Boiler Safety Devices and Emergency Response

1. Why the protections exist

Every boiler protection corresponds to an accident that has already happened to someone else. Low-water trips exist because boilers have exploded when tubes were uncovered. Flame-failure trips exist because furnaces have exploded when unburnt fuel accumulated. Safety valves exist because pressure vessels have burst.

This means two things for the engineer:

• The protection is not an inconvenience. It is the accumulated experience of the industry.
• A protection that is bypassed does not remove the hazard. It removes the barrier between the hazard and the accident.

The steam-to-steam generator arrangement shows the protection boundary in one drawing: pressure controller, level controller, safety valves, gauge glass, feed and steam connections. Treat every start-up and every watch round as a check that each item in that boundary is present and working.

Danger: The rule that follows

If you cannot trust the protection, you cannot run the boiler.

2. Water level protection

Water level is the single most important boiler measurement. Water cools the heated tubes; if the tubes are uncovered, the metal temperature climbs within seconds and the tube can fail.

2.1 Gauge glasses

At least two independent direct-reading water level indicators are normally required, fitted to the drum, together with remote indication in the control room.

Each gauge glass has:

• Steam cock — connects the glass to the steam space.
• Water cock — connects the glass to the water space.
• Drain cock — at the bottom, for blow-through.
• Protection device — often a glass ball or a ball valve that seats itself if the glass breaks, limiting the escape of steam and water. Where fitted, it must be free and correctly positioned, and its effectiveness must be confirmed.

The glass works because the steam and water columns in the glass reflect the drum. For that to be true, both the steam and water passages must be clear. A partially blocked passage shows a slowly responding or inaccurate level.

Tubular and reflex plate glasses

A tubular gauge uses a transparent cylindrical glass connected at its upper end to the steam space and lower end to the water space. It gives a direct view of the column and is simple, but the exposed glass is vulnerable to impact and thermal shock, so guards and the maker's pressure/temperature limits matter.

A reflex plate gauge uses a grooved glass plate and a flat cover plate. The water-filled grooves appear dark while the steam space appears bright because light reflects differently at the steam and water interfaces. The contrast makes the level easier to distinguish at a distance, but the operator still needs to confirm the passages are clear and read the indicated boundary correctly. Some boilers use other plate-glass arrangements; identify the type actually fitted and follow its maker instructions.

Neither glass is inherently a second independent reading if both share a blocked common connection. Compare each glass with the other and with remote indication, and prove the passages by the approved blow-through procedure.

The mounting detail: gunmetal bodies with steam cock to the steam space, water cock to the water space, drain cock at the bottom, plate guards against shattering, and plugs for glass renewal. The blow-through sequence in 2.2 proves each of these passages in turn.

2.2 Blowing through a gauge glass

The purpose is to prove that the steam passage, the water passage, and the drain are all clear, and that the glass refills correctly.

Sequence (as commonly used):

1. Note the current level, so you know what it should return to.

2. Open the drain cock. Steam and then water should blow through, and the glass should clear.

3. Close the water cock. Steam only now blows down through the drain, clearing the steam passage and proving the steam connection.

4. Close the steam cock. The glass is now isolated with the drain open.

5. Open the water cock. Water blows down through the drain, clearing the water passage.

6. Close the drain cock.

7. Open the steam cock. The glass should refill and settle at the true level.

8. Compare with the other glass and with the remote indication.

What the behaviour tells you:

Observation during blow-through	Meaning
Glass will not clear when steam cock is closed and water cock open	Water passage blocked
Glass will not clear when water cock is closed and steam cock open	Steam passage blocked
Water does not blow through when only the water cock is open	Water passage or connection blocked
Steam does not blow through when only the steam cock is open	Steam passage or connection blocked
Glass refills slowly, or fills only partly	Passage partially blocked; connection or cock restriction
Glass refills to a different level from the other glass	One of the two glasses is wrong; investigate before acting

If a glass cannot be proven clear, the boiler must not be relied on for level indication until it is fixed.

2.4 Why low water is so dangerous

When tubes are uncovered:

1. The metal loses its water-side cooling.
2. Metal temperature rises rapidly — the heat flux in a furnace wall is high enough to raise the temperature of a dry tube by hundreds of degrees in a very short time.
3. The steel loses strength as it heats.
4. The tube bulges and then ruptures under boiler pressure.
5. The released water and steam flash to a large volume, and in a fire-tube boiler the whole water content can be released almost instantly, which is catastrophically destructive.

