Spurious Shutdown Causes

There are many direct or indirect causes for the occurrence of spurious shutdowns. The main ones are as follows [14]  

It is to be noted that a spurious trip generally, but not always, results in spurious shutdown of the ongoing process. More clearly, in regard to process equipment failures, a spurious closure/stop of non-SIS equipment, like control valves and pumps that interact with the ongoing process, may lead to spurious shutdown. The spurious closure of control valves or the spurious stop of pumps may be due to factors such as element internal failures, automatic control system errors, and human errors. 

The International Electrotechnical Commission (lEC) comprising all national electrotechnical committees (i.e., lEC National Committees) is a worldwide organization concerned with standardization. lEC was established in 1906 

Two standards (i.e., lEC 61511 and lEC 61508) produced by lEC, directly or indirectly, in regard to SlSs are discussed below, separately. 

---

There are many causes for the occurrence of SO, spurious trip, and spurious shutdown. Causes for each of these three items are presented below, separately. 

Inputs - Redundancy, such as 2oo2 and 2oo3, can be employed on the inputs to prevent a single, safe failure of a device or circuit from causing a spurious shutdown. The inputs can also be connected to separate input modules on the logic solver to increase reliability even further. 

When modeling the failure to respond event the one out of two arrangement represents redundancy and the two subsystems are said to be parallel in that they both need to fail to cause the event. Furthermore the component failure rates used will be those which lead to ignoring a genuine signal. On the other hand, if we choose to model the spurious shutdown event the position is reversed and the subsystems are seen to be series in that either failure is sufficient to cause the event. Furthermore the component failure rates will be for the modes which lead to a spurious signal. 

Partial disruption of the core could inhibit the insertion of some control rods under this accident situation, causing a local criticality condition as the core cools down, due to the negative temperature coefficient of reactivity of the fuel. Modifications were made to supplement a number of control rods with a facility to inject boron beads from storage hoppers above the core into in-core thimbles. This secondary shutdown system is automatically triggered by differential pressure sensors the beads can be recovered from the thimbles and returned to the hoppers in the event of a spurious operation. 

Reactor shutdown due to simultaneous insertion of all absorber rods into the core by gravity if the CRA drives are de-energized. CRA drive de-energization is provided automatically or manually in the case of abnormal conditions (e g. in the event of pressure rise in the primary circuit). The number of self-actuated devices corresponds to the number of CRA drives. Their design and location in the GV decreases the possibility of spurious and subversive actions causing the devices to fail. 

With DTT, a blown fuse, an open wire, or any power disruption results in a transition of the SIF to the safe state. Although the SIF is configured to go to the safe state, spurious trips can cause additional safety and/or economic issues. This can be a major concern for continuous operations, where a spurious trip can result in a loss of several million dollars and potential safety concerns that always accompany a shutdown and resulting re-startup. Consequently, it is important when designing a DTT system that power supply redundancy and battery back-up are provided to minimize the probability of spurious trips. In addition to implementation of reliable power supply systems, proper maintenance of the power supply... 

Power Supply. An energize-to-trip (ETT) design means that power is required for the SIF to achieve the safe state. ETT was predominantly implemented in the past to overcome poor reliability of the main power supply system. When de-energize-to-trip is used with no alternate power source (e.g., uninterruptible power supply), a dip in power results in the process going to the safe state. This causes major financial loss and potential safety concerns that normally accompany a process trip and restart. To overcome poor power supply reliability, some facilities chose to implement ETT in order to maintain process reliability. These circuits have the inherent advantage that a loss of power does not result in a spurious trip, hence improved process uptime can be achieved. The disadvantage is that power is required to safely shutdown the process, so loss of power presents the potential for a failure to trip on demand situation. 

In the case of de-energize type logic set of contacts, opens to trip or shutdown the system (in case of energize to trip logic, contact closure will be considered for trip also series, parallel configuration types will be reversed). When trip is associated with proper cause it is safe failure. When this is NOT, then it is spurious/nuisance trip or shutdown. As per lEC 61508 Demand or failing element commands output to a safe state. 

The economic impact of a spurious or nuisance trip of an ESD system can be disastrous. An ESD system is an important layer of protection to prevent and prevent hazardous situations from occurring. So, it is needless to mention that the ESD system must be extremely reliable and function on demand. During an emergency, it must put the process in a safe state in orderly fashion. Also ESD systems design shall be based on a fail safe independent system, that is, ESD systems are such that during a failure of a component the process reverts to a condition considered safe and not a vulnerable serious hazardous event. Reliability and availability are major parameters for ESD system performance. Reliability is a function of system failure rate (its reciprocal) and mean time between failures. Spurious trip conditions may initiate a so-called fail safe incident that may result in accidental shutdown of equipment or processes. However, undetected process design errors or operations may initiate dangerous incidents that may disable the safety interlock and may even cause accidental process... 

On three occasions in Summer 1989, the reactor was stopped by automatic emergency shutdown, the negative reactivity threshold (-10 pcm) being exceeded. This reactivity variation was very fast first a minimum after 50 ms followed by an increasing oscillation, and then a decrease, caused by the control rod drop, 200 ms after the start of the transient. The first two events were thought to be spurious (a neutronic chamber fault) and the reactor was restarted. The normal plant instrumentation did not allow proper recording of the transient so following the second trip special instrumentation was instiled. After the third trip, the reactor was shut down in order to identify the cause of the events. 

Similar to mode 2 in effect but leaving no choices on production losses. All forms of shutdown mean a loss to the business. In addition there are potentially increased costs for wear and tear on the main plant equipment as crash shutdowns occur. There is often an increased risk of hazards due to the disturbances caused by an unscheduled trip followed by the risks of operation under hastily recovered start up conditions. Measures to reduce spurious or nuisance trips are therefore likely to show benefits for the life cycle cost. 

A plant trip arising out of an overt or detected equipment failure in the SIS or an erroneous assessment of the situation (e.g. error in the logic functions). A shutdown is initiated, though no real impairment of safety exists. Also referred to as a false trip or a nuisance failure . Spurious trips can contribute to the hazard rate of the plant through the disturbances so caused. 

An increase in reactor coolant flow will result from either a spare Brayton inadvertently starting whiie the plant is operating at full power (and the associated loop valve(s) opening) or by an increase in the speed of an operating Brayton. If the increased flow is from a spuriously started spare Brayton, shutdown of that Brayton will return flow to normal levels. If it is caused by an increase in the speed of an operating Brayton, the PLR could be used to reduce speed or a control valve could be used to shut the Brayton down. Any increase in primary flow could also increase the HRS heat load. HRS flow control actions could also be required. 

---