Alternating failure

Where ESD and DCS systems are provided, they should be functionally segregated such that failure of the DCS does not prevent the ESD from shutting down and isolating the facilities. Alternatively, failure of the ESD system should not prevent an operator from using the DCS to shut down and isolate the facility. There should be no executable commands over the ESD-DCS communications links. Communication links should only be used for bypasses, status information and the transmission of reports. Confirmation of ESD reset actions can be incorporated into the DCS but actual reset capability should not. 

Finally, the example given here shows the possibilities of the Incident Production Tree method to go beyond the single near miss originally reported, by adding alternative failure (or recovery) elements if these seem realistic according to the sourcc(s) describing the near miss backgrounds. 

The first step in the equipment planning methodology is to define the function the equipment must perform what must the chosen equipment be able to do in order to accomplish the desired objective This question is crucial, and it must be thoroughly answered before one begins to identify alternatives. Failure to adequately specify the objective the equipment must accomplish, and the minimum capabilities the proper equipment should have to achieve that objective, will often result in selection of equipment that fails to solve the real problem. It is amazing how often poor specification of requirements provides a brilliant solution to the wrong problem. 

Fig. 33. Schematic representation of the interface region in LaNis. One of the possibilities for the blocking effect of molecular hydrogen is indicated. The configuration shown for H2 could result if H2 attempted to chemisorb on Ni atom 2 when Ni atom 1 and 3 are already bounded to atomic hydrogen. Alternatively, failure to interact with Ni atom 3 could be due to its inaccessibility because of geometrical constraints (Wallace et al., 1979).

As the external load increases, the stress intensity approaches the fracture toughness, A ic, and crack propagation is initiated. This alternative failure criterion... 

As an illustration, consider Fig. 1, which shows four different failure modes for aluminum adherends bonded with a model epoxy adhesive. Simply by altering the loading mode, one can obtain cohesive failures, apparent (visually) interfacial failures, failures that oscillate within the adhesive layer, and alternating failures that jump back and forth from one interface to the other. Predicted theoretically, this dramatic variation in locus of failure was experimentally achieved not by altering the substrates or the surface preparation but simply by changing the loading conditions for these beam-type fracture specimens. 

To suggest an alternative failure criterion, based on the assumption that all materials contain inherent flaws, linear elastic fracture mechanics applied to adhesive joints was introduced. Basic fracture mechanics approaches were discussed, as well as available test techniques and the influence of various test conditions. 

Failure of the control system has an obvious impact on the performance of the HVAC system. The most noticeable impact is on occupant comfort due to the loss of temperature, humidity, or ventilation control. Older pneumatic and electronic systems are designed for a single best alternative failure mode. In the case of temperature control, failure usually defaults to a full heat setting to prevent freezeups in the northern climates, and to a no flow setting where freezeups are not a problem. 

Using this bulk modulus approach for soils, the time-dependent stress-strain relation is given in Table 3.9. With reference to rocks, the failure strength of the rock is defined in exactly the same way as described earlier the values for E and V will vary. Nevertheless, the various alternative failure models given in Table 3.10 for rocks are related in terms of strain rates by... 

If plasticity is included in the adhesive characteristics, then an alternative failure criterion was proposed and implemented by Crocombe and Adams [9] using critical values of effective uniaxial plastic strain. The triaxial strain was expressed as an effective uniaxial strain, and then compared with the strain to failure of the bulk adhesive. Unfortunately, this too was seen to be dependent on the density of the finite element mesh, and in reality was a critical strain at a distance criterion. The choice of critical strain was also dependent on the adherends present as different plastic zone sizes will be given by different adherend combinations. The geometry considered in this paper was the peel joint. 

Sections 9J,3.1,9 1.8.2, and 9 1.6.3 list individual failure modes and risk mitigation methods There are several alternator failure modes common to all electric machines which are not discussed here, though can be found in Reference 9- 26. 

A loss of load transient occurs If there is a malfunction in the speed control system or related components. The most severe transient is a complete loss of load where the alternator torque decreases to zero. This casualty would likely be caused by an alternator failure, multiple PLR component failures, PCAD software failure, or micrometeoroid impact to the electrical cables between the alternator and PCAD. This severe casualty may be less credible than partial loss of load and may be caused by equipment failures that are not recoverable. 

---