Danger: Never feed a boiler whose tubes may have been uncovered without following the procedure

Cold feedwater hitting a red-hot tube causes sudden contraction, which can rupture the tube that was merely distorted. The correct action is to secure firing and let the boiler cool according to the procedure; the feed decision depends on the boiler design and the procedure.

3. Pressure protection

3.1 The pressure gauge

• Fitted with a siphon or cooling arrangement, so hot steam does not reach the Bourdon tube.
• Marked with the working pressure and a red line at the limit.
• Read at every round and compared with other indications.

A pressure gauge is a single point of failure for its own reading. Where a test gauge connection is provided, use it when accuracy matters, particularly for safety valve testing.

3.2 Safety valves

The drawing shows the parts to know: the valve lid or disc and seat, the spindle, the spring and its carriers, the floating ring, the easing gear, the compression nut, and the steam passage that takes pressure to the underside of the bottom spring carrier. The lift clearance and the D/4 clearance figures are the assembly checks made during overhaul.

How an improved high-lift safety valve works:

• Boiler pressure acts on the underside of the valve disc.
• When the spring force is overcome, the disc lifts from its seat.
• The floating ring and the steam passage to the underside of the spring carrier give the valve a larger effective area once it has lifted, so it opens further and more rapidly. This is what "high lift" means, and it is why the valve discharges its full capacity quickly rather than creeping open.
• The escaping steam is led to the waste steam pipe.
• The easing gear allows the valve to be lifted by hand for testing and for freeing a stuck valve.

The terms to know precisely:

• Set pressure — the pressure at which the valve begins to lift.
• Lift — the travel of the disc off its seat.
• Accumulation — the permitted rise in pressure above the set pressure while the valve is discharging at full capacity.
• Blowdown — the difference between the pressure at which the valve opens and the pressure at which it closes.
• Reseat (closing) pressure — the pressure at which the valve closes and flow stops.
• Chatter — rapid, abnormal reciprocating movement of the disc with contact with the seat. It damages the seat and disc.
• Flutter — rapid, abnormal reciprocating movement without full seat contact.

Why rapid and ample movement matters: the valve must relieve the boiler's full steaming capacity without the pressure rising beyond the permitted accumulation. If the valve opens slowly, or only lifts a small amount, the boiler pressure continues to rise while the valve is open. That is how a safety valve fails to protect.

3.3 Safety-valve forms, easing gear, and accumulation test

Ordinary (low-lift) spring valve: the disc lifts a relatively small distance and the discharge area is governed mainly by the seat circumference and lift. It is mechanically simple, but a small lift gives less escape area, so adequate capacity depends on correct sizing and the approved valve arrangement.

High-lift valve: shaped seat and disc surfaces use the escaping steam to increase the opening force after initial lift. The disc rises further and the valve reaches useful discharge area quickly. The improved high-lift pattern adds features such as a floating ring or cylinder and removes flow-obstructing wings in some designs; these reduce sticking risk and improve the discharge path. Construction varies, so identify the actual design from its drawing rather than assuming every valve has the same internals.

Valve design type	Key design features	Why the feature matters
Ordinary spring-loaded	Winged valve; no waste-steam piston	Basic guided lift; discharge capacity depends strongly on seat area and lift
High-lift	Winged valve; waste-steam piston; no floating ring	Steam pressure on the piston increases opening force and lift
Improved high-lift	Wingless valve; waste-steam piston; floating ring/cylinder	Improves flow past the valve and reduces seizure risk while providing rapid lift

These names describe traditional marine spring-loaded safety valve patterns. Modern valves may feature modified internal arrangements and terminology; always verify the installed valve against its approved manufacturer drawing and parts list.

Easing gear is the lever, lifting rod, and linkage that allows an operator to lift the disc manually under the conditions allowed by the maker. It can demonstrate that a valve is free to move and may help clear a minor sticking condition. It does not establish the set pressure, prove full steaming capacity, or replace an accumulation test. Keep the gear clear, correctly fitted, and secured as designed; operate it only under the approved procedure because hot discharge can cause severe injury.

