Fail-safe Systems Research Articles

Reliability measures for fail safe computer-based systems

Two types of fail-safe (FS) computer-based systems, i.e. FS-stop computer-based systems and FS-active computer-based systems are dicussed. Some important reliability measures for these computer-based systems are introduced.

An action-chain model for the design of hazard-control systems for robots

The authors establish a hazard-control design methodology based on a categorization of action changes and the dissociation of action chains. In this methodology, the damage process is modeled by propagation of actions among system elements, the actions are put into two groups (state-failure and function-failure), the concept of action-linkage dissociation is developed for damage prevention, application rules for information-processing systems are defined, and a systematic procedure to identify hazards and to conceptualize hazard-control systems is developed. It is postulated that dissociations involving paths or sources lead to fail-safe systems, while those involving substitution-of-function lead to fault-tolerant systems. Examples involving robot systems are given to demonstrate the new technology. >

VLSI implementation for control of critical systems

Self-checking integrated circuits, i.e. able to detect its own errors, are not adequate to control the actuators of critical systems used in railway transportation, space, chemical and nuclear industries. Only the conventional fail-safe circuits can apply these needs, unfortunately they cannot be implemented in integrated circuits technologies and thus they cannot be used to realise complex systems.This paper deals with a method to solve this problem. We present briefly the theory of generalized fail-safe systems which includes new, more general definitions, construction conditions and basic properties for fail-safe systems. Then, in order to take into account the problem of undetectable faults, we define strongly fail-safe circuits who achieve the totally fail-safe goal. As an application we propose a fail-safe integrated interface which transforms the outputs of self-checking systems into signal adequate to drive electromechanical actuators and such that the whole system, self checking processing part and interface, implemented in VLSI is strongly fail-safe. Therefore this system can be used for safe drive of complex critical processes.

MTBRD analysis of fail-safe systems

In this paper, on the basis of a general model, an important index of fail-safe (FS) systems—MTBRD (mean time between system recovery from a dangerous-side failed status and the next dangerous failure)—is to be defined, and the effect of changing Q—the kernel of the semi-Markov process which describes the status of an FS system—on MTBRD are evaluated. From these analytical results, three measures for weighing the effectiveness of an FS technique can be defined, by which the system designers are able to quantitatively analyze the effects of the adopted FS techniques on safe operation.

MTBRD evaluation of an actual fail-safe system

MTBRD is an important index for fail-safe (FS) systems. In this paper the effects on MTBRD of dangerous failure rates are discussed on the basis of an analysis performed in the literature. The obtained results may be useful to system designers for further improving the safety performance of an FS system.

Fehlertolerierende steuerung für werkzeugmaschinen

Weck, M. and Frentzen, B., 1986. Error-tolerating control for machine tools. Journal of Occupational Accidents, 8: 99–107. Stored program controls are being introduced, on an increasing scale, for applications that may be critical to safety in areas such as nuclear reactor monitoring, medical technology and traffic light management. In addition to the objective of preventing damage to persons or objects and minimizing shutdown periods and rejects, fail-safe systems are gaining increasing importance in the control and monitoring of manufacturing processes. Examples may be found in controls for robotics and presses as well as in systems monitoring security of personnel. A system for controlling the safety of presses is presented and test results to date reported. With the aid of three microcomputers operating independently and cross-checking themselves by matching routines implemented at software level, a majority-decision system has been devised. The reason for relying on three components was that this number was sufficient to trace the source of the error distorting the partial result without needing to take heavily into account the failure rate, which increases as a function of the number of elements and tends to produce a negative influence upon overall system reliability. Software for the interlinked microcomputers consists of program modules for ensuring control functions, synchronization and data exchange between the computers as well as for matching computational results. Using the data exchanged the units cross-check them-selves and, in the event of error, will exclude the erroneous computer from the majority decision-process and generate an error report. This essential ingredient of automatic error recognition in the system concept was extended to include the capability of replacing defective computer modules without affecting overall system availability. Integration and synchronization of a repaired or replacement module into the majority process is automatic. In addition to detailing the software concept and data exchange within the system, significant characteristics of the hardware in use are presented. This hardware includes the computer components and specialized test and display items, e.g. status indicators of the computer systems. Experience and test results available to date on the system's behaviour under simulated error and failure conditions are reported. This review is confined to the processing of information in the component systems. The purpose of present and future research work is the development of speciaslized hardware for linking this type control to manufacturing processes.

