Failures and dependability

FEW systems are built according to very strict requirements of dependability both in terms of safety (the system must not produce erroneous output signals) and availability. Most of these requirements come directly from official services (FAA, EASA, etc. [FAR/CS 25]). 

The rest of the article is stractured around the threats to safety and system availability, namely [AVI 01]  

It is interesting to note that the defenses against such threats are a useful protection against malicious attacks, in addition to more traditional measures. 

For each threat, we find a summary of the applicable airworthiness requirements and a description of methods used on FEW Aiibns, as well as the challenges and future trends. 

FAR/CS 25.1309 requires the demonstration that arty combination of failures with catastrophic consequences is extremely improbable. Extremely improbable is translated into quality requirements (see sections 6.3 to 6.5, [TRA 08]) and by a 10 probability per hour of flight. 

---

Without diminishing the role of electrostatic phenomena in adhesion, it should be noted that their influence is greatest in the course of adhesion joint failure and depends on the conditions of separation (especially its rate). In most instances, PCM are used under conditions, far from failure and separation, where the electric theory can be applied. 

Taking account of combinations of failures and dependent failure conditions from both internal and external causes (e.g. via the CCA). 

The expected life is sometimes used as an iadicator of system rehabihty however, it can be a false iadication and should be used with caution. In most test situations the chance of surviving the expected life is not 50% and depends on the undedyiag failure pattern. For example, considering the exponential as used ia equation 10, the expected life would be... 

The development of computer capabiUties in hardware and software, related instmmentation and control, and telecommunication technology represent an opportunity for improvement in safety (see COMPUTER TECHNOLOGY). Plant operators can be provided with a variety of user-friendly diagnostic aids to assist in plant operations and incipient failure detection. Communications can be more rapid and dependable. The safety control systems can be made even more rehable and maintenance-free. Moreover, passive safety features to provide emergency cooling for both the reactor system and the containment building are being developed. 

Much of the experience and data from wastewater treatment has been gained from municipal treatment plants. Industrial liquid wastes are similar to wastewater but differ in significant ways. Thus, typical design parameters and standards developed for municipal wastewater operations must not be blindly utilized for industrial wastewater. It is best to run laboratory and small pilot tests with the specific industrial wastewater as part of the design process. It is most important to understand the temporal variations in industrial wastewater strength, flow, and waste components and their effect on the performance of various treatment processes. Industry personnel in an effort to reduce cost often neglect laboratory and pilot studies and depend on waste characteristics from similar plants. This strategy often results in failure, delay, and increased costs. Careful studies on the actual waste at a plant site cannot be overemphasized. 

There are a variety of ways to express absolute QRA results. Absolute frequency results are estimates of the statistical likelihood of an accident occurring. Table 3 contains examples of typical statements of absolute frequency estimates. These estimates for complex system failures are usually synthesized using basic equipment failure and operator error data. Depending upon the availability, specificity, and quality of failure data, the estimates may have considerable statistical uncertainty (e.g., factors of 10 or more because of uncertainties in the input data alone). When reporting single-point estimates or best estimates of the expected frequency of rare events (i.e., events not expected to occur within the operating life of a plant), analysts sometimes provide a measure of the sensitivity of the results arising from data uncertainties. 

Safety analysis. A formal method of assessment should be used. Each component within the system should be considered in turn. The likely types of failure and their consequences for the system should be taken into account. This should include consideration of the reliability of operating procedures, where safety depends upon them, and should encompass both inadvertent and deliberate failure to follow procedures. 

We previously encountered failure modes and effects (FMEA) and failure modes effects and criticality analysis (FMECA) as qualitative methods for accident analysis. These tabular methods for reliability analysis may be made quantitative by associating failure rates with the parts in a systems model to estimate the system reliability. FMEA/FMECA may be applied in design or operational phases (ANSI/IEEE Std 352-1975, MIL-STD-1543 and MIL-STD-1629A). Typical headings in the F.Mld. A identify the system and component under analysis, failure modes, the ef fect i>f failure, an estimale of how critical apart is, the estimated probability of the failure, mitigaturs and IHissihiy die support systems. The style and contents of a FMEA are flexible and depend upon the. ilitcLiives of the analyst. 

Thi.s method assumes that X, the total constant failure rate for each unit, can be expanded into independent and dependent failure contributions (equation... 

