Functional Safety 2014

vii) Works but too often, too quickly

or too early, causing spurious trips

Plant shutdown and restart are often the most dangerous phases of

operation. This category of errors particularly due to incorrect software

techniques, wrong blocks, incorrect implementation:

•

Incorrect timers (usually too short)

•

Trip settings too low

•

Wrong software techniques – e.g. permissive programmed as a trip

•

Configured to automatically generate a trip on failed transmitter when not required

Neil Wakeling, August 2014