Failure recovery

Inadequate nutrition and conditions which are complicated by malabsorption may lead to thiamine deficiency. Beriberi, a diet-deficiency disease, is especially prevalent in those parts of the East where the diet consists mainly of polished rice. The disease is characterized by neuritis but may also lead to serious heart failure. Recovery is prompt when adequate amounts of vitamin B1 are restored to the diet. Severe deficiency as can occur in alcoholics may lead to Wernicke s encephalopathy, often accompanied by Korsakoff s syndrome. Care should be taken with intravenous substitution with thiamine in these cases to prevent serious complications like vascular collapse with hypotension, respiratory distress or an-gioedema. 

Interfaces with other systems Start-up and failure recovery... 

Verification of test equipment calibration Verification of controls and indicators Computer control system testing Verification of sequence of operations Verification of major components operation Verification of alarms Power failure/recovery testing... 

The guideword process can be supplemented by additional topics/questions based on an analysis of previously experienced design deficiencies and operational incidents. For instance, ICI has collated a database of over 350 operational incidents that it uses to refine its CHAZOP Study process. Some example questions for the CHAZOP Study are given in Appendix 8E at the end of this chapter. Of particular interest to the study is the effect of partial or catastrophic failures, recovery mechanisms (e.g., rollback and roll-forward), and the general usability of the system (e.g., the need for multiple screens to access data, screen refresh times, meaningful information displays). The list of questions can be expanded with operational and regulatory experience. 

Performance response times (e.g., screen refresh rates, cycle times, and critical control response times), Mean-Time-To-Failure (MTTF), system remedial action, power failure recovery, startup, shutdown... 

The acute effects of aldicarb exposure are due to cholinergic overstimulation and may include the SLUDGE syndrome (salivation, lacrimation, urination, diarrhea, gastrointestinal cramping, and emesis), respiratory depression, bronchospasms, increased bronchial secretions, pulmonary edema, blurred vision, miosis, headache, tremors, muscle fasciculations, convulsions, mental confusion, coma, and death due to respiratory failure. Recovery from nonlethal exposures occurs very rapidly, usually within a few hours. 

Fortunately, bed rest, rehydration, parenteral nutrition, and therapy directed at decreasing the production of toxins that result from bacterial degradation of nitrogenous substrates in the gut lumen (e.g., administration of lactulose, which reduces gut ammonia levels by a variety of mechanisms, the use of enemas and antibiotics to decrease the intestinal flora, a low-protein diet) prevented Percy Veere from progressing to the later stages of hepatic encephalopathy. As with most patients who survive an episode of fulminant hepatic failure, recovery to his previous state of health occurred over the next 3 months. Percy s liver function studies returned to normal, and a follow-up liver biopsy showed no histologic abnormalities. 

Airworthiness of civil aircraft depends upon a process by which a team composed of aircraft manufacturers, regulators, and one or more airlines predicts possible system failures. This process. Maintenance Steering Group 3 (MSG-3), considers possible failure pathways (e.g., in structures, controls, avionics) and for each pathway determines a recovery strategy. For structural failure, this may be replacement after a fixed service life, regular inspection to ensure detection, or an indication to crew of the malfunction. The concern here is with the reliability of the primary failure recovery system for aircraft structural inspection regular inspection to ensure detection. 

High availability, no single point of failure When a system experiences a failure, it should continue operation without interruption during repair, that is, failure recovery. 

In explanation-based generalization (EBG), there is some research on failure recovery (such as by [Gupta 87]), which is quite similar in spirit to the derivation of weakest pre-conditions. 

A. Gupta. Explanation-based failure recovery. In Proc. of the 1987 Conf. of the Am. Assoc, for Artificial Intelligence, Vol. 2, pp. 606-610. Morgan Kaufmann. 

FAILURE[7] is the failure recovery module. Sometimes Ml fails to meet all specifications and constraints. FAILURE analyzes the cause of these failures, and allows the user to interactively fix it. Fixes typically consist of either choosing a different part, or relaxing the violated constraint. FAILURE uses a dependency network [17] to automatically determine the affected portions in the design. FAILURE then directs Ml to redesign them. 

A. Daga and W.P. Birmingham. Failure recovery in the MICON system. In Proc. of the 27th Design Automation Corf. IEEE Computer Society and ACM-SIGDA, 1990. 

The next step is the computation of the resilience regions within the two failure-recovery regions, as described in Section III. 

Once the states x, x enter the out-of-operation region O at a certain finite time, the system cannot recover back to the operation region O. But in the two failure-recovery regions Ry and it is possible for the system to return to the operation region. 

To find the specific resilience region, we compute a resilience curve to separate the end-to-failure and end-to-recovery parts in the failure-recovery region. The situation in Ry is considered first, whose dynamic equations are (the coupling factors are neglected at first) ... 

Figure 7 illustrates the resilience curves, which separate the resilience regions from the non-resilience regions within the failure-recovery region, as described by the equations (25) and (26). 

The equilibrium point locus is another important aspect for the system resilience. For example, if the equilibrium point of the operation mode resides in the failure-recovery region, we can observe a chattering behavior like the one shown in Figure 9. 

---