A fail-safe microprocessor-based protection system utilising low-level multiplexed sensor signals

The safety of commercial nuclear power plants is of importance to designers, builders and operators of such large and complex plants. The emphasis on safety has led to the requirement for highly reliable fail-safe systems for their control and protection. The authors describe one such system, the individual sub-assembly temperature monitoring system (ISAT) which is being developed for the commercial demonstration fast reactor (CDFR). The system incorporates recent advances in solid-state electronics and in particular microprocessors to implement time-shared data acquisition techniques to obtain and process data from around 1400 fast response thermocouples whilst meeting the required levels for reliability and availability.

The Penlon Bromsgrove high frequency jet ventilator for adult and paediatric use. A solution to the problem of humidification.

The Penlon Bromsgrove is a new high frequency jet ventilator, suitable for use in both adults and children. The jet stream is humidified by means of an integral in-line Bernoulli nebuliser. The self-recharging nebuliser can also convey drugs directly to the airways in the form of an aerosol. Alarms and fail-safe systems are incorporated. A pressure gauge continuously displays the jet drive pressure. There are two digital LED displays; one shows jet frequency in breaths per minute; the other, the jet drive pressure, minimum, maximum and mean patient airway pressures. Two fail-safe systems ensure that these pressures do not become excessive. Both audible and visual alarms are provided. The prototype has proved to be quiet and completely reliable over more than 4000 hours use, with no bronchoscopic or histological evidence of ineffective humidification.

Failure to safety in process-control systems

There are those who wish fail-safe systems on us everywhere. This is not always in the real interests of safety, and stultifies development in that field. In fact, such ideas may in practice be logically, ethically and legally wrong.

The Fail-Safe Feature of the Lapp & Powers Fault Tree

In response to the Editor's suggestion, 3 states of the Lapp & Powers fault-tree model are distinguished, `good', `failed safe' and `failed unsafe'. Both the logical and the probability functions are given separately for both failed safe and good events as well as the probability calculations. A simplified 2-component example is also discussed to illustrate the relationship between XOR gates in fault trees and fail-safe systems and subsystems.

Overview of Hardware-related Safety Problems of Computer Control Systems

The main hardware failure types of computer systems are classified. The risks and the difficulties in the safety demonstration of different fail-safe computer systems are compared. Such computer systems are: Multi-computer with hard- or software comparator, with equal and diverse processing; single computer with checking program or with diverse multi-processing. The problems of computers with fail-safe circuits or with processing in coded form are discussed. A structure of the safety demonstration is recommended. In order to achieve a low probability of multiple failures a fast failure detection is necessary. In practise it is not possible to analyse the internal failures of a microprocessor in detail. An operational method of failure detection using a second processor and a function test program is outlined. Advantages and disadvantages of hardware diversity are discussed.

Synthesis of Fault Trees: An Example of Noncoherence

The Lapp & Powers (L&P) fault-tree model of a nitric acid cooling process is explored to a greater level of depth than in the previous round-robin correspondence on the controversy over exclusive-or (XOR) gate G7 in the L&P fault tree. In this paper, the minimalized logic equations for success or failure of G7 are derived, and the subsystem reliability function is calculated. The subsystem reliability vs component reliability function is U-shaped; this is not an abnormality, but a result of the XOR failure logic. The overall system reliability vs component reliability function, however, is J-shaped. Some further comments are made on the relevance of this problem to the study of s-noncoherent and fail-safe systems.

Unified Design of Self-Checking and Fail-Safe Combinational Circuits and Sequential Machines

This correspondence deals with a unification and extension of some previous work on self-checking (SC) and fail-safe (FS) systems.

Designing fail-safe microprocessor systems : Dan R. Ballard. Electronics p. 139 (4 January 1979)

Designing fail-safe microprocessor systems : Dan R. Ballard. Electronics p. 139 (4 January 1979)

Overview of Buried Pipelines Under Seismic Loading

Damage and response behavior of buried lifelines, such as submerged tunnels and gas, water, and sewer distribution lines, subjected to earthquakes are reviewed. Current design practice, analysis procedures, code provisions, and the latest published research are considered. Damage surveys indicate that pipelines with flexible joints (rubber gasket), buried in uniform firm soil experience less damage during earthquakes. The seismic response behavior is governed by the displacements of the ground. Ductility to allow pipeline movement is the most important factor in designing such systems. Various passive design practices, such as carefully selecting site locations, ductile pipeline materials, and providing fail-safe systems are presently being used to mitigate the effects of earthquakes. There are no code provisions in the United States to design buried lifelines for seismic loads. Engineers and researchers are working toward developing seismic design codes for buried pipelines.

