Spurious Trip Causes

SO of SIS parts or elements is one of the main contributors for the occurrence of spurious trips. It may result in a spurious trip if the number of activated parts or elements corresponds to the number of parts or elements required for performing the safety function. Thus, the chosen hardware configuration determines whether or not an SO results in a spurious trip. 

It is to be noted that there are several other causes for the occurrence of spurious trips. Some examples are as follows [14]  

---

The typical MAC is of the open contact Break Glass type, suitable for Division 1 locations. MACs should be covered with a guard to prevent inadvertent alarm activation. Alternatively, the MAC can be actuated by a pulling action (to prevent spurious trips caused by someone pushing the button by mistake). The emergency response system should tell the operators and ERT which MAC was activated. 

In some situations the sensitivity may need to be reduced and a higher tripping current used e.g. 100 mA or 300 mA. Fluorescent lighting systems and welding socket feeders are subject to a poor quality of current waveform due to non-linear characteristics of their loads. The distortion superimposed on the fundamental current may be sufficient to cause spurious tripping of a fast-acting 30 mA relay. 

Problem Three thermocouples are used to sense temperature in a reactor. The three signals are wired into a safety PLC, and a trip will occur if only one of the sensors indicates a trip. The probability of failure in the safe mode (causing a spurious trip) for a one-year mission time is 0.005. What is the probability of a spurious (false) trip ... 

Most practitioners define "Fail-Safe" for an instrument as a failure that causes a "false or spurious" trip of a safety instrumented function unless that trip is prevented by the architecture of the safety instrumented function. Many formal definitions have been attempted that include "a failure which causes the system to go to a safe state or increases the probability of going to a safe state." This definition is useful at the system level and includes many cases where redundant architectures are used. 

With DTT, a blown fuse, an open wire, or any power disruption results in a transition of the SIF to the safe state. Although the SIF is configured to go to the safe state, spurious trips can cause additional safety and/or economic issues. This can be a major concern for continuous operations, where a spurious trip can result in a loss of several million dollars and potential safety concerns that always accompany a shutdown and resulting re-startup. Consequently, it is important when designing a DTT system that power supply redundancy and battery back-up are provided to minimize the probability of spurious trips. In addition to implementation of reliable power supply systems, proper maintenance of the power supply... 

Power Supply. An energize-to-trip (ETT) design means that power is required for the SIF to achieve the safe state. ETT was predominantly implemented in the past to overcome poor reliability of the main power supply system. When de-energize-to-trip is used with no alternate power source (e.g., uninterruptible power supply), a dip in power results in the process going to the safe state. This causes major financial loss and potential safety concerns that normally accompany a process trip and restart. To overcome poor power supply reliability, some facilities chose to implement ETT in order to maintain process reliability. These circuits have the inherent advantage that a loss of power does not result in a spurious trip, hence improved process uptime can be achieved. The disadvantage is that power is required to safely shutdown the process, so loss of power presents the potential for a failure to trip on demand situation. 

This could worsen the Safety Culture if spurious trip rate is excessive, causing personnel to view these as nuisance trips. 

On account of advancement in technology, people go on adding feature after feature to the systems. It has been found many times these cause additional problems to the system, viz. in the form of spurious trips. It will not be pmdent to consider that... 

It is better to start the discussions with Fig. VII/1.4-5-1 from where it is clear that just by adding devices in redundant mode, the safety availability does not always increase, as there are pros and cons in each of the applications as shown in the first case, chances are more for spurious trip, in the second case, it is the other way round. So, a detailed study of various redundancy modes will be necessary. Dual configuration shown appears to be safe, but could also be the root cause of spurious trips due to random failures. Now the aim is to find advantages and disadvantages of implementation of various hardware redundancy architectures (industry specific and international standards). It is very useful to understand a few terms such as redundancy,... 

The economic impact of a spurious or nuisance trip of an ESD system can be disastrous. An ESD system is an important layer of protection to prevent and prevent hazardous situations from occurring. So, it is needless to mention that the ESD system must be extremely reliable and function on demand. During an emergency, it must put the process in a safe state in orderly fashion. Also ESD systems design shall be based on a fail safe independent system, that is, ESD systems are such that during a failure of a component the process reverts to a condition considered safe and not a vulnerable serious hazardous event. Reliability and availability are major parameters for ESD system performance. Reliability is a function of system failure rate (its reciprocal) and mean time between failures. Spurious trip conditions may initiate a so-called fail safe incident that may result in accidental shutdown of equipment or processes. However, undetected process design errors or operations may initiate dangerous incidents that may disable the safety interlock and may even cause accidental process... 

