Spurious trip

Material of construction of sensor not suited for operating environment. Loss of sensing capability, leading to unwanted consequences such as spurious trips, overt (announced) and covert (unannounced) faults. 

Bee.iusa the nitrogen pressure was unreliable, it was difficult to maintain a pressure of 0.5 inch water gauge in the metal cabinet. Workers complained that the safety switch kept isolating the electricity supply, so an electrician reduced the setpoint first to 0.25-inch and then to zero, thus effeciocly bypassing the switch. The setpoint could not be seen unless the cover of the switch was removed and the electrician told no one what he had done. The workers though I lie wa,s a good electrician who had prevented spurious trips. Solvent and air leaked into the cabinet, as ilready described, and the next time the electricity supply was switched there was an explosion. 

Failures can either be fail-safe or fail dangerously. Fail safe incidents may be initiated by spurious trips that may result in accidental shutdown of equipment or processes. Fail dangerously incidents are initiated by undetected process design errors or operations, which disable the safety interlock. The fail dangerously activation may also result in accidental process liquid or gas releases, equipment damage, or fire and explosions. 

Tripping heat input to the reboiler The use of a single temperature or pressure cutoff cannot be relied on for tripping heat input (60) it may not function when the failure occurs. Two incidents have been reported (239), one where a pressure trip failed to operate and avoid overpressure, the other where a temperature trip behaved similarly. The use of two temperatvire or pressure cutoff switches, with one of them sufficient to trip the heat input, is more reliable, but is generally not recommended because it is likely to induce spurious trips. One satisfactory system that can often be relied on for reducing the relief requirements (60, 414) includes three or more (redundant) switches, with a "voting system. This may be expensive, but the expense can often be justified. 

In some situations the sensitivity may need to be reduced and a higher tripping current used e.g. 100 mA or 300 mA. Fluorescent lighting systems and welding socket feeders are subject to a poor quality of current waveform due to non-linear characteristics of their loads. The distortion superimposed on the fundamental current may be sufficient to cause spurious tripping of a fast-acting 30 mA relay. 

The typical MAC is of the open contact Break Glass type, suitable for Division 1 locations. MACs should be covered with a guard to prevent inadvertent alarm activation. Alternatively, the MAC can be actuated by a pulling action (to prevent spurious trips caused by someone pushing the button by mistake). The emergency response system should tell the operators and ERT which MAC was activated. 

The performance of MSM was not satisfactory due to failure of filament frequently and spurious trips due to noise pickup, etc. As the sputter ion pump current is a reliable signal, which is also proportional to leak rate, the logics were modified to take safety actions from sputter ion pump current in place of MSM signal. 

All the above modification improved the reliability of reactor protection system and spurious trips reduced. 

A separate fault tree can be created for each failure mode. This is useful in safety instrumented function verification. Figure 5-8 shows a fault tree for a spurious trip of the same safety instrumented function from Figure 5-6. Note that these two fault trees are models of two different failure modes in the same safety instrumented function. 

Problem Three thermocouples are used to sense temperature in a reactor. The three signals are wired into a safety PLC, and a trip will occur if only one of the sensors indicates a trip. The probability of failure in the safe mode (causing a spurious trip) for a one-year mission time is 0.005. What is the probability of a spurious (false) trip ... 

Most practitioners define "Fail-Safe" for an instrument as a failure that causes a "false or spurious" trip of a safety instrumented function unless that trip is prevented by the architecture of the safety instrumented function. Many formal definitions have been attempted that include "a failure which causes the system to go to a safe state or increases the probability of going to a safe state." This definition is useful at the system level and includes many cases where redundant architectures are used. 

Care must be taken in implementing PVST, particularly in high-energy conditions. In very high flow conditions the partial stroke test of the SIS valve could incur a response in the BPCS system and the resetting of the PVST could introduce an additional variable to the BPCS. This could impact otherwise unknown instabilities in the BPCS or SIS sensing system leading to a spurious trip. 

Although the solutions in this chapter focus on safety integrity evaluation, it must be remembered that the reliability of the system is also important since this impacts on the nuisance or spurious trips of the plant. TTiese trips can have a large impact on safety and cost. Therefore (Mean Hme To Fail Spurious) is also calculated. 

The process hazards analysis for this vessel stated that either high temperature or high pressure is an indication of a potential runaway reaction that may result in an explosion. The safety requirements specification states that the SIF shall be SIL 2 and a nuisance or spurious trip should be better than one in every five years. The process will be operated for mission time of ten years after which a major overhaul and rebuild will take place. 

Parameter U is used for probability malfunction RTS on demand. Parameter MTBSF is used for mean operation time between spurious trips. 

As illustrated in this example most of the failures related to topside compressors are related to the instrumentation and spurious trips. When developing a compressor for Subsea application, it will therefore be essential that these types of failures can be significantly reduced or eliminated. 

Various tests and data acquisition operations planned during the operation programme were continued during the 60 % NP steady state. Power was temporarily reduced several times to 50 % NP in order to conduct the last adjustments to the equipment of the electricity production facilities and to avoid automatic shutdown of the plant in the event of a spurious trip of a turbine. On another occasion, it was reduced to 40 % NP to enable repairing a steam inlet piping support, with the corresponding turbine shut down. 

The safety assessment of design in normal operation should verify that a reactor trip or initiation of the safety systems would occur only when required. Spurious trips or initiation of safety systems are generally detrimental to safety. 

NOTE 2 Other names used for safe failure are nuisance failure, spurious trip failure, false trip failure or fail-to-safe failure. 

I) Has a maximum acceptable spurious trip rate been specified for each SIF where necessary ... 

With DTT, a blown fuse, an open wire, or any power disruption results in a transition of the SIF to the safe state. Although the SIF is configured to go to the safe state, spurious trips can cause additional safety and/or economic issues. This can be a major concern for continuous operations, where a spurious trip can result in a loss of several million dollars and potential safety concerns that always accompany a shutdown and resulting re-startup. Consequently, it is important when designing a DTT system that power supply redundancy and battery back-up are provided to minimize the probability of spurious trips. In addition to implementation of reliable power supply systems, proper maintenance of the power supply... 

Power Supply. An energize-to-trip (ETT) design means that power is required for the SIF to achieve the safe state. ETT was predominantly implemented in the past to overcome poor reliability of the main power supply system. When de-energize-to-trip is used with no alternate power source (e.g., uninterruptible power supply), a dip in power results in the process going to the safe state. This causes major financial loss and potential safety concerns that normally accompany a process trip and restart. To overcome poor power supply reliability, some facilities chose to implement ETT in order to maintain process reliability. These circuits have the inherent advantage that a loss of power does not result in a spurious trip, hence improved process uptime can be achieved. The disadvantage is that power is required to safely shutdown the process, so loss of power presents the potential for a failure to trip on demand situation. 

NOTE For economic protection applications, ETT is often used on rotating machinery (e.g. compressors) where the consequences of a spurious trip can have serious financial considerations and where there is no risk of loss of containment due to... 

Selection of the SIS architecture is an activity performed during the conceptual design step of the safety lifecycle. The architecture has a major impact on the overall safety integrity of the SIS. The architecture also influences SIS reliability (likelihood of spurious trips). Some of the activities involved in determining the SIS architecture are... 

Faults initiating a safe response of the SIS without a demand Spurious trip due to a component fault... 

---