Damage protection redundancy

Damage protection redundancy. This addresses failures which can cause hazardously cascading failure conditions (see Section 6.6.3) after a root cause... 

To obtain permission to operate a pipeline, whether for long-distance transport or for intraplant operation, it must be shown that the construction and mode of operation exclude the possibility of uncontrolled release of substances into the environment during normal operation and in the event of damage or disturbances. This requires a redundant safety system, both to protect public safety by avoiding fires and explosions, and to avoid pollution of soil and groundwater and surface water. 

In isolated cases redundant PCE safety instrumented systems should be examined to determine whether fire hazard or the possibility of mechanical damage necessitates a split construction or a protected and/or separate power supply and spatial separation of cable trays. 

The system has only partial redundancy. A failure in the pump or cylinder would produce a failure of the system. A blockage failure in one of the lines would protect the system from failure because there is a second Une. However, routing the hydraulic lines through the same locations reduces the value of the redundant lines. Damage to one is likely to occur to the second. The value of redundancy increases if there are different locations for the redundant components... 

The ultimate protection against system downtime is achieved through redundant cable routing. Redundant fibers are placed in a second route to immediately take over in the event a cable is damaged. Redundant routing should be considered when zero downtime for the physical cable plant is required. 

The damage of the not physically separated redundant instrument sensing lines caused by an external or internal hazard, in some cases, may disable the functioning of reactor protection system. 

Individual component failures are not significant contributors to shutdown core damage frequency, and there is no particular dominant contributor. This confirms the at-power conclusion that single independent component failures do not have a large impact on core damage frequency for the AP1000, and reflects the redundancy and diversity of protection at... 

Apart from normal damage of constituent elements of such a data communication system, data can also be damaged in spite of the fact that the recipient of this fails to notice. The possible causes are imperfection of protection with CRC code (Cyclic Redundancy Check) in the layer of data links, incorrect configuration of transmission in the network layer e.g. improperly set TTL (Time To Live) field in the IP protocol or unauthorised change of data. 

The damage to electrical power and control circuits resulted in the loss of redundant subsystems and equipment. This was surprising in view of the independence and separation criteria that had been applied in the design of the plant. The two principal reasons for the failures were found to be (1) failure to recognize potential sources of failure of safety equipment (i.e., the interconnection of safety equipment and nonsafety circuits such as the indicator-light circuits) and (2) contrary to what had been considered good practice, the conduit used to isolate cables from their redundant counterparts did not protect the cables adequately. 

---