Fail-operational

The chart in Fig. 21 shows that the reverse trend for an operator can be seen, in which there is a reduction in expected PI values in comparison with other workers. The tests performed by one operator are not acceptable and since the test was performed as expected by another operator, it must be a factor of the failing operator that causes the problems with the assay. 

A fail-operational design allows system functions to continue safely until corrective action is possible. This type of design is preferred since there is no loss of function. An example is the fail-safe operational orientation of the control rods on nuclear reactors, which automatically drop into place to reduce the reaction rate if it exceeds a preset limit. 

Fail-safe devices may be fail-passive, fail-active, or fail-operational. A fail-passive device, such as electrical circuit breakers or fuses, wdl render a system inoperative or de-energized until corrective action is taken. A fail-active device will keep a system energized but in a safe mode until there are corrective actions. A fail-operational device allows a system to function safely, even when the device fails. 

System status fail Operator is unaware of actual system status... 

Fail operational A system that can continues to function without any change in objectives or performance after a single failure. 

Fail Operational A design characteristic which allows continued operation of a system or subsystem despite a discrete failure. 

Fail Operational, Fail Safe A fail operational design which also remains acceptably safe. 

If it s broken, don t run it. At Bhopal, the refrigeration system had been down for months. A faulty valve that should have sent the leaking gas to a scrubber sent it instead to the flare system, which failed. Operators didn t detect the leak immediately, because a key panel was missing from the control room. As stated by a Union Carbide executive, the plant should not have been running. 

STATION BLACKOUT AC recovery in O.Shrfail Primary system intesritv fail Steam generators integrity fail Auxiliary feedwater system fail AC recovery in 1 hr fail Operator fail to depresurize RCP Seal LOCA AC recovery prior to core uncovery fail AC recovery in 7 hr fail... 

Sinha, P. Architectural design and reliability analysis of a fail-operational brake-by-wire system from ISO 26262 perspectives. Reliability Engineering System Safety, 1349-1359 (2011)... 

Other safety standards require that even separate control units are used, since especially the environmental conditions can also influence the electronic functions and with separate control units it can be assumed that the functions in different control units are not dangerously influenced by environmental influences at the same time in the same way. It is mainly if fail-operational or fault-tolerant functions are to be considered, but also extensive heat or EMC could lead by common mode effects to unexpected behavior even if safety mechanisms are cotrectiy implemented. 

ISO 26262 allows different ASIL for software in one microcontroller, and also having legacy software, software which have not been developed according a safety-standard or software from foreign sources in a sufficient separated environment. But except, to perform an adequate Analysis of dependent failure the standards provide no guidance. How to design fault-tolerant or even fail-operational architectures and designs and how to deal with such horizontal barriers are not considered in ISO 26262. 

Consequently fail-operational systems need to be considered. 

In case of any safety-related absolute or Sequent lime constraints, at least a safety-related time monitor needs to be implemented. This lime monitor could be used to trigger a watchdog so that the system could be degraded in a safe state by a consoller shut-down. If a shut-down of the controller isn t the safe state, for example in fail-operational systems such degradations don t provide any safe reactions. 

Safety systems can be classified as either fail-safe or fail-operational [32,33]. A system is fail-safe if there is a safe state in the environment that can be... 

In order to achieve fail operational behavioiu of the safety critical steering function, the Guidance System is developed by defining and managing adequate risk reduction strategies in terms of mitigating measures in system design and application conditions for each safety-related hazard such as ... 

This mathematical model represents a system in which a vehicle is operating in alternating weather (e.g., normal and stormy). The vehicle can fail operating either in normal or stormy weather. The failed vehicle is repaired back to both its operating states. The system state-space diagram is shown in Figure 6.5. The numerals in boxes and a circle denote system states. 

Fail-operational A characteristic in design which permits continued operation in spite of the occurrence of a discrete malfunction. 

Safety-related equipment, safeguards, and possible alternative approaches (e.g., monitoring, interlocks, system redundancy, hardware or software fail-operational/fail-safe design considerations, subsystem protection, fire detection/suppression systems, personal protective equipment, ventilation, and noise or radiation attenuation)... 

---