Safe fault

The fraction of the overall failure rate of a device that results in either a safe fault or a diagnosed (detected) unsafe fault. The safe failure fraction includes the detectable dangerous failures when those failures are annunciated and procedures for repair or shutdown are in place. 

Note WARNING to ensure safe fault monitoring, the DCS should be able to detect fail high and fail low conditions as malfunction indicators. 

This metric reflects the robustness of the item to single-point and residual faults either by coverage from safety mechanisms or by design (primarily safe faults). A high single-point fault metric implies that the proportion of singlepoint faults and residual faults in the hardware of the item is low. 

NOTE 3 If the above estimations are considered too conservative, then a detailed analysis of the failure modes of the hardware element can classify each failure mode into one of the fault classes (single-point faults, residual faults, latent, detected or perceived multiple-point faults or safe faults) wifli respect to the specified safety goal and determine the failure rates apportioned to the failure modes. Annex B describes a flow diagram that can be used to make the fault classification. 

System Fail Safe Fault Rate Faults/Year Fail to Danger Fault Rate Faults/Year Fractional Dead Time... 

Arrange fail-to-safe fault rates across the top of the model Arrange fail-to-danger rates across the bottom of the model Sum rates into sensor, logic and actuator groups... 

Protection with internal fuses is easier, as fuses are provided for each element which can contain the severity of the fault well within the safe zone in all probability. Some users even recommend capacitor units 250/300 kVAr and above with internal fuses only. Figure 26.1 shows a typical operating band of (he internal fuses for an internally protected unit. It demonstrates a sufficient margin between the operation of (he fuses and (he shell s safe zone. The fuse characteristics are almost the same for all manufacturers. 

It is possible that during the fault only one ot the insulators is subject to the transitory first peak of the fault, as there may be slight misalignment between the insulators, asymmetry in the busbars, an imperfect bolt fixing and their fastening, or a combination of such factors. To be on the safe side it is advisable to consider each support and its fasteners to be suitable to withstand the forces by themselves. We have assumed a factor of safety of 100% in all the above calculations to account for this. 

Intrinsic Safety. Static electrical concepts such as minimum ignition energy do not directly apply when assessing the safety of electrical circuits such as radios, flashlights and instmmentation. Intrinsically safe electrical equipment is usually available which has been subjected to fault analysis and testing. The equipment must be certified for the flammable atmosphere in which it will be used (NFPA 497). Refer to texts on Intrinsic Safety such as [63]. 

The OWR protective systems were modeled with event tree diagrams for the time sequence following an initiating event to fuel damage or safe shutdown. Fault trees were used to find the probability of failure of each protective system in a particular event tree. 

The view is therefore growing that we should try to design plants so that they are safe even if there is a fault in the software. This can be done by adding on independent safety systems, such as relief valves and hardwired trips and interlocks, or by designing inherently safer plants that remove the hazards instead of controlling them (see Chapter 21). 

As can be noted in Figure 21.7.2, steam and ediane are mi.xed before entering die reactor tubes where pyrolysis reacdons take place. All feed and product lines must be equipped with appropriate control devices to ensure safe operation. The FTA flow chart breaks down a TOP event (see descripdon of fault tree in Unit II) into all possible basic causes. Aldiough, diis mediod is more structured than a PHA, it addresses only one individual event at a dine. To use an FTA for a complete liazard analysis, all possible TOP events must be identified and investigated this would be extremely time consuming and perhaps urmecessary in a preliminary design. 

Where a.c. supplies exist, transformer-rectifiers are the most economical source of d.c. for cathodic protection systems. In the case of pipelines, standard transformer-rectifiers, either oil or air cooled, can be employed. They range in size from 5A, 5V for small systems to 100 A, 48 V for major pipeline schemes. A typical output for a well-coated cross-country pipeline in the UK would be 5 A, 48 V. In the case of sea-water jetties where the voltage required is usually low because of the lower sea-water resistivity, a typical rectifier size for a major installation would be 500 A, 18 V. For offshore pipelines and loading platforms where a fire hazard exists, it is usual to employ certified flameproof or intrinsically safe rectifiers to overcome any possibility of fire hazard should faults develop in the unit. 

All of these point defects are intrinsic to the heterogeneous solid, and cirise due to the presence of both cation and anion sub-lattices. The factors responsible for their formation are entropy effects (stacking faults) and impurity effects. At the present time, the highest-purity materials available stiU contain about 0.1 part per billion of various impurities, yet are 99.9999999 % pure. Such a solid will still contain about IQi impurity atoms per mole. So it is safe to say that all solids contain impurity atoms, and that it is unlikely that we shall ever be able to obtain a solid which is completdy pure and does not contain defects. 

Intrinsically Safe Circuits A circuit which any spark or thermal effect, produced either normally or in specified fault conditions, is incapable, under the test conditions prescribed in this standard, of causing ignition of a mixture of flammable or combustible material in air in its most easily ignited concentration."(3)... 

---