Device fail dangerous

A reactor experiences trouble once every 16 months. The protection device fails once every 25 yr. Inspection takes place once every month. Calculate the unavailability, the frequency of dangerous coincidences, and the MTBC. 

For a 2oo2 architecture, if any device or system had failed dangerously when a demand occurs the safety function will be lost i.e. if System A OR system B is unavailable. 

When PE devices are being evaluated for use in an SIF, the integrity of the software in the PE device should be considered. Unfortunately, software failures are difficult to predict. The mathematical models used to predict hardware failures are not easily applied to software, because software failures are not random they are systematic. Software errors are also difficult to identify because of the overwhelming number of combinations of events that could lead to a fail-dangerous or fail-safe event. Unlike hardware... 

By the strictest definition, a fail-safe system is one that cannot cause harm when it fails. The term fail-safe is used to describe a device which, when it fails, fails in a way that will cause no harm or at least a minimum of harm to other devices or danger to personnel. Fail-safe is a system safety concept that, in theory, is intended to ensure a system remains safe, or in a safe state, in the event of a failure, thereby preventing a mishap while alternative action is being... 

Channel Device Fail-safe rate per year Fail-danger rate per year... 

Failure Mode - The action of a device or system to revert to a specified state upon failure of the utility power source that normally activates or controls the device or system. Failure modes are normally specified as fail open (FO), fail closed (FC) or fail steady (FS) which will result in a fail safe or fail to danger arrangement. 

Danger of device failure there is a concomitant danger with this therapy that the device may for some reason fail to operate, which again requires surgical intervention to correct. 

A form of electrical interlocking for machinery guards which incorporates an actuating switch operated by the guard and associated electronic devices which control power to the equipment. Failure of any of the elements or their connection wiring can be considered a fail to danger arrangement. 

The case ended in a products liability lawsuit against the gas valve manufacturer. Had the manufacturer placed the connector in a small plastic bag and shipped it uninstalled, the connector would have changed from a faU-dangerous device to a fail-safe device. The gas valve would not have worked at aU if someone failed to install it when there was no second safety device. It would have worked properly if either the connector or a second safety device were installed. Warnings with the connector would have prevented connecting both during installation of the gas valve. 

For process equipment, designers need to specify necessary safety features and the tests for meeting requirements. For process equipment, there should be fail-safe features. Fire protection, overpressure, excess heat, runaway reactions, dust control, exhaust ventilation, dangers of flammable liquids, leaks, sensing devices to report status are all examples of important safety features. Designers and purchasers need to consider access for setup, maintenance and cleaning. There may be a need for access by stairs, fixed ladders or platforms as part of large equipment. 

The filters on all of these devices have to be replaced regularly. If an old filter is left in too long, the unit not only fails to purify the water but can actually put contaminants back into the water and breed bacteria. This could make the water more dangerous than it was before being filtered. 

The choice of interlocking method will depend on power supply and drive arrangement to the machine, the degree of the risk being protected against and the consequences of failure of the safety device. The system chosen should be as direct and as simple as possible. Complex systems can be potentially unreliable, have unforeseen fail-to-danger elements and are often difficult to understand, inspect and maintain. 

The major limitation to the operation of catalytic gas-sensing elements of this type is their loss of sensitivity on exposure to atmospheres containing certain gases and vapours. Such a loss of sensitivity is particularly important in catalytic gas sensors since the device will fail to indicate danger that is, a false low reading may be obtained in a flammable atmosphere. 

Device failures result in a specific failure mode, e.g., a transmitter could fail with the signal stuck within the acceptable range. Experience and knowledge of how the device functions is necessary to identify the failure modes. These modes can then be classified as either safe, where the failure causes the device to go toward its safe state, or dangerous, where the failure causes the device to fail to function. In the case of a transmitter, a stuck signal would be considered a dangerous failure. 

Device failures can sometimes be detected by online, automatic diagnostics that notify the plant operator that the device has failed so that compensating measures can be implemented. These failures are classified as detected, leading to the identification of dangerous detected (DD) or safe detected (SD) failures. If online diagnostics are not available, the failure may remain undetected until a process demand occurs or the device is proof tested. These undetected failures may be dangerous undetected (DU) or safe undetected (SU). 

When the demand frequency is more than twice the periodic proof-test frequency, the application should be considered a high-demand mode application. Therefore the equations and techniques that use test interval as a key variable are not valid. In effect, one cannot take credit for periodic inspection unless it is done very frequently. Credit may be taken for diagnostics that cause the device to fail to the safe state (i.e. automatic process shutdown on any detected dangerous failure) in the high-demand case, as long as the diagnostic time period plus the time necessary to safely return the process to a safe state is less than the available process safety time (the time period between initiation of a demand and the hazard). 

In the system conception it should be ensured that no dangerous situations can develop if a signal is missed. The system should, by means of diverse technical monitoring and protective devices, be brought automatically to a safe condition if the monitoring operator fails to react to a critical signal within a predetermined period of time. 

There are various fault flow charts in standards or other rules of technology, covering the specific design requirements of fail-safe behaviour for the safety device in question. The principle of all fault flow charts is always the same. The chart begins with the "ist failure" (e.g. emitter-collector of any transistor short circuit). It is to be verified that after each "ist failure" no dangerous situation may occur. If so, one has to ask what else happens after the "ist failure". There are 4 answers to this question ... 

The operating conditions are controlled by two redundant systems an equipment installed to regulate the value of the parameters during normal operations, and a set of safety devices to prevent the occurrence of dangerous conditions in the tanks, when regulating system fails. In addition, the vessels are provided with detectors and alarms, which go off when measured parameters assume unexpected values. 

---