"De-energise to trip" is a long established principle because of the danger of common cause failures. Although there is little published on this topic, it is covered in the section "Protection systems (trips and interlocks)" in the HSE Technical Measure Document for COMAH sites, but the quality of UPS, diagnostics etc. is now very different from the last century. As well as the obvious effects of architecture, failure modes and frequency on the number of spurious trips and failures to dangers, we have also studied the relationships between design policies, (for example, overrides and diagnostic coverage), testing policies, repair policies, operating policies and their effects on common cause failures. The effects of different policies on spurious trips and failures to danger would be illustrated with practical examples from the energy industry: oil and gas production and power stations.
展开▼
