Multiple-point failure

Fault-tree analysis (FTA) focuses on the identification of multiple point failures by using a deductive top-down method to analyze effects of initiating faults and events occurring in complex systems. FTA works very well, showing how complex systems can overcome single or... 

Heat shock proteins (HSPs) are synthesized by cells in response to an increase in temperature, as well to various other stressful stimuli. Their main function is to ensure intracellular protein homeostasis, thus preserving the cells viability in the presence of aggression. Current evidence points to a protective role for HSPs in several aspects of critical disease, such as ischemia-reperfusion, ARDS, and multiple organ failure. The increase of a few degrees Celsius above the normal environmental temperature of cells leads to the heat shock response 1) rapid expression of heat shock genes, 2) suppression of normal protein synthesis, and 3) the ability of cells to survive a second and otherwise lethal heat challenge (thermotolerance). 

It may not be credible that multiple simultaneous failures and maloperations occur. In considering what is credible, the following points may be useful ... 

There is accumulating evidence that apoptosis plays an important role at multiple points in the evolution of MI not only in the acute phase but also in remodeling and development of heart failure after MI. 

Design, when allowed, to minimize or eliminate single-point failures that have an undesired consequence. Make at least 2-fault tolerant, that is tolerant of multiple faults or system breakdown that would have adverse safety consequence. 

The second and more common hardware FMEA examines actual system assemblies, subassemblies, individual components, and other related system hardware. This analysis should also be performed at the earliest possible phase in the product or system life cycle. Just as subsystems can fail with potentially disastrous effects, so can the individual hardware and components that make up those subsystems. As with the functional FMEA, the hardware FMEA evaluates the reliability of the system design. It attempts to identify single-point failures, as well as all other potential failures, within a system that could possibly result in failure of that system. Because the FMEA can accurately identify critical failure items within a system, it can also be useful in the development of the preliminary hazard analysis and the operating and support hazard analysis (Stephenson 1991). It should be noted that FMEA use in the development of the O SHA might be somewhat limited, depending on the system, because the FMEA does not typically consider the ergonomic element. Other possible disadvantages of the FMEA include its purposefiil omission of multiple-failure analysis within a system, as well as its failure to evaluate any operational interface. Also, in order to properly quantify the results, a FMEA requires consideration and evaluation of any known component failure rates and/or other similar data. These data often prove difficult to locate, obtain, and verify (Stephenson 1991). 

Following a multiple-tube failure in a PFR superheater in 1987, two models were proposed to place deterministic limits upper limits on tiie number of tube failures following an initial leak. These were a reaction flame heat transfer model, to show that a large number of tubes could not be brought to the point of failure at the same time, and a piston expulsion model, where most of the sodium would be expelled from the SGU, blanketing the tubes with steam eind stopping the sodium water reaction when a certain number of tubes had failed. 

Fault Tree Analysis (FTA) is a well known and widely used safety tool, implementing a deductive, top down approach. It starts with a top level hazard, which has to be known in advance and "works the way down" through all causal factors of this hazard, combined with Boolean Logic (mainly AND and OR gates). It can consider hardware, software and human errors and identifies both single and multiple points of failure. Both a quantitative and qualitative analysis is possible. 

Multiple iterations possible from concept stage to detailed design stage Enables early identification of potential problems Single point failure Better assessment of effects... 

I was doing an FME A of a blowont preventer, a series of valves that control the back pressnre of snbsea oil drilling eqnipment, that had a lot of designed-in redundancy for safety. The blowont preventer had multiple redundancy (for safety reasons) methods to operate these critical valves during an emergency. These redundant systems were bnndled in rednndant hosing down to the seabed, a redundant path to the blowont preventer. Ironically, the single-point failure to the entire safe and reliable operation of the system was a manual valve that switched operations from a side A rednndant path to side B. If that valve got stuck in the middle, potentially, neither side wonld work. When discovered, obviously, this was quickly fixed. 

NOTE 3 If the above estimations are considered too conservative, then a detailed analysis of the failure modes of the hardware element can classify each failure mode into one of the fault classes (single-point faults, residual faults, latent, detected or perceived multiple-point faults or safe faults) wifli respect to the specified safety goal and determine the failure rates apportioned to the failure modes. Annex B describes a flow diagram that can be used to make the fault classification. 

This approach to using multiple components is based on the fact that NASA experience indicates the prudence of having redundant components, even if they have demonstrated reliability, to ensure that manufacturing defects or human error does not lead to a mission ending failure. For those components where redundancy is considered impractical, exceptions to the single point failure avoidance requirement is provided. For the... 

One of the most widely used assumptions in quantitative analyses is that failures of components or sub-systems are independent of any other failures. This assumption greatly simplifies the analysis and is therefore very convenient. Although most essential and critical systems employ some sort of redundant technique, closer scrutiny soon makes it apparent that many of these systems have a single element (or common point ), the failure of which will cause multiple chaimel failures. This means that any conclusions drawn from these results need to be evaluated for sensitivity to common cause failures. We need to constantly ask ourselves whether this assumption is realistic and, if it is not, whether the analyses need to be modified to take account of any common cause failures. 

We would be remiss in our obligations if we did not point out that the regions of multiple solutions are seldom encountered in industrial practice, because of the large values of / and y required to enter this regime. The conditions under which a unique steady state will occur have been described in a number of publications, and the interested student should consult the literature for additional details. It should also be stressed that it is possible to obtain effectiveness factors greatly exceeding unity at relatively low values of the Thiele modulus. An analysis that presumed isothermal operation would indicate that the effectiveness factor would be close to unity at the low moduli involved. Consequently, failure to allow for temperature gradients within the catalyst pellet could lead to major errors. 

---