INTERNATIONAL PRACTICE

HISTORY BACKGROUND DOCUMENT

Protective Systems

IP 15-7-2
Page 1 of 2 Rev. 1 June 1999

BACKGROUND HISTORY DOCUMENTATION FOR CORRESPONDING PARAGRAPHS OF IP 15-7-2 (REV. 1)

S S,O S
[H] [H] [H]

5.1 5.2 5.3

This requirement insures compliance with the fail to safe position concept embodied in this IP 15 7 2. This requirement allows a single hardware system to execute the protective system function required. This requirement allows a single hardware system to execute the protective system function required without connection to other equipment which would impair its performance. This requirement is a further delineation of Par. 5.3 . This requirement allows a single hardware system to execute the protective system function required without connection to other equipment which would impair its performance. Enhances system performance by limiting access to the equipment in terms of its modification or bypass. This requirement meets the needs of system electrical classification. This requirement deals with a common problem for performance of pneumatic systems. Zero time delay on flame scanners reduces fire losses The objective of this paragraph is to insure that the cause of the protective system actuation is seen and corrected before the system is placed back in service. This requirement limits logic type to the only acceptable methods. This paragraph extends Par. 6.10 to require bypass alarms. This requirement insures that sensor signals will be acted upon promptly. Adequate system diagnostic tests are needed to insure system performance. Independent communication between individual modules that are part of the same system to insure equipment performance. This is a further delineation of Par. 6.23. Software used for equipment programming needs to be generally suitable for the purpose intended. An Emergency actuator for the manual operation of each protective system is needed. It allows the operator to take independent emergency action when events not monitored by the protective system occur. Operator information from priority one alarm systems just prior to the automatic actuation of a protective system is needed. Provides for operator information when any protective system has been bypassed. This paragraph is a further delineation of Par. 7.7 . Environmental equipment may impact safety integrity. This requirement provides for integrity of the power system used to run the protective system equipment which is as essential as the system itself. Power circuits that supply protective systems need to be designed to preclude power failure.

S,O S

[H] [H]

5.4 5.5

S R,S S S S

[H] [H] [H] [H] [H]

5.6 5.7 5.10 6.5b 6.6

R,S S,O S,O S,M S,O

[H] [H] [H] [H] [H]

6.10 6.18 6.20 6.21 6.23

S S,I S

[H] [H] [H]

6.24 6.25 7.1

O,S

[H]

7.4

S O,S S,R O,S

[H] [H] [H] [H]

7.7 7.8 7.9 8.1

S,R

[H]

8.6

THIS INFORMATION FOR AUTHORIZED COMPANY USE ONLY EXXON RESEARCH AND ENGINEERING COMPANY FLORHAM PARK, N.J.

IP 15-7-2
Page 2 of 2 Rev. 1 June 1999

HISTORY BACKGROUND DOCUMENT

Protective Systems

INTERNATIONAL PRACTICE

S R,S

[H] [H]

8.9 9.4

This is a further delineation of Par. 8.1 above. This requirement addresses the simplicity of sensor inputs and actuator outputs. Multiple inputs and outputs defeat system integrity hence the are not allowed. This requirement extends fireproofing needs to protective systems. Redundancy requirement is a safety issue. This requirement is needed to prevent system operating problems on account of radiation sources near the flame scanner. This requirement deals with common mode failure due to plugged process taps. Selectable failure of sensors is a safety issue. This requirement is directed toward new software controlled process transmitters minimum requirements. Manual reset is needed to force operator attention to the specific process problem associated with protective system actuation. Manual movement of protective system valve would defeat the purpose of the protective system. Sliding stem valves with metal seats are specified to obtain the level of operating integrity consistent with a protective system. Multiple solenoid valves are required to overcome the single failure of a valve causing system actuation. External linkages permit an easy defeat of the protective system valve hence they are not allowed. Excessively long operating times will defeat timely system operation. Multiple function valves defeat system integrity and are not allowed. protective system use. Valves must be dedicated to

S S,R S,R

[H] [H] [H]

9.5 10.1 10.6

S,O S,O R,S S

[H] [H] [H] [H]

10.7 10.8 10.12 11.1

S S

[H] [H]

11.2 11.3

S S,R S M,S

[H] [H] [H] [H]

*11.4 11.7 11.8 11.9

[H]

11.10

Valves that use multiple forms of energy for operation will fail to operate is any of the sources are not available. Hence the requirement for backup of all sources of energy. Valves must operate at design conditions . Non ferrous materials such as aluminum and brass are not allowed do to the possibility of melting at high temperatures. On-line testing is required because the system must be tested and most process units run lengths exceed testing needs. Testing frequency of the protective system is a safety issue. Defeat of valve actuation through incorrect use of block and bypass valves is not acceptable. e. f. Defeat of the protective system by a bypass switch must be indicated to the operator. Loss of power to protective system test equipment must not cause the system to actuate.

S S

[H] [H]

11.11 11.12

S,R

[H]

12.1

S,O S S S

[H] [H] [H] [H]

12.2 12.3 12.5 12.5

Notes: (1) (2) Each paragraph to identify the Purpose Code(s) of the corresponding paragraph number of the applicable International Practice (IP) The symbol [ H] is used to denote all History Background Paragraphs which are for INFORMATION ONLY.

THIS INFORMATION FOR AUTHORIZED COMPANY USE ONLY EXXON RESEARCH AND ENGINEERING COMPANY FLORHAM PARK, N.J.