System Shutdown

N. L. Conger, "Designing Safety Shutdown Systems A Systematic Approach," Proceeding of Instrument Society of America Conference, ISA/73, Paper 73-756, Houston, Tex., 1973. 

The fact that batch processes are not carried out at steady state conditions imposes broad demands on the control system. The instrumentation and control system have to be selected to provide adequate control for a wide variety of operating conditions and a wide variety of processes. In addition, basic process control and shutdown systems have to deal with sequencing issues. This chapter presents issues and concerns related to safety of instrumentation and control in batch reaction systems, and provides potential solutions. 

Emergency shutdown systems/valves not readily accessible. 

Gruhn, P. and Cheddie, El. 1998, Safety Shutdown Systems Design, Analysis and Justification, ISA. 

Emergency Shutdown Device A device that is designed to shutdown the system to a safe condition on command from the emergency shutdown system. 

Emergency Shutdown System The safety control system that overrides the action of the basic control system and shuts down the process when predetermined conditions are violated. 

The eomplex FCC system involves not only turbomaehinery, but also related proeess eomponents. All of these must be properly designed and sized to operate within system parameters from startup to steady state design point, and through shutdown. System response to emergeney eonditions is also mandatory. Computer simulation is, therefore, an integral part of the design proeess. A eomputer program eapable of this simulation is deseribed below. 

Car-Sealed Closed Valve - In certain cases it may be advantageous to use car sealed closed valves, such as in a bypass around a fuel gas control valve used for furnace flameout protection. The bypass is provided so that the automatic shutdown system can be periodically checked for operation. Where CSC valves are used for other purposes, they are also limited to appUcations where inadvertent opening of the CSC valve would not overpressure the equipment by more than 1.5 times design pressure. 

Active—Using controls, safety interlocks, and emergency shutdown systems to detect and correct process deviations e.g., a pump that is shut off by a high level switch in the downstream tank when the tank is 90% full. These systems are commonly referred to as engineering controls. 

A pressure sensor giving a continuous indication which is displayed on the control panel and can be observed by the operator. The sensor has a high pressure safety interlock set at a predetermined pressure that activates an emergency shutdown system. 

The same system, but with an on-off pressure switch set to activate the emergency shutdown system if the pressure reaches the predetermined point. The pressure switch remains inactive as long as the pressure is below its trip point. 

Green, D. L., and A. M. Dowell (1996). Cookbook Safety Shutdown System Design. i996 Process Plant Safety Symposium, Volume 1, April 1-2,1996, Houston, TX, ed. H. Cullingford, 552-565. Houston, TX South Texas Section of the American Institute of Chemical Engineers. 

The Canadian licensing philosophy requires that each accident, together with failure of each safety system in turn, be assessed (and specified dose limits met) as part of the design and licensing process. In response, designers have provided CANDUs with two independent dedicated shutdown systems, and the likelihood of anticipated transients without scram is negligible. 

To develop a safe design, it is necessary to first design and specify all equipment and systems in accordance with applicable codes and standards. Once the system is designed, a process safety shutdown system is specified to assure that potential hazards that can be detected by measuring process upsets are detected, and that appropriate safety actions (normally an automatic shutdown) are initiated. A hazards analysis is then normally undertaken to identify and mitigate potential hazards that could lead to fire, explosion, pollution, or injury to personnel and that cannot be detected as process upsets. Finally, a system of safety management is implemented to assure the system is operated and maintained in a safe manner by personnel who have received adequate training. 

Assume that two levels of protection are adequate. Experience in applying FMEA analysis to production equipment indicates that in many cases only one level of protection w ould be required, given the degree of reliability of shutdown systems and the consequences... 

The shutdown system will have adequate interlocks to prevent inadvertent trips. The system must include two-out-of-three voting or backup instruments. The operators must trust the system for it to remain in service. 

Maintain a mitrimum of 1 PSi pressure differential across the Slide Valves Install "Radial designed Feed Nozzles Install an automated shutdown System... 

Gruhn, P., et al., Safety Shutdown systems Design, Analysis, and Justification, ISA,... 

Mitigating events or mitigating factors act to impede the accident sequence, resulting in less severe consequences. Examples include detection and activation of emergency shutdown systems, operator intervention, spill containment, equipment spacing, natural dispersion, and reducing the... 

Overall effectiveness of protective systems and emergency controls. Protective systems, such as alarms, shutdown systems, and emergency controls, are often the keys to incident prevention and timely operator response. Protective systems that are properly designed, tested, and well maintained can reduce the frequency of event occurrence. Conversely, systems that are not tested and maintained may result in a high frequency of event occurrence. 

Since the aggregate risks from Process Unit 2 are largely the result of single event—brittle fracture—the qualitative hazard assessment identified potential safeguards that could be put in place to prevent a brittle fracture occurrence. It was decided that the best option would be to install an emergency shutdown system in Process Unit 2 to prevent pressuring the nitrogen vapor vessel if a cold temperature situation was present. 

Prior to installing a new shutdown system, however, a fault tree analysis was performed on the proposed modifications. From this study, it was concluded that the overall frequency of brittle fracture was lowered from 5x10"4 to 5 x 10-5 (occurrences/year). Using this new frequency in the calculation for aggregate risk would result in revised outcome frequencies and F-N data points, as shown below. 

Figures 6.3 and 6.4 show the adjusted F-N curves. With this risk reduction, the company s aggregate risk criteria would be met Therefore, the emergency shutdown system was installed and no further action was required.

In general, the safety of a process relies on multiple layers of protection. The first layer of protection is the process design features. Subsequent layers include control systems, interlocks, safety shutdown systems, protective systems, alarms, and emergency response plans. Inherent safety is a part of all layers of protection however, it is especially directed toward process design features. The best approach to prevent accidents is to add process design features to prevent hazardous situations. An inherently safer plant is more tolerant of operator errors and abnormal conditions. 

Figure 11-5 A chemical reactor with an alarm and an inlet feed solenoid. The alarm and feed shutdown systems are linked in parallel.

---