Emergency shutdown time delay

[mustafahh]

Hello everybody,

One of my coworkers brought this question to me. Based on what should we set the time delay for rotating equipment emergency shutdown is there specific standards on the API, ISO or whatever ?
For example, some compressors are set to shutdown if the vibration exceeds the specified shutdown limit if it stays for 3 seconds. Other machines are set to trip if vibration continues for 5 seconds and so on.

Thank you,

 

[electricpete]

I have an old standard (API 670-1993 - Vibration, Axial Position, and Bearing Temperature MonitoringSystems) which implies 100 milliseconds max from detection to initation of shutdown

3.5.1.1.p. The time required to detect and initiate an alarm (alert)
or a shutdown (danger) shall not exceed 100 milliseconds.

So I think using any time delay to try to avoid spurious trips is not a generally accepted approach. Some alternate strategies to the same end may include:
1 - voting logic which trips only if the signal is seen by 2/2 or 2/3 or 3/4 etc.
2 - Standard FMEA circuit review
3 - suitable selection of setpoints, including alert to operators to allow investigation prior to shutdown in many cases, as well as trip setpoint not so low that it trips during normal expected system transients.


=====================================
(2B)+(2B)' ?

 

[JJPellin]

We have machines with trips designed with delays between zero and 30 seconds. There is no standard that I am aware of that dictates the delay. We use an analysis method that considers the risk associated with a failure to trip or a spurious trip associated with all of the potential causes. If a delay can reduce the risks associated with the spurious trip while still retaining the protection needed for the real trip, then a delay is acceptable. But, this analysis is needed. Do not accept a zero delay to reduce secondary damage to equipment if the increase in spurious trip risk will result in danger to personnel.

As already noted, use voting schemes where practical to reduce the spurious trip risk. But, for a real event such as a trip of the main lube oil pump, you may need to consider adding a delay to allow time for the auxiliary pump to come up to speed and avoid a unit shut down. This is especially true if the unit shut down involves some inherent great risk to personnel.

A delay can be used to allow a system to make it through a transient event that would not necessarily create a hazard greater than the hazard associated with the trip. It can give the control system time to regain control. Every situation must be analyzed individually.

Johnny Pellin

 

[mustafahh]

electricpete & JJPellin, thanks for your response.

Is there any logic where we can rely on such as machine speed or HP ? I think the time delay should be less for higher speed machines. But I don't have any clue for that.