Fail safe electrical

Fail Safe-An instrument that on loss of power (pneumatic, electric, etc.) will go to a position that cannot create a safety hazard. 

Generally, electrical control systems are designed Fail-Safe. If power is temporarily lost, unnecessary shutdown of the process may occur. Thus, most safety systems such as fire and gas detectors, Nav-Aids, communications, and emergency lighting require standby D.C. power. 

Fail-safe procedures Examines the consequences of utility failures, such as loss of steam, electricity, water, air pressure, or inert padding. Describes what to do for each case so that the system fails safely. 

The filling method (See Figure 2) is essentially a fail-safe system in that controls are designed to prevent double-cycling. The filling valve and the reservoir valve are electrically interlocked so... 

If a sprinkler system is installed in a computer room or similar area, provisions must be made to automatically de-energize all electrical power to the room and equipment, except power to lighting, in the event of sprinkler operation. Ensure that de-energizing activity leads to a fail-safe condition. Preferably, this should take place prior to water application to minimize damage to exposed electronic circuits. This can be accomplished automatically by smoke detection systems. Manual activation is tolerable for constantly attended locations. Where automatic sprinklers are installed in areas containing minimal combustibles as described above, a sprinkler density of 0.10 gpm/ft (0.38 Ipm/m ) should be provided. Refer to NPEA 75. 

Electrohydraulic actuators have similar performance characteristics and cost/maintenance ramifications. The main difference is that they contain their own electric-powered hydraulic pump. The pump may run continuously or be switched on when a change in position is required. Their main application is remote sites without an air supply when a fail-safe spring return is needed. 

Although, at the end of the twentieth century, the accident at Chernobyl has made the use of fission reactors (eventually breeders) politically unacceptable, it must be recalled that our society can be run on electricity from nuclear reactors, with hydrogen as the storage medium and fuel for transportation. Fail-safe reactor schemes have been described in the literature. The eventual choice between nuclear energy and renewables will be one of cost. 

Wheel-speed sensors do not monitor speed directly they sense the movement of the circumference of the tire. This is done with 48 or 32 pulses per turn, and some correction factor for tire sizes. This information comes from driven and non-driven wheels, and means four independent sources of information describing road surface, friction coefficient, cornering etc. In all cases the information is passed through the electronic control unit (ECU). ABS and all advanced systems are safety systems that do not allow the electrical signal to be split before it goes to the ECU. This is necessary to make a fail-safe system. 

Heating may be accomplished by placing around the vessel an electrical band heater fitted with a thermostat, preferably of the fail-safe type, which cuts off if the sensor (a thermocouple or a thermistor) fails. If this is not the case, it is recommended—from bitter experience—that a thermal cutoff switch in contact with the vessel should be fitted, so that, if the temperature reaches, say, 100 °C, the heater will cut out. Overheating can damage the vessel and ruin a reaction. 

Power fail-safe/automatic restart In the event that power to the computer is lost, this option senses the power failure and executes a prespecified set of instructions before the machine becomes inoperable. These instructions may transfer control of the process from the digital computer to another back up control system and/or save information necessary for an orderly and automatic restart of the control programs when electrical power has been restored to the computer. This option enhances the safety of computer-controlled processes. 

In the most common design, a fail-passive arrangement reduces the system to its lowest energy level. The system will not operate again until corrective action is taken. Circuit breakers and fuses for protection of electrical devices are examples of this type of fail-safe device. Solenoid valves (see Figure 11-3), such as this one on a steam control valve which is configured fail close shuts off instrument air, are another example. 

Depending on the degree of potential catastrophe, there usually is more than one safety interlock for a potential catastrophic event. Each of these safety interlocks including the sensor/transmitter, control function, and final control element are usually independent of the other safety interlocks for the same event. For maximum protection, each sensor for the same event should be unique to eliminate the potential of a common failure. The safety interlock must be fail-safe. This means that any loss of interlock power—electricity, air, hydraulics, etc.— loss of signal, must produce the same action as the safety interlock produces when it is activated (tripped). 

Electrically powered actuators have not historically been able to provide fail safe functionality. Today there are some smaller partial turn electric actuators that have a spring return in the event of total loss of power. While these have the ability to close without power, there is a significant addition of complication that impacts the reliability when compared to a simple spring return hydraulic or pneumatic actuator. A response to this has been the electro-hydrauUc actuator that permits the safety functionality of a hydraulic piston fail safe actuator. The electrical portion provides power to the hydraulic system and the loss of which may be treated as a trip signal in addition to the basic shutdown signal. 

Safety interlocks, common to machinery, provide a means either of preventing operator access to a hazardous area until the hazard is removed or of automatically removing the hazardous condition (i.e., electric shock, moving parts) when access is gained. Safety interlocks have special requirements, such as fail-safe design, positive opening, and nonoverridable type. 

Fail-safe interlock—An interlock where the failure of a single mechanical or electrical component of the interlock will cause the system to go into, or remain in, a safe mode. 

Fail-safe devices may be fail-passive, fail-active, or fail-operational. A fail-passive device, such as electrical circuit breakers or fuses, wdl render a system inoperative or de-energized until corrective action is taken. A fail-active device will keep a system energized but in a safe mode until there are corrective actions. A fail-operational device allows a system to function safely, even when the device fails. 

A local representative would carry out any instractions received from the central monitoring station and could also serve as an initial contact point for local citizens, should a need arise. Simple, fail-safe means would be provided for the local representative to place the reactor in a safe shutdown state at any time. For example, the local representative would have access to a reactor trip button from outside the reactor room that disrupts electrical power to the control rods allowing them to drop into the core by gravity. 

A qualified reactor operator would make small adjustments to the control absorber mechanical stop positions on a routine, periodic basis, but without physical access to tire control rods, similar to the procedures presently used with submarine reactors. Care in the uKchanical and electrical design of control rods and their drive mechanisms is essential to ensure fail-safe operation and to prevent inadvertent rod withdrawal events and the development of possible rod ejection forces from pressure gradients under any circumstances. 

A new type of hydraulic drive mechanism is used to drive the control rods in HR-200. In the drive system the reactor coolant (water) is the actual medium. The water is pumped into step-cylinders of which the movable parts contain the neutron absorber. A pulsed flow, generated by a controlling magnetic valve in the control unit moves the movable part of the step-cylinder step by step. The drive system is very simple in its stmcture and is designed on the "fail-safe" principle, i.e. all control rods will drop into the reactor core by gravity under loss of electric power, depressurization, postulated breaks in its piping systems and pump shut down events. 

The nuclear system protection system initiates the rapid insertion of the control rods to shut down the reactor. The system is of the fail-safe design where it will trip on loss of electrical power but will not trip and cause a scram on the loss of a single power source. The four trip channels are physically separated from each other and from other equipment precluding the possibility of interactions that could cause possible false scrams or failure to scram. The logic requires a manual reset by the operator, which is automatically inhibited for 10 s. One reset switch is used for each trip channel. Failure of a single trip channel, division logic, or a system component will not prevent the normal protective action of the nuclear system protection system. 

Air filtration, the real heart of the system, was a major concern for the safety community. It was necessary to build in redundancy with every major component to ensure a fail-safe system. This consisted of dual High Efficiency Particulate Air (HEPA) and carbon filters, dual vacuum gauges, dual air pressure alarms, dual motor blowers to draw air through the glovebox, dual sources of electricity and a Hame Photometric Detector (FPD) to monitor between the carbon beds for possible breakthrough of chemical compounds. This was necessary because the effluent air from the filter beds was being released into the working environment of the operators. Army... 

---