Easing gear operation and limitations

Accumulation test rules and sequence

Accumulation test demonstrates that the installed safety valves can discharge the boiler's maximum steam generation without pressure exceeding the governing limit. It is a controlled witnessed test, not an improvised operating check:

1. Agree the written test plan with the Chief Engineer, boiler maker, and attending surveyor/authority as required. Confirm the applicable code, permitted pressure rise, hold period, load condition, and acceptance criteria for this particular boiler.

2. Confirm calibrated pressure indication, working water-level indication and feed supply, clear valve outlets and drains, safe discharge routing, communications, and exclusion of personnel from the discharge area.

3. Raise the boiler under controlled firing using the approved test method. Do not gag or isolate all protective valves; any temporary arrangement must be specifically authorised and controlled under the approved procedure.

4. Record initial pressure, firing/load condition, water level, gauge identity, and the opening sequence. Observe pressure continuously as valves lift and discharge.

5. Verify the pressure remains within the permitted accumulation for the required test period and the valves reseat as specified. Stop the test if water level, pressure, discharge, or any plant condition becomes unsafe.

6. Reduce firing, secure the test, check for leakage or abnormal valve behaviour, restore every gag/lock/isolated connection to its normal condition, and independently verify restoration before service.

7. Enter the result, calibrated instruments, pressures, duration, valve identity, witness, defects, and corrective actions in the boiler record.

Standard Accumulation Criteria: An accumulation limit must not exceed 10% above working pressure, with test duration strictly limited to 15 minutes for cylindrical boilers and 7 minutes for water-tube boilers (feed water supply permitting). Boiler feed inlets and steam outlets are isolated while arranging maximum continuous firing. These parameters represent standard regulatory baselines: governing classification society rules, approved test plans, boiler manufacturer guidelines, attending surveyor directives, and thermal risks to superheaters/economizers always take precedence. Accumulation tests on high-rating water-tube boilers may be waived by class where severe tube overheating could result.

3.4 Setting and testing a safety valve

Preparation:

1. Confirm the valve identity and its correct set pressure from the maker's data.

2. Confirm it was assembled correctly and that it lifted by D/4 when the spring tension was removed during overhaul.

3. Confirm the drain lines and waste steam pipes are clear.

4. Confirm a recently calibrated pressure gauge is connected to the boiler shell. It is usual to use two gauges to confirm the setting accurately.

5. Confirm the test procedure with the Chief Engineer and, where required, the surveyor.

Under-steam setting:

1. Bring the boiler to pressure with controlled firing and the boiler on light load.

2. Shut all inlet and outlet valves once the water level is stable. Open the feed inlet only as necessary to maintain level.

3. Gag one of the two safety valves — one at a time, using the approved procedure. Never gag both.

4. Raise pressure slowly on the ungagged valve.

5. Note the pressure at which the valve starts to lift.

6. Adjust the compression nut in small increments — a few turns at a time — and retest.

7. Confirm the lift pressure, then confirm the blowdown and the reseat pressure.

8. Confirm the valve lift pressure against the approved working-pressure limit applicable to this boiler. Some class rules specify adjustment to no more than 103% of approved working pressure after overhaul; confirm the vessel's current rule edition and survey instruction.

9. If an accumulation test is required, conduct it only to the separately approved test plan. Regulatory baselines mandate no more than 10% accumulation, up to 7 minutes for water-tube and 15 minutes for cylindrical boilers; current classification society and flag state instructions govern the specific acceptance criteria and test duration.

10. Transfer to the other valve and repeat.

11. Record the distance from the bottom of the compression nut to the top of the safety valve cover bushes, so the setting can be restored after any future dismantling.

12. Remove the gags, fit the hood (locked to the spindle with a cotter key), fit the easing gear.

13. Lift each valve manually by the easing gear to confirm correct operation and freedom.

14. Count the gags and confirm every one is removed.

15. Log the set pressure, the test gauge reference and calibration date, and the person who performed the test.

Regulatory Testing Basis: After boiler open-up and maintenance, safety valves must undergo floating and pressure setting under steam. Class rules dictate that safety valve lift settings must not exceed 103% of the approved working pressure (or as specified by the individual classification society rules and statutory safety certificates for the vessel).

When set in the absence of a surveyor, the Chief Engineer must forward a statement to the office in the required form, recording the settings and the test conditions.

3.5 Safety valve faults

Danger: Never fit an isolating valve between the boiler and a safety valve

And never leave one closed.

