System dependent failures

Explosibility and Fire Control. As in the case of many other reactive chemicals, the fire and explosion hazards of ethylene oxide are system-dependent. Each system should be evaluated for its particular hazards including start-up, shut-down, and failure modes. Storage of more than a threshold quantity of 5000 lb (- 2300 kg) of the material makes ethylene oxide subject to the provisions of OSHA 29 CER 1910 for "Highly Hazardous Chemicals." Table 15 summarizes relevant fire and explosion data for ethylene oxide, which are at standard temperature and pressure (STP) conditions except where otherwise noted. 

T Urethanes not shown because of great differences in physical properties, depending on formulations. Adhesion characteristics should he related by actual test data. Any system which shows concrete failure when tested for surfacing adhesion should he rated excellent with decreasing rating for systems showing failure in cohesion or adhesion below concrete failure. 

A distinction must be made regarding the length of service of the pressure reducing systems. Fatigue failure of any mechanical system depends on time, i.e., the number of cycles to failure. Therefore, the treatment required for a continuous service may not be justified for a short term service. A System in short term service is defined as one which operates a total of 12 hours or less during the life of the plant. Pressure relief valves typically meet this limit. Systems in short term service exceeding the screening criteria indicated above should be evaluated. 

FMEA examines each potential failure mode of a process to determine effects of failure on the system. A failure mode is anything that fails hardware. It may be a loss of function, unwanted function, out-of-tolerance condition, or a failure such as a leak. The significance of a failure mode depends on how the system responses to the failure. 

This FMEA/FMECA shows failure rates that are both demand and time dependent. Adding the demand failure rates gives a train failure rate of 5. 1 E-3/demand. The sum of the time dependent failure rates is 3Ei-10/hr. A standby system such as this, does not exhibit its operability until it is actuated for which the probability is needed that the train has failed since the last use Val " are considered to be part o ng envelope and... 

It is unclear whether previously published fire risk analyses have adequately ircaicd dependent failures and systems interaetions. Examples of either experienced or postulated system interactions that have been missed include unrelated systems that share common locations and the attendant spatially related physical interactions arising from fire. Incomplete enumeration of causes of failure and cavalier assumptions of independence can lead to underestimation of accident l rci uencies by many orders of magnitude,... 

As technology progresses the safety of man-machine systems depends more and more on the quality of the human component (operator). This fact is very obvious in transportation, where the operator (driver) is formally and actually in control of his or her vehicle. In aviation, however, a strong trend towards software control of the aeroplane is already becoming dominant, forcing the operator (pilot) primarily into the role of supervisor or monitor of the automatic control system and into that of trouble-shooter in case of (technical) failure. In this respect a cockpit crew is facing the same situation as for instance a shift of operators in the central control room of a completely computerised chemical process plant. 

Sorption of Cu(tfac)2 on a column depends on the amount of the compound injected, the content of the liquid phase in the bed, the nature of the support and temperature. Substantial sorption of Cu(tfac)2 by glass tubing and glass-wool plugs was observed. It was also shown that sorption of the copper chelate by the bed is partialy reversible . The retention data for Cr(dik)3, Co(dik)3 and Al(dik)3 complexes were measured at various temperatures and various flow rates. The results enable one to select conditions for the GC separation of Cr, Al and Co S-diketonates. Retention of tfac and hfac of various metals on various supports were also studied and were widely used for the determination of the metals. Both adsorption and partition coefficients were found to be functions of the average thickness of the film of the stationary phase . Specific retention volumes, adsorption isotherms, molar heats and entropy of solution were determined from the GC data . The retention of metal chelates on various stationary phases is mainly due to adsorption at the gas-liquid interface. However, the classical equation which describes the retention when mixed mechanisms occur is inappropriate to represent the behavior of such systems. This failure occurs because both adsorption and partition coefficients are functions of the average thickness of the film of the stationary phase. It was pointed out that the main problem is lack of stability under GC conditions. Dissociation of the chelates results in a smaller peak and a build-up of reactive metal ions. An improvement of the method could be achieved by addition of tfaH to the carrier gas of the GC equipped with aTCD" orFID" . ... 

