Difference between revisions of "Fail-safe"

From Marspedia
Jump to: navigation, search
(8 intermediate revisions by 6 users not shown)
Line 1: Line 1:
 
Due to the hostile [[environmental conditions]] on [[Mars]], human visitors to the planet would have to rely heavily on artificial environments in order to survive.  Their [[habitat]]s' [[life support]] equipment must therefore run 100% reliably. This article describes the principles of '''fail-safe''' engineering.
 
Due to the hostile [[environmental conditions]] on [[Mars]], human visitors to the planet would have to rely heavily on artificial environments in order to survive.  Their [[habitat]]s' [[life support]] equipment must therefore run 100% reliably. This article describes the principles of '''fail-safe''' engineering.
  
The basic premise of fail-safe behaviour is to ensure that if a system or subsystem fails, it should do so in a "safe" manner; that is, no single failure should be able to place those who use or maintain it in danger.
+
The basic premise of fail-safe behavior is to ensure that if a system or subsystem fails, it should do so in a "safe" manner; that is, no single failure should be able to place those who use or maintain it in danger. Even if parts of the system fail, the system as a whole must continue working. A full breakdown of a vital system would be catastrophic for the colony and can mean a complete [[failure of the colony]]. In this case all settlers would die.  Fail-safe design must avoid [[w:Single_point_of_failure|single points of failure]].
  
The following systems are considered:
+
==Systems to be considered==
* Life support systems ([[oxygen]], [[temperature]])
 
* Production and [[food preservation|storage]] of [[food]]
 
* Production, distribution and storage of [[energy]]
 
* Telecommunication network
 
* [[building]]s
 
  
 +
*Life support systems ([[oxygen]], [[temperature]])
 +
*Production and [[food preservation|storage]] of [[food]]
 +
*Production, distribution and storage of [[energy]]
 +
*Telecommunication network
 +
*[[building]]s structure
  
 
==Redundancy==  
 
==Redundancy==  
Every system is built twice or more, where each can work independent from the other. The capacity of each system is big enough to support the full service in case of failure of one system. In normal operation both systems are running in parallel with half load. This principle provides the best reliability for the whole function.
+
Every system is built twice or more, where each can work independent from the other. The capacity of each system is high enough to support the full service in case of failure of one system.
  
<strong>Example:</strong> The number and size of [[solar panel]]s is at least twice as big as actually needed for vital system operation. In normal operation mode the surplus energy can be used for additional convenience.  
+
In another example the number and size of [[solar panel]]s could be at least twice as large as actually needed for vital system operation. In normal operation mode the surplus energy generated could be used for additional production with energy storage systems.  
  
, it's looking that way) it must be shot in 3D with the new tlhncoeogy, not converted in post with some cheesy attempt to make extra money.-Personally I feel if it's done right 3D could add a since of realism and immersion that is sorely missing in so many movies. Remember the way we felt when we first stepped into the worlds created by Cyan? It was as if you were there. That's our biggest goal with the Myst Movie, to put you there, let you live in Anna's shoes, and feel the excitement you felt playing the games. If Myst is done in 3D, we will do everything within our power to use it as a tool to enhance your experience, not undermine it.-Of course if you want you, can buy the cheaper tickets and just see it in 2D. But keep this in mind  if you buy the 3D tickets you will be helping to insure a sequel   not to mention helping to support your dear friends here at Mysteria Film Group
+
Redundancy requirements can be reduced using modular systems.  For example, rather than doubling the number of solar panels, we can design the system so that redundancy is at the component level. In an extreme case, where each solar panel has redundant connections, a single extra solar panel would provide the required redundancy.   
  
salam afshindaneshjoye doryocate ertebatat hastam dar francemikhastam chand soal azatoon beporsam raje be podcasti ke sakhtidkheili mamnoon misham ke az tarighe mail betoonim ba ham dar ertebat bashimarezooye movafaghiate bishtarmehrdad
+
If losing solar power is a possibility, for example during a dust storm, the redundancy at a system level would require a separate power source, such as nuclear reactors, or stored power in various forms. 
 +
 
 +
==Interconnectivity==
 +
Services must also be available in the case of local failure. Therefore, the service providing systems should be interconnected.
 +
 