It is unclear whether previously published fire risk analyses have adequately ircaicd dependent failures and systems interaetions. Examples of either experienced or postulated system interactions that have been missed include unrelated systems that share common locations and the attendant spatially related physical interactions arising from fire. Incomplete enumeration of causes of failure and cavalier assumptions of independence can lead to underestimation of accident l rci uencies by many orders of magnitude,... 

Since dependency analysis is not needed, we can go on to the BUILD program. Go to FTAPSUIT and select 5 "Run Build." It asks you for the input file name including extender. Type "pv.pch," It asks you for name and extender of the input file for IMPORTANCE. Type, for examle, "pv.ii . It next asks for the input option. Type "5" for ba.sic event failure probabilities. This means that any failure rates must be multiplied by their mission times as shown in Table 7.4-1. (FTAPlus was written only for option 5 which uses probabilities and error factors. Other options will require hand editing of the pvn.ii file. The switch 1 is for failure rate and repair time, switch 2 is failure rate, 0 repair time, switch 3 is proportional hazard rate and 0 repair time, and switch 4 is mean time to failure and repair time.)... 

Virolainen, R 1984, On Common Cause Failures Statistical Dependence and Calculation of Uncertainty Disagreement in Interpretations of Data, Nuc. Eng. and E 77 pp 103-108. 

The pressure and temperature of a container s contents at the time of failure will depend on the cause of failure. In fire simations, direct flame impingement will weaken container walls. The pressure at which the container fails will usually be about the pressure at which the safety valve operates. This pressure may be as much as 20 percent above the valve s setting. The temperature of the container s contents will usually be considerably higher than the ambient temperature. 

This manager requested quantitative results, so the analyst must estimate the probability of each failure or error included in the event tree. Data for all the failures and errors in this particular problem are available in tables in the Handbook, Swain and Guttman (1983). The analyst must modify these data as necessary to account for specific characteristics of the work situation, such as stress levels, equipment design features, and interoperator dependencies. Table 5.1 summarizes the data used in this problem. 

Analysis of Dependent Failure Events and Failure Events Caused by Harsh Environment Conditions Nuclear 700 events representing common cause failures and failures caused by harsh environments Licensee Event Reports on failures of 26 component and subcomponent types listed below 94. 

This is a letter report from JBF Associates Inc., to Sandia National Laboratories (SNL) summarizing JBF s efforts to analyze dependent (common cause) failures and failures caused by harsh environments. The information used for the analysis was ta)cen from over 1000 failure reports (mostly abstracts of LERs that were assembled for other studies). The 26 groups of components selected for study are accumulators, batteries, cables, control rod drives,... 

The report presents the findings from the analysis of the RCP failures. Estimates of the annual frequency for the spectrum of leak rates induced by RCP seal failures and their impact on plant safety (contribution to coremelt frequency) are made. The safety impact of smaller RCP seal leaks was assessed qualitatively, whereas for leaks above the normal makeup capacity, formal PRA methodologies were applied. Also included are the life distribution of RCP seals and the conditional leak rate distributions, given a RCP seal failure the contribution of various root causes and estimates for the dependency factors and the failure intensity for the different combinations of pump designers and plant vendors. 

A mechanical seal s performance depends on the operating condition of the equipment where it is installed. Therefore, inspection of the equipment before seal installation can potentially prevent seal failure and reduce overall maintenance expenses. 

Materials subjected to high temperatures during their service life are susceptible to another form of fracture which can occur at very low stress levels. This is known as creep failure and is a time dependent mode of fracture and can take many hours to become apparent (Fig. 8.88). 

Avoiding structural failure can depend in part on the ability to predict performance of materials. When required designers have developed sophisticated computer methods for calculating stresses in complex structures using different materials. These computational methods have replaced the oversimplified models of materials behavior relied upon previously. The result is early comprehensive analysis of the effects of temperature, loading rate, environment, and material defects on structural reliability. This information is supported by stress-strain behavior data collected in actual materials evaluations. 

Avoiding product failures can depend, in part, on the ability to predict the performance of plastic materials and their shapes. With available time, the usual approach of product prototype and/or field-testing provides useful and reliable performance data when conducted properly. As an example designers continue to develop sophisticated computer methods for calculating stresses in complex structures. 

---