Safety control function

The system shall be provided with sufficient controls for a system shutdown, and for returning the system to a stable condition from all situations that can occur with any significant probability. Further information about controls and instrumentation may be found in Section 8. 

An accumulation of a given quantity of fissile material may cause a criticality accident. The design and operation of an incineration system for wastes containing fissile radionuclides shall be such that criticality cannot occur. The following aspects are important  

In the design and operation of an incineration facility for wastes containing more than trace quantities of fissile materials, a criticality safety analysis shall be carried out and appropriate operational limits shall be established. Inventory control of the fissile nuclides should be the key element in the criticality safety. The following provisions shall be taken into consideration  

In addition to meeting the radiation protection requirements for plant operations and keeping the radiation doses ALARA, the design shall also meet the applicable regulatory requirements for non-nuclear industrial safety. 

---

A lot of effort goes into treating risks and this is where the safety management control function features. The safety control function or IISSMECC is shown in Model 7.7. 

This safety control function is part of the risk management plan and is derived from the hazard identification, risk analysis, and risk evaluation, which are the three legs of risk assessment. 

These control functions prevent abnormal process actions that would jeopardize personnel safety, harm the environment, or damage equipment and/or property. 

Same sensor used for basic process control system and safety instrumented system. Failure of sensor leads to loss of control system and safety system functionality. 

The function of safety controls should be checked at least once a year. 

The checking and readjustment as necessary of all safety controls is an essential part of periodic maintenance - possibly annually. A time should be chosen when temporary stoppage of the plant will not cause inconvenience. Unsafe conditions can be set up by throtding valves, stopping pumps, or removing the load. In each case the relevant safety control should function at the pre-set conditions. Safety checks on specialized items such as fire dampers may be required from time to time by local authorities, and these checks, together with the expert advice available from the testing officers, should be welcomed as proof of the inherent safety of the installation. 

LOPA is a semi-quantitative tool for analyzing and assessing risk. This method includes simplified methods to characterize the consequences and estimate the frequencies. Various layers of protection are added to a process, for example, to lower the frequency of the undesired consequences. The protection layers may include inherently safer concepts the basic process control system safety instrumented functions passive devices, such as dikes or blast walls active devices, such as relief valves and human intervention. This concept of layers of protection is illustrated in Figure 11-16. The combined effects of the protection layers and the consequences are then compared against some risk tolerance criteria. 

Any critical safety related control function should be protected from impairment from an accidental event that would render the device unable to fulfill its function. 

There are control functions such as safety interlocks, batch management, and scheduling. 

Operational checks are normally presenting process control computer systems. These systems may contain code that is part of the master production record. At the system level, the purpose of operational checks is to execute algorithms, sequencing of operations, and safety-related functions as required in the applicable customer specification. Inspections and testing are fundamental processes to be performed during the validation of critical system sequences. In addition, an ongoing program must be established to frequently verify that critical operations occur in the proper sequence. 

Already now, in cars of the upper class, there are about 80 ECUs (Embedded Computing Units) and five or more bus systems, controlling comfort as well as safety critical functions. Most of the innovations (80-90%) in cars are ICT-driven, especially product individualization and differentiation are based on ICT. The cost of electronics and software in such a car will rise from 25% to more than 40%. On the other hand, according to reports at the 2003 informatics conference in Germany, 55% of car failures are caused by electronics and software, and the X-by-wire implementation plans had to be delayed by major players in the field by years. Diagnosis and maintenance in the field are again a challenge—because of complex electronic systems. 

It has been demonstrated, that mass deployment of networked, dependable embedded systems with critical control functions require a new, holistic system view on safety critical and security critical systems. Both communities have to interact, communicate and integrate at the end. A unified approach to address the safety AND security requirements of safety related systems is proposed, based on the functional safety standard IEC 61508 and IT-Security management standards, handbooks and guidelines. 

One of the main quality control functions of the monitor is oversight of data collection in CRFs. The responsibilities of the monitor here include checking on investigators compliance with the protocol, subject safety, and thorough and complete reporting of all AEs. 

Compared with DC, particular difficulties arise from reflections on the cable in the mismatched state by application of alternating current in a higher frequency range (Fig. 6.240). This fact results in functional and safety-related problems, which may be controlled by restriction to relatively short cables and by applying the AC safety control circuit as established by PTB Physikalisch-Technische Bundesanstalt, Germany. 

Structural Fatigue and Failure Damage to Equipment Equipment Malfunction Vibration (and Noise) Control for Personnel Safety and Function Comfort, Acceptance, product "Feel" Effects on Instruments, Processes, and Precision Equipment... 

In general, there are two different architectures for BMSs namely, decentralized systems and centralized systems. These two architectures are illustrated for an electric vehicle (EV) application in Fig. 8.3 (decentralized) and Fig. 8.4 (centralized). In the decentralized system (Fig. 8.3), the individual BMS tasks are located in different devices. The charge control is part of the charger, the discharge control is part of the EV drive system, the battery state determination is carried out within a range meter, and so on. Some BMS tasks must be implemented in more than one device, especially in the case of safety management. Normally, there is little or no communication between the devices, so an optimized operation is not possible. Another disadvantage is that the battery-relevant control functions are located in different devices. Thus, each device must be adapted to the particular battery used. 

---