 +
<strong>Example:</strong> If system A and system B have their own air supply system, then people in building A can get air from building B in case of a failure in the air supply system of their own building.
 +
 
 +
==Grid instead of chain==
 +
The whole system must be available independent from the failure location, even in catastrophic situations. The interconnection must allow normal functioning of the whole system even if one system part is completely destroyed. For the connection of more than two systems a grid is better than a chain.
 +
 
 +
[[Image:mesh.gif]]
 +
 
 +
The chain architecture (bad) bears the risk of a complete cut-off for system parts. The grid architecture (good) ensures a continuous interconnection of the remaining systems.
 +
 
 +
This applies for [[building]]s, as well. In the case of chain architecture, a drop in air pressure in building Y separates the people in X and Z.
 +
 
 +
<strong>Example:</strong> The [[Internet]] is (partially) constructed in a grid architecture. Despite the fact that it is the most complex artificial thing men have ever constructed it has never failed as a whole.
 +
 
 +
==Standby systems (back-up)==
 +
A standby system is automatically powered up, or can be manually brought into operation shortly. Advantage: The system is not subject to full maintenance effort during standby mode. Risk: If not checked in regular intervals the backup system may not be able to work if needed.
 +
 
 +
A typical application is diesel generators in standby mode, that are activated if grid power fails.  However, the switch between the generator set and the grid may be the failing component  Therefore a second diesel generator, with a second switch, may be added for full redundancy. 
 +
 
 +
[[category:Health and Safety]]

Revision as of 11:26, 25 September 2020

Due to the hostile environmental conditions on Mars, human visitors to the planet would have to rely heavily on artificial environments in order to survive. Their habitats' life support equipment must therefore run 100% reliably. This article describes the principles of fail-safe engineering.

The basic premise of fail-safe behavior is to ensure that if a system or subsystem fails, it should do so in a "safe" manner; that is, no single failure should be able to place those who use or maintain it in danger. Even if parts of the system fail, the system as a whole must continue working. A full breakdown of a vital system would be catastrophic for the colony and can mean a complete failure of the colony. In this case all settlers would die. Fail-safe design must avoid single points of failure.

Systems to be considered

Redundancy

Every system is built twice or more, where each can work independent from the other. The capacity of each system is high enough to support the full service in case of failure of one system.

In another example the number and size of solar panels could be at least twice as large as actually needed for vital system operation. In normal operation mode the surplus energy generated could be used for additional production with energy storage systems.

Redundancy requirements can be reduced using modular systems. For example, rather than doubling the number of solar panels, we can design the system so that redundancy is at the component level. In an extreme case, where each solar panel has redundant connections, a single extra solar panel would provide the required redundancy.

If losing solar power is a possibility, for example during a dust storm, the redundancy at a system level would require a separate power source, such as nuclear reactors, or stored power in various forms.

Interconnectivity

Services must also be available in the case of local failure. Therefore, the service providing systems should be interconnected.

Example: If system A and system B have their own air supply system, then people in building A can get air from building B in case of a failure in the air supply system of their own building.

Grid instead of chain

The whole system must be available independent from the failure location, even in catastrophic situations. The interconnection must allow normal functioning of the whole system even if one system part is completely destroyed. For the connection of more than two systems a grid is better than a chain.

Mesh.gif

The chain architecture (bad) bears the risk of a complete cut-off for system parts. The grid architecture (good) ensures a continuous interconnection of the remaining systems.

This applies for buildings, as well. In the case of chain architecture, a drop in air pressure in building Y separates the people in X and Z.

Example: The Internet is (partially) constructed in a grid architecture. Despite the fact that it is the most complex artificial thing men have ever constructed it has never failed as a whole.

Standby systems (back-up)

A standby system is automatically powered up, or can be manually brought into operation shortly. Advantage: The system is not subject to full maintenance effort during standby mode. Risk: If not checked in regular intervals the backup system may not be able to work if needed.

A typical application is diesel generators in standby mode, that are activated if grid power fails. However, the switch between the generator set and the grid may be the failing component Therefore a second diesel generator, with a second switch, may be added for full redundancy.