Control systems failure diagnostics

The development of computer capabiUties in hardware and software, related instmmentation and control, and telecommunication technology represent an opportunity for improvement in safety (see COMPUTER TECHNOLOGY). Plant operators can be provided with a variety of user-friendly diagnostic aids to assist in plant operations and incipient failure detection. Communications can be more rapid and dependable. The safety control systems can be made even more rehable and maintenance-free. Moreover, passive safety features to provide emergency cooling for both the reactor system and the containment building are being developed. 

In situations where the SIS is the only layer of protection and is used for a safety function operating in the continuous mode of operation, then the diagnostic test interval will need to be such that faults in the SIS are detected in time to ensure the integrity of the SIS and to allow action to be taken to ensure a safe state in the event of a failure occurring in the process or the basic process control system. 

To achieve this, the sum of the diagnostic test interval and the reaction time to achieve a safe state should be less than the process safety time . The process safety time is defined as the time period between a failure occurring in the process or the basic process control system (with the potential to give rise to a hazardous event) and the occurrence of the hazardous event if the safety instrumented function is not performed. 

The safety level was defined as category 2 according to standard NF EN ISO 13849 (PL d ). In category 2, the safety function is controlled at suitable intervals by the machine control system. The occurrence of a fault can lead to loss of the safety function in the interval between two checks. The MTTFd is hi and the diagnostic coverage is average . Common cause failures are taken into account. 

The plant operation is controlled by the integrated automated control system on the basis of multiple redundant control computing devices with automatic diagnostic of software-hardware The technical capabilities of the computing devices allows continuous and periodical diagnosis of the state of the most important elements and the reactor plant as a whole by all presently used methods which considerably reduces the probability of sudden failures... 

Level 2, for the control of abnormal operation and the detection of failures, is to be reinforced (for example by more systematic use of limitation systems, independent from control systems), with feedback of operating experience, an improved human-machine interface and extended diagnostic systems. This covers instrumentation and control capabilities over the necessary ranges and the use of digital technology of proven reliability. 

Defects or faults in any component of the loop can develop into malfunctions. Faults are not always visible to the operator immediately, but may appear in such a way that they give rise to complete loop failure. In safety-critical applications, no failure can be tolerated [3]. Redundancies in hardware and software facilitate fault recovery. So, for increased dependability fault tolerant control (PTC) is an ideal solution. In critical controls it may be disastrous to tolerate any failure of control systems. In PTC the system continues to operate with single failure in components and/or subsystems. Also in cases of critical controls, FTC will make a controlled shutdown to a safe state in a critical situation. FTC systems use the help of redundancies in hardware and software, discussed earlier, and fault diagnostics and intelligent software to monitor health and behavior of components and function blocks and take remedial action. With these tools the faults are isolated and suitable... 

Just prior to the incident the pipe-laying operation had been stopped. Operators reported a system failure and that the hydraulic power had been lost. Such an occurrence was not particularly unusual and, in line with company procedures, this was investigated immediately. A team of technicians led by the chief electrician tried without success to resolve the problems. After these attempts, a more in-depth analysis was made. It was decided, on the basis of input from the system diagnostics, to perform a memory reset. Following this the system appeared to be running correctly. This was the first time that a full memory reset was requested by the internal diagnostics of the control system during a project operational phase. 

System diagnostics Power failure Communications failure Environmental controls (EMI, RFI, etc.)... 

Two fundamentally different categories of failures exist physical failures (often called random failures) and functional failures (often called systematic failures). (See Figure 3-1). Random failures are relatively well understood. A random failure is almost always permanent and attributable to some component or module. For example, a system that consists of a programmable electronic controller module fails. The controller output de-energizes and no longer supplies current to a solenoid valve. The controller diagnostics identify a bad output transistor component. 

In the Markov model for this configuration, state 0 represents the condition where there are no failures. From this state, the controller can reach two other states. State 1 represents the fail-safe condition. In this state, the controller has failed with its outputs de-energized. The system has failed dangerously in state 3 and the failure is not detected by on-line diagnostics. The Markov model for the loolD is similar to the lool except that the dangerous detected failures automatically trip the system (go to state 1). 

Three system success states that are similar to the other dual systems previously developed are shown. State 1 is an interesting case. It represents a safe detected failure or a dangerous detected failure. The result of both failures is the same since the diagnostic cutoff switch deenergizes the output whenever a dangerous failure is detected. The only other system success state, state 2, represents the situation in which one controller has failed in a safe undetected manner. The system operates because the other controller manages the load. 

---