Tolerable fault limit

The monitoring system acts during specified operation of the plant beyond the range of operational setpoints but below the tolerable fault limit. It signals permissible faulty states of the plant. There are no safety arguments for not continuing plant operation however, increased attention is necessary (assigned to level 2 of Table 4.1). 

If a plant leaves its range of specified operation because one or several process variables have left their nominal range the PCE equipment intervenes at the limit between specified operation and tolerable fault conditions, unless there is a reason for plant shut-down. 

Fault accommodation This is a common approach to achieve fault tolerance. Fault accommodation is limited to internal controller changes. In this method there will be changes in controller parameters or structure to avoid fault consequences. However, the input—output (I/O) between controller and plant remains unchanged, that is, the loop is not completely restructured. 

We discussed in Section 21.1.1 the maximum tolerable currents through a human body and their duration. The potential difference in a ground conductor at any point where a human body may come into contact with it during the course of a ground fault should be such that the resultant current through the human body will remain within these tolerable limits. 

Design and implement a reliable and fault-tolerant basic process control system to ensure the design limitations of the primary containment system are not exceeded. 

However, for structuring to have some direct relevance to questions of operational dependability, and in particular fault tolerance, it must be what might be described as strong—strong structuring actually controls interactions within and between systems, and limits error propagation in both time and space, i.e., constitutes real not just perceived or imagined boundaries. 

Table 6 of lEC 61511-1 ANSI/ISA-84.00.01-2004 Part 1 flEC 61511-1 Modi defines the basic level of fault tolerance for sensors, final elements, and non-PE logic solvers having the required SIL claim limit in the first column. The requirements in Table 6 are based on the requirements in lEC 61508-2 for PE devices with a SFF between 60 and 90 %. The requirements are based on the assumption that the dominant failure mode is to the safe state or that dangerous failures are detected. 

The final element subsystem consists of one solenoid. Type A. It has a hardware fault tolerance of 0. The SFF is 76%. According to Figure 7-8. Type A Architecture Requirements lEC 61508, the subsystem qualifies for SIL 2. The overall design is qualified to SIL 1 since lowest subsystem is the limiting factor. 

Human error is defined as an act outside the tolerance bounds. These are determined by the technical boundary conditions and may therefore be influenced— within limits— by the designer in the sense that the tolerance region becomes large (fault-tolerant design). This reduces the probability of human error. 

Redundancy or Backup Systems, Monitors Isolation of Systems, Components and Elements Designed Failure Effect Limits Designed Failure Path Fault and Error Tolerance... 

Due to the dynamic behavior of reconfigurable fault-tolerant systems, the creation of stochastic dependability models is a difficult task. Traditional techniques like fault trees or rehabdity block diagrams are no longer sufficient in many cases, because they assume all components to be of a Boolean nature. However, in today s adaptable and reconfigurable systems, components must be described by more than the states active and failed in order to reflect the different roles of a component in a reconfigurable system. Moreover, often the system itself is not considered to be Boolean, but different failure classes are discriminated. Finally, the basic events (component failures and repairs) cannot be assumed to be independent, but common cause failure, failure propagation, limited repair capacities etc. must be taken into account. 

Our future works aims to extend the architecture research to the whole control system, limited here to the instrumentation. It consists in determining the number of control units and the instrumentation associated to each of them that satisfy the specified fault tolerance level. This problem can be solved thanks to the set of constraints imposed to the instrumentation that defines indirectly groups of sensors and actuators that can simultaneously fail due to the failure of the unit control to which they are connected. Another aim concerns the structural analysis that can be improved. It may consist in deterrnining automatically the needed... 

---