Subtle Failures

We found resolvers convenient not only for mastering the ordering of advices, but also for instrumentation purposes. As undesirable interferences may induce subtle failures, we would like to reveal them by means of assertions. Based on the resolvers scheduling the conflicting advices of our micro-aspects, we can add instrumentation advices to the schedule and precisely control their placement in the execution chain. 

Overall Principle. First, the designer must declare whether data- or control-flow interactions between a set of aspects are expected or not. Then, the resolution implies defining the correct order of the application of multiple advices at a shared join point. Interferences may induce subtle failures, we propose to reveal them by means of assertions. To keep separation of concerns, the assertions should be implemented with dedicated aspects that monitor the execution of other aspects. The resolver construct is used to this aim. 

Multiple failures may be either independent or dependent. Two events are said to be independent if the occurrence of one does not effect the likelihood of the other, otherwise the events are said to be dependent. Most important severe accidents are expected to include events that are at least partially dependent, due to common underlying causes of failure or interactions among systems. Depeiident failures defeat the redundancy or diversity of plant systems that provide key functions such as coolant injection. The term system interaction is used to describe dependent failures that involve or affect more than one plant system. Examples of actual accidents that illustrate various types and modes of failure are presented in Section 2.3 and Appendices 2A and 2B. Dependent failures can be divided into three categories explicitly dependent events, conunon cause failures, and subtle failures. The distinctions between these categories are based on the manner in which the impact of the dependent events are (or are not) treated in risk assessments (Section 2.6). The following subsections describe these three categories of dependent failures in more detail. 

Subtle failures are certain types of dependent failures that involve complex features that do not allow the failures to be easily categorized. These types of interactions are sometimes buried in the depths of the design and operation of the system and can be difficult to uncover. Subtle failures are best explained by example. Six examples follow. 

The analysis of the incidents shows that the majority were not caused by some subtle failure mode of the control system, but by defects which could have been anticipated if a systematic risk-based approach had been used throughout the life of the system. It is also clear that despite differences in the underlying technology of control systems, the scfety principles needed to prevent failure remain the same. ... 

Dirt is one of the biggest culprits in the demise of bearings. Dirt makes its appearance in bearings in many subtle ways and it can be introduced by bad work habits. It also can be introduced through lubricants that have been exposed to dirt, which is responsible for approximately half of bearing failures throughout the industry. 

At the doses used, there is blockage of the effects of as much as 25 mg of injected heroin. Toxicity in heroin addicts is low, but some reported subtle adverse effects of naltrexone such as decreased energy (Hollister et al. 1981). Nonaddicted obese subjects have been known to develop markedly elevated transaminase levels at doses of 300 mg/day (Mitchell et al. 1987). The inference has been drawn that high doses are potentially hepatotoxic (Pfohl et al. 1986), and the drug is contraindicated in liver failure or acute hepatitis. 

In the practical world, results not only need to be reproducible but also transferable. This requirement helps assure that differences in apparatus for the purpose of automation do not interfere with the method and demands a validation to demonstrate equivalency. Designs which diverge from the strict USP and industry convention run the risk of developing a system that cannot be validated at the specific method level. The authors have personally observed cases where extremely subtle changes in apparatus resulted in a failure to demonstrate suitability. 

However, failure to disprove the null hypothesis does not mean we can reject the alternative hypothesis and accept the null hypothesis. This is a subtle but extremely important point in hypothesis testing, especially when hypothesis testing is used to identify factors in research and development projects (see Section 1.2 and Table 1.1). 

There are broadly two uses of chemometrics that interest the process chemist. The first of these is simply data display. It is a truism that the human eye is the best analytical tool, and by displaying multivariate data in a way that can be easily assimilated by eye a number of diagnostic assessments can be made of the state of health of a process, or of reasons for its failure [ 153], a process known as MSPC [154—156]. The key concept in MSPC is the acknowledgement that variability in process quality can arise not just by variation in single process parameters such as temperature, but by subtle combinations of process parameters. This source of product variability would be missed by simple control charts for the individual process parameters. This is also the concept behind the use of experimental design during process development in order to identify such variability in the minimum number of experiments. 

Processes 4, 5 and 6 are all essentially one step oxidations of SO2 to SO3 and hence sulphuric acid. The first pair are modified versions of the traditional Contact and Chamber processes for sulphuric acid manufacture, with the principal change being in their ability to accept dilute SO2 gas streams as the feedstock. The use of Activated Carbon as an air oxidation catalyst has clearly received international attention, with success or failure depending to a large extent on subtle modifications in catalyst preparation and catalyst presentation to the reactant gases. Virtually every type of catalyst bed configuration has been explored. 

There is already one excellent example of our failure to make such a predictive leap—the Antarctic ozone hole. The reason for the failure to anticipate the rapid loss of ozone in the lower stratosphere was a failure to appreciate the potential role of the subtle photochemistry, in particular, the heterogeneous chemistry. Nor did researchers have a full appreciation for the consequences of the air parcels inside the polar vortices being relatively isolated from midlatitude air. Some of these same issues are important in the Arctic region in wintertime, but researchers lack the predictive capability to determine how ozone will ultimately be affected. 

In conclusion, historically it appears that there have been several AHR-mediated effects in seabirds in the Great Lakes, which probably contributed to reproductive failure and an increased incidence of live-abnormalities (in cormorants), but most of these were due to the effect of AHR PCB congeners, primarily PCB 126. The exceptions may be Lake Ontario and Saginaw Bay, where 2378-TeCDD concentrations and all PCDD/F concentrations, respectively, were very high in the 1970s. Contemporary AHR-mediated effects in Great Lakes seabirds are more likely to be subtle, such as effects on immune system function and fatty acid synthesis, rather than population-level effects such as reduction in reproductive success. Hoffman et al. [116] reviewed PCB and PCDD/F toxicity in birds. 

Note that with highly complex networked systems (i) there are likely to be uncertainties and arguments about system boundaries, (ii) the very complexity of the system (and its specification, if it has one) can be a major problem, (iii) judgments as to possible causes or consequences of failure can be subtle and disputable and (iv) any provisions for preventing faults from causing failures are themselves almost certainly fallible. 

TCDD may result in subtle alterations rather than primary gonadal failure. 

The interpretation of the behaviour of PBT is more subtle. Overall mass changes upon total PBT oxidation / reduction are similar to the counter ion ("dopant") molar mass, for example FAM/Q = 93 g mol"1 in 0.01-0.1 mol dm 3 Et4N+BF47CH3CN compared to mgp — = 87 g mol"1. These results apparently imply permselectivity with little or fto solvent transfer at low electrolyte concentration, and permselectivity failure at high electrolyte concentration. As we show in the next section, this apparent permselectivity is entirely fortuitous, and results from a compensating combination of mobile species transfers. The message here is that a combination of thermodynamic and kinetic data is required to unequivocally attribute the mass change to the relevant species transfers. 

---