Shutdown trips

Figure 5.29. (a) Trip as part of control system, (b) Separate shutdown trip. 

EMERGENCY SHUTDOWN TRIPPED BY LOSS OF 225 KV AUXILIARY POWER... 

Emergency shutdown tripped by loss of 225 kV auxiliary power... 

Release of Reserve Shutdown Control Material o Main Loop Shutdown Trip Circuits... 

Transient operations (namely, startup/shutdown/trip condition)... 

I WITH CONTROL WITH RESERVE ROD TRIP 1 SHUTDOWN TRIP 2600 A r WITH KSIRVE... 

Arrangements have been provided to allow the operation of the channel emergency cooling system to be tested whilst the reactor is running. Similarly, the liquid shutdown trip valves are designed for testing Individually whilst the reactor is in operation. 

Various protective instruments are used to provide a shutdown signal (to a fast-acting trip valve at the expander inlet) that senses various things, such as overspeed, lubricant pressure, bearing temperature, lubricant temperature, shaft runout, icing, lubricant level, thrustbearing load, and process variables such as sensitive temperatures, levels, pressures, etc. However, too many safety shutdown devices may lead to excessive nuisance shutdowns. 

Safety systems are typically divided into emergency trip/shutdown functions, controlled (slow) shutdown, alarm activation, or startup annunciation of auxiliary equipment such as oil pumps. 

An expander emergeney trip valve, eapable of elosing in less than one-half seeond, must be installed elose to the expander inlet flange. A 60-80 mesh sereen, differential pressure monitor, and shutdown must be installed between the trip valve and the expander inlet. Additionally, it is highly reeommended that a 40-60 mesh sereen be installed upstream of the eompressor inlet for use during the initial startup period. 

First-out annuneiators are highly desirable and should provide suffieient points to aeeommodate the speeified alarm and shutdown funetions. Standard features should inelude aeknowledge/silenee, lamp/test, and both audible and visible deviees for general alarm indieation. A dry auxiliary eontaet from the shutdown eireuit must be provided for expander inlet trip valve aetuation. Additional sets of eontaets are useful for other alarm requirements. 

Sfart-up/shutdown Provide for safe start-up, including purging if necessary Provide for safe shutdown Normal By a trip On standby In various emergency situations, etc. 

The same system, but with an on-off pressure switch set to activate the emergency shutdown system if the pressure reaches the predetermined point. The pressure switch remains inactive as long as the pressure is below its trip point. 

Trips and interlocks should be tested after a major shutdown, especially if any work has been done on them. The following incidents demonstrate the need to test all protective equipment ... 

Trips should normally be designed so that they operate if the power supply is lost. If this will cause a dangerous upset in plant operation, then an alarm should sound when power is lost. Trips should be tested at startup if they have been worked on during a shutdown. Particularly important trips, such as those on furnaces and compressors and high-oxygen concentration trips, should always be tested after a major shutdown. 

The study performed by Burns and Roe (BSR) shows that valve failures constitute the component category most responsible for the shutdown of PWR and BWR plants. This Investigation, contracted with SNL for DOE, identified the principal types and causes of valve failures that led to plant trips for the period from 12/72 to 12/78. The primary sources of data for the report were searches of the data base, the monthly Gray Books, Nuclear Power Experience publications, as well as discussions with utilities, valve manufacturers, and suppliers. 

The shutdown system will have adequate interlocks to prevent inadvertent trips. The system must include two-out-of-three voting or backup instruments. The operators must trust the system for it to remain in service. 

Each of these steps might be performed either by direct action of operations or emergency response personnel or by automatic systems. An example of the latter might be an array of toxic or flammable gas detectors that might trip an emergency shutdown system that closes remotely actuated block valves and vents off the process pressure to a flare if two adjacent sensors read above a predetermined vapor concentration. 

Failures can either be fail-safe or fail dangerously. Fail safe incidents may be initiated by spurious trips that may result in accidental shutdown of equipment or processes. Fail dangerously incidents are initiated by undetected process design errors or operations, which disable the safety interlock. The fail dangerously activation may also result in accidental process liquid or gas releases, equipment damage, or fire and explosions. 

An example of a causal factor chart for a relatively simple incident is shown in Figure 9-8. In this example, there are two redundant pumps, one of which is required to supply feed to a reactor downstream. The operator is requested to change-over operation from Pump A, which is running, to Pump B, which was previously shutdown. Instead of opening Pump B suction valve, the operator opens the wrong valve, causing the Reactor to trip on low flow detection. 

Before the incident, the facility had experienced a power failure that led to the shutdown of an olefins unit. For several hours, a restart had been attempted and the compressor had tripped on high vibration at low speed. This caused the check valve to close, which placed additional stresses on the valve shaft. Failure to execute a smooth planned start-up was a key contributor to the timing of this incident. However, given the design defects inherent in the valve, an ultimate failure was inevitable. 

The plant shutdown (which distracted the operators and made the electric fire water pump unavailable) was caused by a thunderstorm that tripped the primary feeder and no backup feeder was installed. The unit should be designed to shutdown safely on loss of power. (Process hazards analysis)... 

---