4. Combustion and fuel protection

Correct combustion produces water vapour, carbon dioxide, sulphur dioxide, nitrogen, and the excess air that was supplied. Carbon monoxide in the products of combustion with poor combustion is the signal that the burner is not burning the fuel completely — and incomplete combustion is also what leaves unburnt fuel in the furnace.

4.1 Pre-purge

Before ignition, the furnace and gas path must be purged to remove any flammable mixture.

The purge must satisfy both the airflow requirement and the time requirement for the specific boiler. The airflow must be proven, not inferred from the fan running, and the purge must not be shortened or bypassed.

4.2 Flame failure protection

The flame scanner continuously proves that a flame exists.

On flame failure the burner management system must:

1. Shut off the fuel immediately.
2. Raise an alarm.
3. Post-purge the furnace.
4. Lock out until manually reset.

Danger: Do not bypass the flame scanner

A masked or defeated scanner means the fuel can continue to enter a furnace with no flame, which is the classic preparation for a furnace explosion.

4.3 Fuel cut-off

The quick-closing valve must shut off fuel on:

• Flame failure.
• Low-low water level.
• High steam pressure.
• Loss of combustion air.
• Incorrect fuel temperature or viscosity.
• Emergency stop.
• Loss of control air or power, where applicable.

The valve must be tested to confirm it actually closes. A quick-closing valve that is slow, or that does not fully close, is a serious defect.

4.4 Atomising medium

Loss of atomising steam or air means the fuel cannot be broken into droplets. The result is a stream of unburnt fuel in a hot furnace. The burner must be secured on loss of atomising medium with the same discipline as on flame failure.

This is one reason why the atomising line has to be drained and warm before the burner is lit: wet atomising steam produces a poor spray, and cold steam will not atomise correctly at light-off.

4.5 Furnace explosion

A furnace explosion occurs when unburnt fuel accumulates in the furnace and gas path, and is then ignited.

How fuel accumulates:

• Incomplete pre-purge.
• Repeated ignition attempts with no purge between them.
• A fuel valve that leaks into the furnace when the burner is shut.
• Fuel admitted before the igniter is proven, or with no ignition.
• Flame failure with the fuel valve not closing properly, or with the fuel continuing to enter for any reason.
• Water in the fuel interrupting the flame while fuel continues to be supplied.

How ignition then occurs:

• The next ignition attempt.
• The hot refractory or hot metal surfaces igniting the accumulated mixture spontaneously.
• A glowing particle or a hot surface in the gas path.

Prevention is entirely procedural and mechanical:

1. Purge properly, every time, for the full period.

2. Prove the igniter before admitting fuel.

3. Prove the flame before releasing the firing rate.

4. Ensure the fuel valve closes fully and quickly.

5. Never attempt to relight without a full purge.

6. Never defeat the flame scanner or the purge logic.

4.6 Other combustion-related risks

• Burner dripping — fuel continues to enter after shutdown. Remove the burner, purge, and overhaul it. Do not simply light it again.
• Air register set wrongly — produces a long flame, poor mixing, smoke, and unstable combustion.
• Blocked or fouled gas path — raises furnace pressure, reduces output, and increases the risk of a soot fire.

5. Emergency response

5.1 Low water level

Recognise:

• Both gauge glasses low, or one low and the remote indication low.
• Low water level alarm.
• Falling level trend with feedwater unable to keep up.

Act:

1. Confirm the true level from both gauge glasses and the remote indication. An instrument fault and a real low level look identical until you check.

2. If the burner has not tripped and the level is genuinely at or approaching the low-low point, reduce or stop firing.

3. Do not feed unless the procedure allows. Cold feed into uncovered, overheated tubes can cause sudden contraction and rupture.

4. Establish whether water is available: feed pump running, feed tank level, feed valve position, discharge pressure.

5. Find the cause: feed pump, control valve, check valve, a leak, a passing blowdown valve, a level transmitter fault.

6. Report and log with times.

7. Do not return to service until the true level is established and the boiler condition is understood.

5.2 High water level and carryover

Recognise:

• Both glasses high.
• Water carryover in the steam — wet steam at the consumers, water hammer, unstable superheat.
• Conductivity or chloride readings rising if the cause is dissolved solids.

