Fail-safe” condition

Partial correctness is analogous to weak equivalence in that it is a sort of fail-safe condition. If A(a) = FALSE the input criterion is invalid and a presumably never occurs as input and so we make no claims as to the behavior of program (P,I) with "bad" input. If (P,I,a) does not halt there is no output and this is also regarded as a don t-care situation. There are fairly realistic situations where we would be perfectly satisfied with this sort of "correctness" -for example, in data security or protection systems. We presume - or have enpirical evidence - that the system does not fail often or catastrophically and wish to know that when it is working and output is given (of whatever kind, for the output could be just internal transfer of data) then the result is "good" or, more likely, nothing "bad" happens. 

The fail-safe condition is to not feed air into the regenerator. Therefore, the suction valve is air-to-open and the vent valve is air-to-close. What action should the flow controller have, direct or reverse ... 

If a sprinkler system is installed in a computer room or similar area, provisions must be made to automatically de-energize all electrical power to the room and equipment, except power to lighting, in the event of sprinkler operation. Ensure that de-energizing activity leads to a fail-safe condition. Preferably, this should take place prior to water application to minimize damage to exposed electronic circuits. This can be accomplished automatically by smoke detection systems. Manual activation is tolerable for constantly attended locations. Where automatic sprinklers are installed in areas containing minimal combustibles as described above, a sprinkler density of 0.10 gpm/ft (0.38 Ipm/m ) should be provided. Refer to NPEA 75. 

Many of the fail-safe valves used in chemical processes are quarter-turn valves. Generally, ball valves with spring loaded actuators are recommended so that there is positive fail-safe movement in case of power or air failure. It may not be practical for very large valves to be spring loaded. These large valves should generally have a local air supply tank to cause them to fail to the fail-safe condition. 

In the Markov model for this configuration, state 0 represents the condition where there are no failures. From this state, the controller can reach two other states. State 1 represents the fail-safe condition. In this state, the controller has failed with its outputs de-energized. The system has failed dangerously in state 3 and the failure is not detected by on-line diagnostics. The Markov model for the loolD is similar to the lool except that the dangerous detected failures automatically trip the system (go to state 1). 

At each shutdown, compare sensor readings with each other and determine whether fail-safe condition was achieved. (E.g., use these comparisons as permissives for the next startup. This reduces Mean Time To Detection of field device failures. This also applies to monitoring of valve position with limit switches.)... 

From the foregoing it is clear that the ESD system will take all associated systems to the safe state, but what will happen if the ESD system fails The interface of the ESD and the system itself shall be designed in such a way that all connected systems will be pushed to a safe state for the facility upon failure of the ESD system to achieve a fail safe condition. Such ESD system failures could be caused by an open/short circuit of the ESD system I/Os, loss of power, or loss of emergency communication with associated systems [e.g. Clause 2.1.3 Section 4 and Table 4-2 (safest conditions) of DNV-OS-A101 2013]. 

Solenoid valves are used to play important role in cases of emergency shutdown and are used for actuations. In this connection. Fig. VII/1.1-3 or IX/5.1.3-1 may be referenced. Now for all such cases, there will be fail safe condition of these valves, viz. fail open or fail close and fail lock (last position—mainly for modulating valves). In fail lock condition, regardless of the valve s natural failsafe state, the system makes the valve to lock positioner air inside the valve actuator as shown. However, on account of leakage, this position cannot be held permanently over very long period. Various safe failure conditions of the control valves have been depicted in Fig. EX/... 

A process can be designed with small pressure drops over control valves. This minimizes energy costs. The valve is typically designed to be 50% open at design conditions. If the failsafe condition is a wide open valve, an air-to-close (AC) valve is specified. Examples are cooling water and refrigeration valves. If the fail-safe condition is a completely shut valve, an air-to-open (AO) valve is specified. Examples are steam, fuel, and reactor-feed valves. 

A DCS hazards analysis, therefore, has two principal parts. First, it must evaluate the fail-safe condition of each valve, not only for a total system outage but also for a failure of the valves on the boards individually. Once this is done, the team should then evaluate the effect of a board failure on the rest of the system. One recommendation resulting from this analysis may be to move control loops from one board to another. In general, the components of a single system, such as a distillation column or a reactor, should be put together on one board. 

The basic approach is to direct the system to the safest operating level relative to people or the environment when any emergency condition is detected, including power loss. An important concept of process control safety is to have adequate redundancy to reduce unwanted shutdowns and maintain an adequate level of certainty that a safe state will result if a real emergency does occur. As far as possible, instruments should be of the fail-safe type. 

Eail-Safe Design features which provide for the maintenance of safe operating conditions in the event of a malfunction of control devices or an interruption of an energy source (e.g., direction of failure of a control valve on loss of signal). A system is fail-safe if failure of a component, signal, or utility that would create a hazard initiates an action that maintains the system in a safe condition. 

It generally is recommended, and often required, that gas dcicciiuii systems be installed in a fail-safe manner. That is, if power is disconnected or otherwise interrupted, alarm and/or process equipment shutdown (or other corrective action) should occur. All specific systems should be carefully reviewed, however, to ensure that non-anticipated equipment shutdowns would not result in a more hazardous condition tlian the lack of shutdown of the equipment. If a more hazardous situation would occur with shutdown, only a warning should be provided. As an example, a more hazardous situation might occur if blowout preventers were automatically actuated during drilling operations upon detection of low levels of gas concentrations than if drilling personnel were only warned. 

It is virtually impossible to design a fail-safe operation of a chemical process. However, many companies have attempted to minimize liazardous conditions by developing a systematic approach to process design. Implemention of these acdons hoped to aeliieve maximmn protection to personnel, equipment, and die public. 

The high-high probe is completely independent of the other probes and is hardwired to shut down the system completely, independent of the computer. (In the preliminary safety review, the hazards associated with HF overfeed were identified as important thus the independent high-high shutdown probe system was installed.) All systems are designed to fail into safe conditions. The HF control valves are air operated and of a design that makes it impossible for HF to contaminate the air supply. 

Automatic control systems neither replace nor relieve the operator of the responsibility for maintaining the facility. The operation of the control systems is periodically checked to verify proper operation. If a control system fails, the operator must be able to take over and control the process manually. In most cases, understanding how the control system works aids the operator in determining if the system is operating properly and which actions are required to maintain the system in a safe condition. 

Fail Safe - A system design or condition such that the failure of a component, subsystem or system or input to it, will automatically revert to a predetermined safe static condition or a state of least critical... 

The pilot plant must also be carefully designed so that its control and safety systems are, fail-safe, and any unexpected equipment or utility failure brings the unit into a safe and de-eneigized condition. Unexpected or rapid process changes, if they can herald or lead to dangerous conditions (eg, runaway exothermic reaction), should be continuously monitored by appropriate instrumentation and suitable automatic action provided (1,55—67). 

When a fault tree has been constructed, it can be used to estimate the probability of the system failing if the probabilities of the events in the fault tree can be estimated. In most cases, this requires a good understanding of the reliability of instruments, alarms, and safety devices, since these devices would be expected to maintain the process in a safe condition. 

---