Device fail operational

Velocity measurements in flow regions where other devices fail to operate suitably—boundary layers, stagnating air zones—are typical applications. 

As long as pressure, level, and temperature control devices are operating correctly, the safety system is not needed. If the control system malfunctions, then pressure, level, and temperature safety switches sense the problem so the inflow can be shut off. If the control system fails and the safety switches don t work, then relief valves are needed to protect against overpressure. Relief valves are essential because safety switches do fail or can be bypassed for operational reasons. Also, even when safety switches operate correctly, shutdown valves take time to operate, and there may be pressure stored in upstream vessels that can overpressure downstream equipment while the system is shutting down. Relief valves are an essential element in the facility safety system. 

An alarm should sound any time redundant inputs disagree. In most cases, the operating personnel will have to decide what to do. In some cases the computer control system will have to decide by itself what to do if redundant inputs disagree. The more hazardous the process, the more it is necessary to use multiple sensors for flow, temperature, pressure, and other variables. Since it must be assumed that all measuring devices will fail, they should fail to an alarm state. If a device fails to a nonalarm condition, there can be serious problems. It is also serious if a device fails to an alarm condition, and there is really not an alarm condition. This is generally not as serious as the first case, but it can provide a false sense of security. Usually it is assumed that two... 

The heating mantle should be of such a design that there is no risk of sparks igniting the solvent. This also applies to all electric cables and plugs. The mantle should also incorporate an electricity cut-out device to operate if the water supply to the condenser fails. 

Failure of both the primary and secondary relief device to operate as designed. PSH fails and PSV does not release at the set pressure or is blocked. 

Transistor relays may also be used in coimection with contact manometers (< /. chap. 8.3.1 and 8.3.1.1). They are commercially available as a combination of standing or supported device. They operate on the normally open and normally closed principles where a circuit is switched on and off, respectively, on making a contact. These relays are further employed for photoelectric circuits, e.g. in the level control of liquids and in vacuum control (c/. chap, 8.6 and 8.3.1.1). As safety relays thev switch off the circuit if the contact thermometer fails. 

Control device. The control device is mounted in a standard 19" rack. It contains the power snpply for the solenoid valves, the power snpphes for the transducer, a 12 Bit A/D-conveiter and the microcompnter. The microcomputer is equipped with a battery-buffered RAM and a restart logic to restart antorrratically after a power fail. The fairltless operation of the system is controlled by a watchdog. The device is operated by menu, displayed on a 4><40 alphantrmeric LCD-display, and a keyboard with 10 nnmeric kevs, 5 function keys and a key operated switch to disable certain commands. 

Every oven should be equipped with a backup thermostat or temperature controller to either control the unit should the primary one fail or shut the oven down. If the secondary contioller permits the oven to continue to operate after the primary device fails, it should provide a warning that the failure has occurred so that the researcher can make the decision as to whether or not to continue the operation. In any event, as soon as practicable and before beginning a new run, the oven should be repaired. No unit with only a single thermostat should be used for long, unattended programs. 

Redundancy - The existance of more than one means for accomplishing a given task, where all means must fail before there is an overall failure of the system. Parallel redundancy implies two or more means are working at the same time to accomplish a given task and either can do the required job by itself. Standby redundancy applies where a second or alternate system is switched into operation when the primary device fails. 

Fail-safe devices may be fail-passive, fail-active, or fail-operational. A fail-passive device, such as electrical circuit breakers or fuses, wdl render a system inoperative or de-energized until corrective action is taken. A fail-active device will keep a system energized but in a safe mode until there are corrective actions. A fail-operational device allows a system to function safely, even when the device fails. 

Construction starts with the initiating event and works through each branch in turn. A branch is defined by a question (e.g., "Protective device fails "). The answers are usually binary (e.g., "yes" or "no"), but there can also be multiple outcomes (e.g., 100,20, or 0 percent in the operation of a control valve). Each branch is conditional on the appropriate answers to the previous ones in the tree. 

For example, consider the simple case where a FACTS device can never do any harm to the network, i.e., if the device fails, the system simply bypasses it and continues to operate. This is denoted as the the fail-bypass failure mode. In this failure mode, correct operation of the FACTS devices adds safe states to the system, and failure of these devices has no effect on system operation, as a failed device is bypassed. The additional safe states correspond to the cascading failures prevented by introducing the FACTS devices (see Table 2). The resulting reliability model is given by Equation 2. 

As in the failure modes 1 and 2, this incorrect operation of the FACT device will not cause an overload in the line bearing the device, but it may cause overloads elsewhere in the grid. Simulation was used to verify that FACTS device failure in mode 3 could lead to cascading failures. Results of the simulation were used to develop the reliability model of Equation 7, which assumes that the FACTS devices fail in mode 3. 

Semi-active control devices offer the adaptability of active ones without requiring such high power, since external power is only used to change the device s properties, such as damping or stiffiiess, and not to generate a control force (Symans et al. 1994) In fact, many semi-active devices can operate on battery power, which is critical during seismic events, when the main power source to the structure may fail. 

Conditional Failure Probability. The concept of conditional piobabihty of faiuie is useful to predict the chances of survival for a device that has been in operation for a period of time and is not in a failed state. Such information is helpful for maintenance planning. 

These tests must encompass the complete interlock system, from the measurement devices through the final control elements. Merely simulating inputs and checking the outputs is not sufficient. The tests must duplicate the process conditions and operating environments as closely as possible. The measurement devices and final control elements are exposed to process and ambient conditions and thus are usually the most hkely to fail. Valves that remain in the same position for extended periods of time may stick in that position and not operate when needed. The easiest component to test is the logic however, this is the least hkely to fail. 

Eail-Safe Design features which provide for the maintenance of safe operating conditions in the event of a malfunction of control devices or an interruption of an energy source (e.g., direction of failure of a control valve on loss of signal). A system is fail-safe if failure of a component, signal, or utility that would create a hazard initiates an action that maintains the system in a safe condition. 

If a spillage about once in five years (or however often we think the operator will fail) cannot be accepted, then it is necessary to have two protective devices, one trip (or alarm) to act as a process controller and another to take over when the controller fails. It is unrealistic to expect an operator to watch a level when a trip (or alarm) is provided (see Section 14.7 a). 

---