Act:

1. Confirm the true level.

2. Reduce feedwater flow; do not make a large single correction.

3. Reduce firing or load if necessary.

4. Increase blowdown as permitted, to reduce the dissolved solids driving the foaming.

5. Check the chemistry for high solids or oil contamination.

6. Check the steam line and drains for water hammer, and drain the line.

7. Check the steam separators at the next opportunity if the problem recurs with correct chemistry.

Oil contamination in the boiler water is a specific cause of foaming. The usual source is fuel oil heater coils or a lubricating oil leak. It must be found and repaired, and a coagulant may be used to break the oil out so it can be blown down.

5.3 Flame failure during running

Act:

1. Confirm the fuel has shut off and the alarm has sounded.

2. Allow the post-purge to complete.

3. Do not reset and relight without investigating.

4. Check: fuel pressure and temperature, viscosity control, burner condition, atomising medium, air supply and register position, flame scanner and sight tube, water in fuel, and any draught disturbance.

5. Obtain permission before restarting, and restart with the full sequence.

5.4 Tube leak

Recognise:

• Unexplained fall in water level.
• Increasing feedwater flow requirement for the same steam output.
• Falling steam pressure and output.
• White or wet appearance at the funnel.
• Steam or water escaping from the casing, inspection doors, or around the insulation.
• Abnormal noise inside the furnace — a roaring or hissing that changes with load.
• Feedwater flow persistently exceeding steam flow.

Act:

1. Reduce load and secure the boiler as instructed.

2. Confirm the fuel is shut off and allow the post-purge.

3. Isolate the boiler from the steam system.

4. Maintain correct cooling and draining within the procedure. Cool naturally; do not force-cool, and do not dump water into a hot boiler.

5. Do not open the boiler until it is depressurised and cool.

6. Inspect and identify the failure mechanism before repair — the mechanism determines whether it is an isolated fault or a systematic problem.

Note the distinction: a passing blowdown valve produces the same symptom as a tube leak — increased feedwater demand and a falling level. Check the blowdown valves and their drain line temperature before assuming a tube failure.

5.5 Soot or uptake fire

Recognise:

• Rapidly rising uptake or flue-gas temperature.
• Sparks or visible flame at the stack.
• The stack itself getting hot, or glowing.
• A smell of burning soot.
• Local hot spots on the casing or the stack.

Act:

1. Reduce or stop firing as the procedure requires.

2. Do not soot blow into a hot fire.

3. Apply the approved fire-fighting method — commonly steam smothering through the soot blowers or a fixed arrangement.

4. Provide boundary cooling to the uptake and stack where instructed.

5. Do not restart until the boiler has been inspected, the deposit removed, and the cause of the excessive deposit addressed.

The deposit that burns sits on these gas-path surfaces — generating tubes, superheater and economiser sections served by the soot blowers. A rising uptake temperature logged over days is the warning that this deposit is building before it ignites.

Note the risk with steam: in a very hot deposit, steam can dissociate and the resulting hydrogen can feed the reaction. The procedure for the specific plant must be followed, and the decision to use steam depends on the fire's stage and temperature.

5.6 Economiser fire

Recognise:

• Rising economiser outlet gas temperature.
• Steam or smoke from the casing in the economiser area.
• Popping, rumbling, or thumping from the economiser.
• A change in draught, sometimes a sudden increase as the fire alters the gas path.

Act:

1. Secure firing.

2. Keep feedwater passing through the economiser where the procedure requires it, so the tubes stay cooled.

3. Use the approved extinguishing method.

4. Inspect before returning to service; check for tube damage, distortion, and deposit.

The economiser fire starts on this surface: feedwater tubes in the gas path that should be heating water, not collecting combustible deposit or steaming. Keep feedwater flowing through it during the emergency so the tubes stay cooled, and inspect every element for distortion before returning to service.

5.7 Water hammer

Recognise:

• Heavy banging or hammering in the steam line, superheater, or economiser.
• Pipe movement and support damage.
• Pressure spikes.

Causes:

• Condensate in a cold steam line, or in a line that has been allowed to cool with the drains closed.
• Opening a steam valve too rapidly.
• Economiser steaming, which traps steam in the tubes.
• Carryover from the drum adding water to the steam.