Computers replacing safety relays in railway signalling: Analysis of different methods, description of and experience from two applications. LME first Interlocking and ATC system containing computers.

During 40 years safety relays have been the predominant technology in practical use for railway signalling systems with fail-safe demands. During the last two - three years computers have been introduced for vital functions. To fulfil fail-safe requirements different methods have been used to overcome the non-asymmetric fail-function of electronic components and systems. This paper will cover some different methods and evaluate them. As a result an approach to achieve a fail-safe computer system will be suggested. In a computer system for vital functions the information is processed twice by two independently designed and executed program versions in the same computer resulting in a safe and economic solution. The first LME computerbased interlocking plant is now being delivered and the experience of the development work is covered. Modern Automatic Train Control (ATC-) system is now equipped with microcomputers. Experience from development and field tests of an intermittent ATC-system is summarized. The two projects make it evident that general, standard computers can be used for fail-safe systems, if careful adaption of fail-safe design philosophy is maintained.

A new humidifier.

A new heated water-bath humidifier operates on a new basic principle which overcomes the practical disadvantages of existing systems. A heated hose is used to control a temperature drop along the whole length of the delivery line instead of raising the temperature of the gases in the delivery line as in previous systems. Therefore the tank does not have to fully saturate the gases and a simple, totally cleanable design is possible. A temperature sensor at the delivery point controls the hose heater, constituting a rapid response, low thermal inertia system and delivery temperature is displayed on the unit. Compensation for varying gas flows and ambient temperature changes is inherent and the unit is suitable for neonatal/paediatric and adult use without special adjustment. The tank has a separate reservoir chamber which feeds an evaporation chamber via a cleanable float valve, conferring many advantages including clearly visible water levels, easy filling without breaking the circuit and constant compression volume. Full fail-safe alarm systems are incorporated.

A review of the U.S. Environmental Protection Agency's Research Program on the prevention and control of hazardous material spills

This paper is a status report on a number of the projects in progress at the Industrial Waste Treatment Research Laboratory of the U.S. Environmental Protection Agency at Edison, New Jersey. The actual causes of numerous hazardous material spills have been documented and analyzed to assign priority to operational areas in which spill prevention and control procedures are urgently needed. Spill alert systems are ready for installation on marginally safe earthen holding pond dikes. Fail-safe systems are being evaluated to reduce spillage from overfilling and from transfer line rupture. The handling of spills in municipalities has been addressed with particular attention to the maintenance and utilization of secondary sewage treatment facilities during spill events. Among the physical and chemical treatment systems that have been or are being produced are trailer-mounted units for processing contaminated water. Also, special devices are being designed for the dispersion and recovery — where necessary — of adsorbents and counteractive chemical reagents for in situ treatment of polluted water bodies. Plastic foams have been developed to dike or confine spills and to plug leaks in ruptured containers. A pickup truck-mounted collection unit, consisting of a battery-powered pump and a self-deploying plastic storage bag, has been constructed and tested. Nearing final testing is a “Sea Curtain”, which extends from the bottom of a stream to the air above. The “Curtain” can be used to isolate a water column that is being contaminated by a soluble, sinking, or floating hazardous material discharged from shore or in stream. Gelling and solidification agents have been shown to be effective in immobilizing spilled hazardous materials. Systems are being built to reprocess treatment agents for reuse and to detoxify whatever agents or recovered materials cannot be salvaged. Field-use packets and other easy-to-deploy items are being developed to trace spills in water and to assess the effectiveness of cleanup. Procedures for enhanced, in-place, biological degradation of spilled hazardous materials are under test. The thrust of the Laboratory's program in these and in related projects is toward the demonstration of practical procedures, hardware, and suitably engineered systems for the prevention and control of spills of hazardous materials.

Dyadic approximation method for multivariable control-systems analysis with a nuclear-reactor application

A method is developed for the approximation of an N×N plant transfer-function matrix by a transfer-function matrix consisting of the linear sum of N frequency-independent dyads with scalar transfer-function coefficients. The use of the approximation method in the design of failsafe feedback-control systems for the plant is described, and an application is suggested in the stabilisation of the radial spatial modes of a thermal nuclear power reactor.

N-Fail-Safe Logical Systems

The analysis and synthesis of the fail-safe logical systems have been studied by many authors. They utilize logical elements with asymmetric failure. It is shown that by duplicating two identical systems in parallel it is possible to raise the reliability of the system considerably. If, for example, 0 is the safe value, the duplicate output (0, 1) or (1, 0) is regarded as 1. The output (0, 0) is regarded as 0, which cannot, however, be judged to be correct or to be incorrect.