An analysis of a system s failure modes may determine that some could trigger a hazard - these failure modes are safety-related and are likely to represent causes. In contrast those which would not typically lead to harm will be not safety-related . Depending on the relative degree of risk it may be necessary to justify the reason for a failure mode not being safety-related. 

In addition, there does not seem to be any reason for assuming that initiating failures are mutually exclusive and that only one starts the accident, except perhaps again to simplify the mathematics. In accidents, seemingly independent failures may have a common systemic cause (often not a failure) that results in coincident failures. For example, the same pressures to use inferior materials in the foundation may result in their use in the jacket and the deck, leading to a wave causing coincident, dependent failures in all three. Alternatively, the design of the foundation—a systemic factor rather than a failure event—may lead to pressures on the jacket and... 

The satisfactory operation of such a system depends on there being no failure of boil-up so... 

A substance is supplied to a system, for example by a pump or a compressor. The mass flow rate then depends on the capacity of the pump, respectively the compressor. If its stagnation pressure lies above the failure pressure of the system, its failure must be assumed. The mass flow rate to be relieved corresponds to the flow rate which results from the pressure difference after opening the relief device according to the characteristic of the pump or compressor. 

The functioning or failure of a technical system depends on the values of the chemical and physical parameters such as temperatures, pressures and concentrations of the process which takes place in it. Hence, the fault tree model is a simplification. Yet this simplification has the advantage that the connections between the individual components and the system and the impact of their failures on the process as a whole can be represented. 

If components are not repaired, unavailability and failure probability are identical. If there is repair, this is no longer true. A high availability is not identical with a high survival probability. For example, a fictitious cable car whose cables break several times a day has a small survival probability. However, if it were possible to repair the cable within a short period of time, its availability would be high. Thus, which of the two parameters is appropriate for characterizing a system depends on the circumstances. 

So far it has been assumed that the primary events of a fault tree are independent of one another. However, this is not always true. Failures of components from the same production may occur due to a manufacturing flaw which affects all of them. A corrosive atmosphere may shorten the lifetimes of all components exposed to it. Errors in testing and maintenance may occur, for example an erroneous calibration of several redundant measuring devices. These examples belong to a class of failures called dependent failures . They are discussed in detail in [48]. Dependent failures are failures which occur simultaneously or within a short interval of time so that several components are not available simultaneously. This type of failures is especially grave if it affects redundant sub-systems or systems. An overview of the different types of failures is provided by Fig. 9.33. 

As mentioned before, a redundancy implies that more than one component or sub-system is implemented for the same task. A redundancy may also concern actions of the operators, if, for example, the action of one operator is checked by another one. A redundancy reduces the probability of independent failures as well as that of certain dependent failures. The occurrence of dependent failures does not necessarily imply simultaneity. It may rather be the simultaneous unavailability of several components. This may also occur if the components failed one after... 

Quick detection of failmes increases the availability of systems. That is why so-called self-announcing components are used. They signal their own failme and enable one to detect dependent failures as well. 

Quality assurance covering planning, manufacturing and commissioning of components and systems reduces the probability of dependent failures. 

The situation is different when simulating the dynamics of the uptake of the carbon and energy source. Here, there is a high risk of failure if the dynamic behavior is predicted with Monod kinetics verified at different snapshot steady states in continuous or fed batch cultures. Application of these kinetics is questionable, because the steady state data of substrate uptake at different dilution rates may be corrupted by induction of different transporter systems depending on the steady state substrate concentrations. In addition to the variability of the affinity of the various transporter systems as clearly demonstrated for the yeast Saccharomyces cerevisiae, we do expect pronounced differences between permeases and phospho-transferase systems because of the clear distinctions in the influence of intracellular metabolites upon the uptake dynamics. 

Probabilistic modeling of safety-related systems is performed using koon subsystems architectures including dependent failures modeling for j8-factor parameter obtained from a knowledge-based system. 

---