Shutdown systems design process

Green, D. L., and A. M. Dowell (1996). Cookbook Safety Shutdown System Design. i996 Process Plant Safety Symposium, Volume 1, April 1-2,1996, Houston, TX, ed. H. Cullingford, 552-565. Houston, TX South Texas Section of the American Institute of Chemical Engineers. 

The Canadian licensing philosophy requires that each accident, together with failure of each safety system in turn, be assessed (and specified dose limits met) as part of the design and licensing process. In response, designers have provided CANDUs with two independent dedicated shutdown systems, and the likelihood of anticipated transients without scram is negligible. 

To develop a safe design, it is necessary to first design and specify all equipment and systems in accordance with applicable codes and standards. Once the system is designed, a process safety shutdown system is specified to assure that potential hazards that can be detected by measuring process upsets are detected, and that appropriate safety actions (normally an automatic shutdown) are initiated. A hazards analysis is then normally undertaken to identify and mitigate potential hazards that could lead to fire, explosion, pollution, or injury to personnel and that cannot be detected as process upsets. Finally, a system of safety management is implemented to assure the system is operated and maintained in a safe manner by personnel who have received adequate training. 

Design and maintain a system for process upset detection and shutdown—RP 14C. 

Generally, electrical control systems are designed Fail-Safe. If power is temporarily lost, unnecessary shutdown of the process may occur. Thus, most safety systems such as fire and gas detectors, Nav-Aids, communications, and emergency lighting require standby D.C. power. 

In general, the safety of a process relies on multiple layers of protection. The first layer of protection is the process design features. Subsequent layers include control systems, interlocks, safety shutdown systems, protective systems, alarms, and emergency response plans. Inherent safety is a part of all layers of protection however, it is especially directed toward process design features. The best approach to prevent accidents is to add process design features to prevent hazardous situations. An inherently safer plant is more tolerant of operator errors and abnormal conditions. 

Remote automatic—based on a sensing element, logic solver, and output signal to close the valve. In most cases, these automatic valves are designed to fail safe. Automatic isolation can be associated with the automatic activation of a shutdown system for equipment or a process unit. 

This case study embraces the design and validation of both standard and intelligent instrament applications, and briefly discusses special instrament systems (shutdown systems and analyzer packages). The number of instruments that can be involved with the dynamic operation of a pharmaceutical manufacturing process can be large (2000 to 3000 items). In most cases, they are... 

Process safety refers to the application of engineering, science, and human factors to the design and operation of chemical processes and systems. The primary purpose of process safety is to prevent injuries, fatalities, fires, explosions, and unexpected releases of hazardous materials. Process safety focuses on the individual chemical processes and operational procedures associated with these systems. A process safety analysis is used to establish safe operating parameters, instrument interlocks, alarms, process design, and start-up, shutdown, and emergency procedures. Process safety programs cannot completely eliminate risk they can only control or reduce those risks. 

SIS stands for safety instrumented system. SIS is designed to prevent or mitigate from happening of a hazardous event, by taking the process to a safe state whenever a predefined or predetermined conditions occur to the system. It is a combination of sensors, logic solvers, and final conttol elements. In PEs, it consists of both hardware and software. In fact, emergency shutdown system (though shown separately in Fig. 1/ 7.0-2) will be a part of the same. There could be a number of SIF (defined next) in SIS. 

The economic impact of a spurious or nuisance trip of an ESD system can be disastrous. An ESD system is an important layer of protection to prevent and prevent hazardous situations from occurring. So, it is needless to mention that the ESD system must be extremely reliable and function on demand. During an emergency, it must put the process in a safe state in orderly fashion. Also ESD systems design shall be based on a fail safe independent system, that is, ESD systems are such that during a failure of a component the process reverts to a condition considered safe and not a vulnerable serious hazardous event. Reliability and availability are major parameters for ESD system performance. Reliability is a function of system failure rate (its reciprocal) and mean time between failures. Spurious trip conditions may initiate a so-called fail safe incident that may result in accidental shutdown of equipment or processes. However, undetected process design errors or operations may initiate dangerous incidents that may disable the safety interlock and may even cause accidental process... 

Mechanical structures of the core, supporting guides and of all parts of the kinematics chain of the First Shutdown System are of particular interest within this series of tests. Complex assemblies and structures like Steam Generator Units or ad-hoc mechanical solutions require the evaluation of manufacturing and assembly process before finishing the design stage. 

Some specific design guidance is given for pressure and flow control, gas holder control, burner control, fire and gas detection and process shutdown systems. 

Process optimization, process management, trend analysis, alarm processing, control-system design, and adaptive control Enhancement of classical controller performance by sensor failure identification, valve saturation, and process constrains Fault detection, diagnosis, and troubleshooting Supervisory control of simple PID-like controller and startup or shutdown procedures... 

Regarding the control of accidents within the design basis (DID Level 3 in Table 4), the design of AHTR incorporates a mechanical reactivity control and shutdown system based on control rods with the external drives, and two diverse decay heat removal systems, of which one is passive and one is active. The reference AHTR design uses passive reactor vessel auxiliary cooling (RVAC) systems similar to that developed for decay heat removal in the General Electric sodium cooled S-PRISM reactor. Different from its prototype, the RVAC system of the AHTR relies not only on the processes of convection and conduction but on the radiation also. 

There is a similar concern that has to do with design. Should the possibilities for the operators to make UMIs be arranged for and even encouraged Or should the process be completely automatic in order to avoid any type of UMI A common solution to this question in the design of process plants is to allow the operators to intervene in the production process. If the situation deteriorates further to the point where the emergency shutdown system takes over, this shutdown is pre-programmed, and the operators are not allowed to intervene to stop it. 

An extraction plant should operate at steady state in accordance with the flow-sheet design for the process. However, fluctuation in feed streams can cause changes in product quaUty unless a sophisticated system of feed-forward control is used (103). Upsets of operation caused by flooding in the column always force shutdowns. Therefore, interface control could be of utmost importance. The plant design should be based on (/) process control (qv) decisions made by trained technical personnel, (2) off-line analysis or limited on-line automatic analysis, and (J) control panels equipped with manual and automatic control for motor speed, flow, interface level, pressure, temperature, etc. 

Normal Operation. The designer of a chemical plant must provide an adequate interface between the process and the operating employees. This is usually accompHshed by providing instmments to sense pressures, temperatures, flows, etc, and automatic or remote-operated valves to control the process and utility streams. Alarms and interlock systems provide warnings of process upsets and automatic shutdown for excessive deviations from the desired ranges of control, respectively. Periodic intermption of operations is necessary to ensure that instmments are properly caUbrated and that emergency devices would operate if needed (see Flow measurement Temperaturemeasurement). 

---