The short answer first. The part of an Engineered Safety Features Actuation System (ESFAS) sequence that goes wrong most often is not signal generation. It is what happens after actuation: seal-in and reset. A safety actuation, once started, must go to completion even if the initiating signal disappears, and signal reset and equipment return must be two separate, deliberate operator actions. A design that ties both to one reset button can stop its own safety function with a single push.
Start with the safety interlock conditions
Unlike a reactor trip, ESFAS moves equipment. It starts pumps, opens or closes valves, and shuts isolation dampers. So the interlock definition starts with “what is allowed to block an actuation?” The principle is simple: the only thing that may block a safety actuation is a deliberate manual block under a permissive condition. Signals from non-safety systems and normal-operation interlocks do not block a safety actuation.
- □ Confirm that in each actuated component’s control circuit, the ESFAS actuation signal overrides normal-operation interlocks (for example, low-level start inhibits or lube oil pressure start inhibits). Verify the priority in the wiring, not only in software settings.
- □ Confirm the actuation seal-in holds after the initiating signal clears, and define which way the seal-in goes on a momentary loss of channel power.
- □ Confirm reset is split into two steps: signal reset and equipment reset.
- □ Confirm signal reset is blocked while the initiating signal is still present.
- □ Confirm a manual block is possible only while the permissive is present, and clears automatically when the permissive condition goes away.
- □ Confirm the system-level manual actuation switch can generate the actuation signal without passing through the automatic logic.
The actuation sequence, step by step
The ESFAS sequence unfolds in this order. A process variable crosses its setpoint in the channel bistables, coincidence logic is satisfied, and the actuation signal is generated and sealed in. The sealed signal is distributed to equipment groups, pumps start, valves reposition, and position feedback from each component returns to the control room.
- Detection: measure the process variable (pressure, level, radiation, and so on) per channel and detect setpoint exceedance in the bistable.
- Coincidence: confirm the actuation demand by channel vote (typically 2-out-of-4 or 2-out-of-3).
- Seal-in: latch the actuation signal. From here on, it stays even if the initiating signal clears.
- Distribution: send the signal to equipment groups through train-specific (A/B) actuation relays, keeping electrical isolation between trains.
- Completion: equipment reaches its safety position and position feedback arrives. The safety action must run uninterrupted to this point.
- Signal reset: after confirming the initiating signal has cleared, the operator resets the signal. Equipment stays in its safety position.
- Equipment reset: the operator returns components to normal operation one by one, through individual controls.
IEEE 603 carries the principle that once a protective action is initiated it proceeds to completion, and that returning to normal requires deliberate operator action. That is why steps 6 and 7 are separate. In a configuration where signal reset also returns the equipment, the pump that was running stops and the isolation valve reopens at the moment of reset.
Seal-in and reset pseudocode (IEC 61131-3 ST)
(* I/O MAP - train A actuation logic example *)
(* %I2.0 : DI_ACT_DEMAND_2OO4 - coincidence satisfied *)
(* %I2.1 : DI_MANUAL_ACT_SW - system-level manual actuation (parallel hardwired path exists) *)
(* %I2.2 : DI_SIG_RESET_PB - signal reset pushbutton *)
(* %I2.3 : DI_PERMISSIVE_OK - permissive present (e.g. low-pressure operation) *)
(* %I2.4 : DI_BLOCK_SW - manual block switch *)
(* %I2.5 : DI_PUMP_RUN_FB - actuated pump running feedback *)
(* %I2.6 : DI_VLV_OPEN_FB - actuated valve open feedback *)
(* %Q1.0 : DO_TRAIN_A_ACT - train A actuation relay *)
(* %Q1.1 : DO_ACT_COMPLETE_LAMP *)
(* %Q1.2 : DO_BLOCK_ACTIVE_ALM *)
(* 1. Manual block: valid only while permissive present, clears automatically when it goes away *)
X_BLOCK := DI_BLOCK_SW AND DI_PERMISSIVE_OK;
DO_BLOCK_ACTIVE_ALM := X_BLOCK;
(* 2. Seal-in - holds after the initiating signal clears *)
IF (DI_ACT_DEMAND_2OO4 AND NOT X_BLOCK) OR DI_MANUAL_ACT_SW THEN
X_ACT_LATCH := TRUE;
END_IF;
(* 3. Signal reset - not allowed while the initiating signal remains *)
IF DI_SIG_RESET_PB AND NOT DI_ACT_DEMAND_2OO4 AND NOT DI_MANUAL_ACT_SW THEN
X_ACT_LATCH := FALSE;
END_IF;
DO_TRAIN_A_ACT := X_ACT_LATCH;
(* 4. Completion indication - based on equipment position feedback *)
DO_ACT_COMPLETE_LAMP := X_ACT_LATCH AND DI_PUMP_RUN_FB AND DI_VLV_OPEN_FB;
(* 5. Component control circuits have their own seal-in - signal reset does not stop or return them *)
(* Equipment return is by individual component control only (outside this logic) *)Comment 5 is the key. Even when the train actuation relay drops out, each component’s control circuit must hold its safety position through its own seal-in. Without that seal-in on the component side, no matter how strict the reset condition in item 3 is, the equipment returns the moment the reset is pressed.
Comparison of reset arrangements
| Arrangement | Reset action | Equipment on reset | Assessment |
|---|---|---|---|
| Single reset | One step | Returns at once | Risk of stopping action |
| Signal/equipment split | Two steps | Stays in safety position | Meets principle |
| Split + cause check | Two steps + condition | Stays in safety position | Recommended |
| Time-delayed auto reset | None | Returns automatically | Violates principle |
The conclusion sits in the third row. Splitting signal and equipment is not enough on its own; signal reset itself must be blocked while the initiating signal is still present. Otherwise the coincidence logic is satisfied again right after reset, the actuation signal reappears, and it collides with equipment the operator has already returned by hand.
The trap in permissives and manual blocks
Some actuation signals appear unnecessarily during normal startup and shutdown. For example, an actuation signal that only makes sense at low pressure will come in unwanted when the system is depressurized after cooldown. So the design lets the operator block it manually only while a permissive is present, and the block clears automatically once the permissive condition goes away.
What gets missed in the field is the direction of that automatic clearing. If the block switch is maintained-contact and the permissive is only ANDed in the logic, the block clears when the permissive goes away, but the switch is still in the block position. The next time the permissive comes back during a later cycle, the block is reapplied without any operator intent. A momentary block switch, latched and cleared inside the logic, keeps intent and state aligned.
Boundary conditions
This design goes wrong when it comes to protecting the actuated equipment itself. If a running pump loses suction or its motor is overloaded and the seal-in keeps it running, the equipment is damaged. So some equipment protection must remain active during a safety actuation, or the operator must be able to stop an individual component on judgment, and which protections stay active has to be decided jointly by the safety analysis and the equipment design. Seal-in must not be read as “cannot be stopped under any circumstances.”
The single decision rule: confirm that signal reset changes the state of no equipment at all; if it does, rebuild the reset structure before anything else.