At least one functional safety assessment should be performed on each system, typically at the design stage before the system is commissioned. The functional safety assessment process should be performed by an assessment team which includes at least one competent person independent of the project design team. A functional safety assessment should be performed and revalidated after any modifications, mal-operation or failure to deliver the required safety function (a spurious trip which caused the safety system to action its functions successtully would not... 

Analyses in this study are performed to develop the format for the SRS. Some methodologies are suggested to obtain the values for several critical requirements such as common cause failure and spurious trip. However, the approach method for all of the requirements could not be described in more detail because there is no prescribe way for each requirement. A methodology which minimizes the incompleteness and uncertainty between practical data and assumed requirement should be developed. The development of the methodology for each requirement will be discussed in the further study. 

There are many causes for the occurrence of SO, spurious trip, and spurious shutdown. Causes for each of these three items are presented below, separately. 

What are the causes for the spurious trip of the safety instrumented systems ... 

Response time Too slow for process conditions too fast causing spurious trips on short surges. 

Panel based trip amplifiers As above. Responses to sensor failure modes are configurable High or low. Also affected by power siq ly failures. Beware of RFI problems causing spurious trips. 

Assume the 2003 relay stage uses 1 relay for the logic by using multiple contacts from the input stages. For the PFD and Spurious trip calcs assume the common cause factor is 10% and the proof test interval remains at 6 months. 

A plant trip arising out of an overt or detected equipment failure in the SIS or an erroneous assessment of the situation (e.g. error in the logic functions). A shutdown is initiated, though no real impairment of safety exists. Also referred to as a false trip or a nuisance failure . Spurious trips can contribute to the hazard rate of the plant through the disturbances so caused. 

The linear rate system should be Interlocked to bypass the exponential rate trips of the Intermediate Range Monitor after a power level of 10 has been reached This will reduce the possibilities of a failure in the Intermediate Range Monitor period func tlon causing a spurious scram when the Instrument Is no longer needed for exponentleil rate protection. 

There is a probability that a safety instrumented function will fail and cause a spurious/false trip of the process. This is called probability of failing safely (PFS). There is also a probability that a safety instrumented function will fail such that it cannot respond to a potentially dangerous condition. This is called probability of failure on demand (PFD). 

The mean time until a failure of the system causes a spurious process trip. 

No system is totally immune to failure with SIS in operation one can expect that it will always provide safe conditions when a failure occurs. Reliability with respect to SlSs can be conceived as its ability to command an output to a safe state on a process demand within desired response time without causing a spurious action such as nuisance process trip. With this basic idea, in the following clauses include brief discussions to present how both the issues could be addressed to get the best out of the two. At the beginning, it is better to understand meaning of various commonly used terms in connection with reliability. 

In the case of de-energize type logic set of contacts, opens to trip or shutdown the system (in case of energize to trip logic, contact closure will be considered for trip also series, parallel configuration types will be reversed). When trip is associated with proper cause it is safe failure. When this is NOT, then it is spurious/nuisance trip or shutdown. As per lEC 61508 Demand or failing element commands output to a safe state. 

A signal to trip the reactor spuriously or inadvertently (fault 4.1.1 in the fault schedule) could arise from the following causes ... 

It might cause some spurious reactor trips. 

On three occasions in Summer 1989, the reactor was stopped by automatic emergency shutdown, the negative reactivity threshold (-10 pcm) being exceeded. This reactivity variation was very fast first a minimum after 50 ms followed by an increasing oscillation, and then a decrease, caused by the control rod drop, 200 ms after the start of the transient. The first two events were thought to be spurious (a neutronic chamber fault) and the reactor was restarted. The normal plant instrumentation did not allow proper recording of the transient so following the second trip special instrumentation was instiled. After the third trip, the reactor was shut down in order to identify the cause of the events. 

Similar to mode 2 in effect but leaving no choices on production losses. All forms of shutdown mean a loss to the business. In addition there are potentially increased costs for wear and tear on the main plant equipment as crash shutdowns occur. There is often an increased risk of hazards due to the disturbances caused by an unscheduled trip followed by the risks of operation under hastily recovered start up conditions. Measures to reduce spurious or nuisance trips are therefore likely to show benefits for the life cycle cost. 

Spurious initiation may result from numerous causes, in particular, failures in the equipment, inadequate tripping margins on some parameters in relation to variations occurring in normal operation, or human error during interventions. These may result from the following ... 

Date SIF Demand/Spurious Cause of Trip Incident Report Recorded By... 

---