Probability failing safely

Any of the products of brine electrolysis, chlorine, sodium hydroxide, and hydrogen can be hazardous if released. When releases do occur, it is usually from process upsets or breakdowns, which may be minimized by the construction of fail-safe plants, proper maintenance, and by safe transport and storage practices. Probably of greater long-term concern is the mercury loss experienced through the process streams of a mercury cell chloralkali operation. These losses can also carry over to the products of the diaphragm cell, even though this does not use mercury, if a common brine well or common salt dissolver is used for both sets of cells. 

Why would the British have sanctioned the use of a biological weapon Partly they must have wanted to ensure that the assassination of Heydrich, once embarked upon, would be almost certain to succeed what they knew of X must have convinced them that it was the perfect fail-safe weapon. Certainly there would have been few moral qualms. Those in MI 6 who plotted the killing probably felt that making Heydrich the first victim of a poisoned weapon was a fitting end for so despised an enemy. And it was, also, an opportunity for Fildes to see whether X really would work as a weapon. 

According to Loxham (1993) "there is a trade-off between on the one hand a site selection and design for a maximum integrity and small failure probability, and on the other, a broader choice of site locations and designs with fail-safe... 

Most practitioners define "Fail-Safe" for an instrument as a failure that causes a "false or spurious" trip of a safety instrumented function unless that trip is prevented by the architecture of the safety instrumented function. Many formal definitions have been attempted that include "a failure which causes the system to go to a safe state or increases the probability of going to a safe state." This definition is useful at the system level and includes many cases where redundant architectures are used. 

Some failures within a piece of equipment have no effect on the safety instrumented function, nor cause a false trip, nor prevent automatic diagnostics from working. Some functionality performed by the equipment is impaired, but that functionality is not needed. These may simply be called "No Effect" failures. They are typically not used in any reHabihty model intended to obtain probability of a false trip or probabihty of a fail-danger. Per 1EC61508, these would be classified as "Fail-Safe" or may be excluded completely from any analysis depending on interpretation of the analyst. 

There is a probability that a safety instrumented function will fail and cause a spurious/false trip of the process. This is called probability of failing safely (PFS). There is also a probability that a safety instrumented function will fail such that it cannot respond to a potentially dangerous condition. This is called probability of failure on demand (PFD). 

The same approximation techniques can be used to generate a formula for probability of failing safely, PFS... 

Two controllers can be wired to minimize the effect of dangerous failures. For de-energize-to-trip systems, a series cormection of two output circuits requires that both controllers fail in a dangerous manner for the system to fail dangerously The loo2 configuration typically utilizes two independent main processors with their own independent 1/O (see Figure F-6). The system offers low probability of failure on demand, but it increases the probability of a fail-safe failure. The "false trip" rate is increased in order to improve the ability of the system to shut down the process. 

Flow interruption is effected by the level gauge LSHl which activates the solenoid valve VSOLl. This in turn closes the shut-off valve VI (the shut-off valve is fail-safe on instrument air failure with an idealized failure probability of 0). For... 

Of course, it would make sense in this case to use fail-safe valves, i.e. valves which close on instrument air failure. Then air failure would not cause the undesired event unless none of the two valves would adopt its rest position (closed), which might occur with a certain—even if small—probability. 

Use as many Fail Safe Principles [Kritzinger (2006) Chapter 7 para 3] as possible to help provide substantiation of qualitative probability declarations. 

The acceptance of a qualitative or quantitative failure probability declaration is often based on the assumption that failures are independent (AMC25.1309). Independency is often accomplished in duplication of systems/components. Redundancy, and the independence thereof, is a key feature in fail safe designs of system requiting high level of functional integrity. 

As discussed in Chapter 6, the acceptance of a System Level 3 or 4 (see Fig. 1.1) failure probability is often based on the assnmption that failures are independent (AMC25.1309). However, this approach does not snfQciently recognise (refer, inter alia, SAE ARP4761 App I para 1) the threats which external events (outside of the immediate system boundary) have on assumptions made about the robustness of our fail safe designs. 

Safety Safety S(t) of a system at time t is the probability that the system either performs its function correctly or not in a fail safe manner in the interval [0, t], given that the system was operating correctly at time 0. The issue here is fail safe operation or not. 

As long as no subcritical crack propagation (section 5.2.6) or fatigue (section 10.3) occurs, the tested component is now fail-safe in service if proof test reduces the probability of failure at a certain stress level. This change in the probability of failure is now calculated. 

Scenario 4 is a different story. It is obvious that the likelihood is fairly high and the results are from critical to catastrophic. If we use the toxic cloud release example, this indicates that scenario 4 is a problem. It cannot stand as is the system needs to be modified in some fashion to lower the risk profile. If the failure scenario of that particular scenario is motor fails on, then the fix may be fairly easy. Various fail-safe controls could probably be put in place without much expense to mitigate the consequences. 

Following these principles in a more specific way for polymerization reactions, three levels of priority can be defined in decreasing order, the first priority is the reduction of severity by design. As a second priority, technical measures for control of the reaction to avoid runaway should be considered. The aim is to obtain a fail safe process by reduction of the probability of occurrence of an incident. As last resort only, emergency measures should be taken in order to mitigate the consequences of runaway. In any case, the basic principle remains Avoid runaway rather than mitigate its consequences. ... 

Increase In gas pressure above the hot sector leads to a fall in the moderator level power in this sector, but would apparently be accompanied by a rise In the moderator level and power in the other sectors (probably the greatest rise occurring in the sector with the currently largest gas pocket). Is this desirable and is it fail-safe What would happen if there were a failure in the gas pressure above one sector Does an Immediate drop in moderator level and flux in other sectors hold down the transient in the sector in which the gas pressure has fallen ... 

Structures, systems and components important to safety shall be designed and located so as to minimize, consistent with other safety requirements, the probabilities and effects of fires and explosions caused by external or internal events. The capability for shutdown, residual heat removal, confinement of radioactive material and monitoring of the state of the plant shall be maintained. These requirements shall be met by suitable incorporation of redundant parts, diverse systems, physical separation and design for fail-safe operation such that the following objectives are achieved ... 

As time t becomes large, the oil and gas industry system steady-state probability of failing safely using Equation 11.14 is... 

Assume that a system used in the oil and gas industry can fail safely or unsafely and its constant failure rates are 0.0008 and 0.0002 failures/h, respectively. Calculate the probabilities of the system failing safely and unsafely during a 200-h mission. 

---