Act:

1. Reduce or close the steam valve.

2. Drain and warm the line properly before reopening.

3. Check the drum level and the chemistry for carryover causes.

4. Check the economiser feedwater flow and temperature for steaming.

5. Inspect for damage before returning to normal operation.

5.8 Loss of combustion air or forced-draught fan

Act:

1. The burner must trip on loss of combustion air — confirm that it has.

2. Do not reset while the airflow fault exists.

3. Check the fan, its power supply, the damper, the air path, and the airflow proving device.

4. Confirm the furnace has been purged before any attempt to relight.

6. Emergency action summary

7. Exhaust-gas economizer soot fire

How the fire develops: soot from poor combustion accumulates on closely spaced EGE surfaces. Prolonged low engine load, poor fuel, a leaking exhaust valve, a dripping injector, or oil carry-over can leave deposits containing unburnt fuel or lubricating oil. These deposits insulate the heat-transfer surface; local temperature rises, the gas path restricts, and a deposit can ignite. A dry, clean soot layer is less readily ignited than an oily or wet deposit, which can ignite at a lower temperature.

Watch for the pattern, not just one alarm:

• Sudden or continuing rise in exhaust-gas outlet temperature, especially a trend that departs from the engine load relationship.
• Sparks, smoke, or an unusual discharge from the funnel; smoky/oily smell near the EGE; hot casing or visible glow.
• Rising exhaust back pressure or a change in engine/turbocharger operating readings, suggesting a restricted gas path.
• Unexpectedly high steam pressure or superheater outlet temperature on a unit that generates steam.
• Changing hotwell/feed inventory or loss of EGE circulation water, which may indicate a tube failure rather than soot alone.

Initial response to suspected soot fire: inform the bridge and Chief Engineer immediately, request the required engine manoeuvre, and follow the vessel's EGE fire plan. Do not use soot blowers to fight an active fire: they can dislodge burning material and introduce flow that spreads the fire. Secure an oil-fired boiler burner and auxiliary blower if the approved plan requires it, establish the fire watch and boundary cooling, and use the fitted EGE firefighting system when ordered. Keep personnel away from access doors and the funnel discharge.

Circulating-water decision: a soot fire normally requires heat to continue being removed from the EGE, so the circulation pump is generally kept running and the water level/feed monitored. If there is evidence of a tube rupture—such as unexplained water loss, rising hotwell level from the leaking circuit, or loss of circulation inventory—apply the maker's isolation procedure; it may require stopping the pump to prevent feeding water into the fire. Do not make this pump decision from temperature alone.

Water and hydrogen caution: distinguish cold-water cleaning after the unit is safe from an engineered firefighting deluge during a confirmed fire. Do not improvise either. Marine oral references disagree because the response depends on whether the event is an ordinary soot fire, a tube leak, or a metal/very-high-temperature fire. Some describe a controlled copious deluge through a purpose-designed system; others warn against water washing or small, uncontrolled quantities. Use only the fitted system and the ship's approved EGE procedure. At extreme metal-fire temperatures, steam reacting with very hot carbon/iron can contribute combustible hydrogen/CO and intensify oxidation; the indexed class study reference places this special hydrogen/metal-fire concern above roughly 1000°C. It is not correct to assume every ordinary soot fire automatically produces hydrogen.

After the fire is out: continue the prescribed cooling and monitoring until the EGE reaches the safe opening condition. Then inspect the full gas path for fused soot, blocked fins, tube bulging/cracks/leaks, casing distortion, failed supports, and damaged dampers. Repair and pressure-test as required, clean the surfaces, verify circulation and gas-path free area, and record the event and cause before return to service.

8. The discipline that prevents the emergency

Most boiler emergencies are the end of a chain that started earlier and was visible earlier.

• A rising uptake temperature was logged for days before the soot fire.
• A tube leak that started as a small weep produced a slow rise in feedwater demand for weeks.
• A burner that was smoking for months finally caused a deposit that ignited.
• A safety valve that had been gagged for a survey was never ungagged.

The protections catch the last few seconds. The watchkeeping catches the preceding weeks. Both are needed, and the watchkeeping is the part that the engineer controls.

Non-negotiable rules:

1. Never bypass a protection to keep steaming.

2. Never leave a safety valve gagged or isolated.

3. Never run with a failed water level indicator.

4. Never open the furnace or uptake without the correct permit, isolation, and atmosphere test.

5. Never restart after an unexplained trip without finding the cause.

6. Record everything: time, indication, action taken, and who was informed.