywell and pool gas spaces are inert. 

NOTE 1 For example, if a failure of the BPCS oan result in a pressure loop becoming uncontrolled in a potentially hazardous manner, it Is not logioal to presume that a shutdown function, intended to be performed by the same errant BPCS, would funotion oorrectly. 

The 87 horizontal control rods are hydraulically driven and can be extended through the active zone of the reactor Approximately half of them enter from each side of the reactor block The rod system provides both operating control and rapid shutdown functions of the reactor. This Is accomplished by having all rods water cooled and by having the Individual rod drives capable of rapid Insertion from any position as well as slower drive speeds for fine control of reactor flux... 

The ball safety channels provide a completely Independent nuclear control system to back-up the shutdown function of the horizontal rods. The control elements for this system are 3/8 Inch diameter ceramic balls containing neutron absorbers. Ball hoppers are embedded In the top biological shield over each of the IO8 vertical channels. The hopper gates, designed to open In case of an electric power failure, as well as upon appropriate safety-circuit signal, allow the balls to enter the channels by gravity. 

SIS documentation consistent with installed system SIFs perform as specified with invalid process variables Proper shutdown sequence activated Proper alarm and display by SIS Correct computations included in SIS Bypass and manual shutdown function correctly Reset of SIS functions as per SRS Proof test interval included in maintenance procedure Diagnostic alarm performs as required SIS performs as required in case of loss of power SIS goes to desired state on power resumption SIS EMC immunity as per SRS... 

Emergency boron injection after the loss of reactor shutdown functions with core cooling by diversified secondary cooling system powered from modified non-safeguard buses. 

Fire detection and suppression measures shall be provided in order to protect the safe shutdown function in fire. 

Fire mitigation measure like fire resistance wall, fire barrier, distance, and sor forth which mitigate the fire effect to safe shutdown functions. 

The fire hazard analysis demonstrates that the plant will perform safe shutdown functions and minimize radioactive release to the environment in the event of fire. 

The following example shows how a piece of control equipment might be justified to be not safety-related. Assume that this programmable distributed control system (say a DCS for a process plant) causes various process shutdown functions to occur. In addition, let there be a hardwired emergency shutdown (presumably safety-related) system which can also independently bring about these shutdown conditions. 

Figure 8.2 OtF-070—process shutdown functions PAHH, LAHH, LALL.

---