Graceful failure

Any graceful degradation features and repair philosophy after system failure. 

Viewed in this context, the Three-Mile Island (TMI) accident was the coup de grace for an already foundering industry. In spite of the fact that the hydrogen gas bubble that accumulated in Reactor 2 did not explode, although some contaminated gas escaped and that the commissions who investigated the accident faulted human error rather than equipment failure, TMI caused (as the New York Times... 

Reliability and availability Does the running system reliably continue to perform correctly over extended periods of time What proportion of time is the system up and running In the presence of failure, does it degrade gracefully rather than shut down completely Reliability is measured as the mean time to system failure availability is the proportion of time the system is functioning. Both qualities are typically dealt with by making the architecture fault-tolerant using duplicated hardware and software resources. 

Start-up, monitor, shutdown, and failover, the mechanisms to start up the system, monitor its operations for things such as time-outs, shut the system down gracefully, and deal with failures... 

Die Orcutt model is very simple, offering analytical solutions, and thus is a useful tool for a rough estimation of the effect of various parameters on the operation of fluidized beds (Grace, 1984). However, it should be used only for qualitative comparisons, since its predictions have often been inaccurate compared to the experimental values obtained. The sources of those failures are the predicted uniform concentration of gas in the dense phase, which is not the case in experiments, and the assumption of the absence of solids in the bubble phase, which results in underestimating the conversion in the case of fast reactions. 

Fig. 12.1 Typical stress-strain curve for a ceramic composite showing graceful failure.

We have the power and the means to expose more heroes and to address their human failures candidly, without dissecting every last flaw. No one is perfect, no matter how much we might wish them to be. Perhaps this is the most important lesson taught by the men and women who are true heroes. They show us how to be people of courage despite the odds, and to be people of grace, kindness, and nobility despite our humanity. 

The LINUX cluster had been managed under continually increasing load for a period of months. Systems administrators had responded by incremental addition of PCs, but the performance had shown continued decline. The system was loaded near capacity, which is often far below theoretical, 70% of maximum being a common benchmark. Another feature of the system, which is especially relevant to clusters, was the impact of component failure. For computers, this is likely the disk drive. Drives have a mean time between failure of one to two years and follow a bathtub curve of burn-in failure, followed by reliable performance and then high failure near the end of the lifecycle. Cluster design must take into account the need for graceful degradation. 

Answer Any component can be shorted or opened by the safety agency during their testing. Even the possibility of a solder connection coming undone anywhere, or a bad via between layers of a PCB would be taken into account. Any such single-point failure is expected to usually cause the power supply to simply shut down gracefully, or even fail catastrophically. That is fine, but in the process, no hazardous voltage is permitted to appear on the outputs, even for a moment. 

For example, there is no reason why a conspiracy charge could not be predicated on a failure to report substantial risk information to the EPA even if the information had been reported to a state agency. See infra W.R. Grace. 

Aside from the work performed at NASA Ames, recent work by Levine et al., at NASA Glenn, has been conducted to improve the oxidation resistance of monolithic materials and to develop fiber reinforced UHTC materials to improve composite fracture toughness and impart a level of graceful failure in materials. 

While all of these features of good package design are expected to provide the desired property of graceful failure, it is also true that there are only very limited data available on packages tested to failure to see how release increases with severity of the accident environment. Limited test data and analyses that have been performed support the concept of graceful failure [44-46]. 

---