Augmenting defense-in-depth with the concepts of observability and diagnosability from Control Theory and Discrete Event Systems

Defense-in-depth is a fundamental principle/strategy for achieving system safety. First conceptualized within the nuclear industry, defense-in-depth is the basis for risk-informed decisions by the U.S. Nuclear Regulatory Commission, and is recognized under various names in other industries (e.g., layers of protection in the Chemical industry). Accidents typically result from the absence or breach of defenses or violation of safety constraints. Defense-in-depth is realized by a diversity of safety barriers and a network of redundancies. However, this same redundancy and the intrinsic nature of defense-in-depth - the multiple lines of defense or “protective layers” along a potential accident sequence - may enhance mechanisms concealing the occurrence of incidents, or that the system has transitioned to a hazardous state (accident pathogens) and that an accident is closer to being released. Consequently, the ability to safely operate the system may be hampered and the efficiency of defense-in-depth may be degraded or worse may backfire. Several accidents reports identified hidden failures or degraded observability of accidents pathogens as major contributing factors.In this work, we begin to address this potential theoretical deficiency in defense-in-depth by bringing concepts from Control Theory and Discrete Event Systems to bear on issues of system safety and accident prevention. We introduce the concepts of controllability, observability, and diagnosability, and frame the current understanding of system safety as a “control problem” handled by defense-in-depth and safety barriers (or safety constraints). Observability and diagnosability are information-theoretic concepts, and they provide important complements to the energy model of accident causation from which the defense-in-depth principle derives. We formulate a new safety-diagnosability principle for supporting accident prevention, and propose that defense-in-depth be augmented with this principle, without which defense-in-depth can degenerate into a defense-blind safety strategy. Finally, we provide a detailed discussion and illustrative modeling of the sequence of events that lead to the BP Texas City Refinery accident in 2005 and emphasize how a safety-diagnosable architecture of the refinery could have supported the prevention of this accident or mitigated its consequences. We hope the theoretical concepts here introduced and the safety-diagnosability principle become useful additions to the intellectual toolkit of risk analysts and safety professionals and stimulate further interaction/collaboration between the control and safety communities.     

Modeling animal-vehicle collisions considering animal-vehicle interactions

Animal–Vehicle Collisions (AVCs) have been a major safety problem in the United States over the past decades. Counter measures against AVCs are urgently needed for traffic safety and wildlife conservation. To better understand the AVCs, a variety of data analysis and statistical modeling techniques have been developed. However, these existing models seldom take human factors and animal attributes into account. This paper presents a new probability model which explicitly formulates the interactions between animals and drivers to better capture the relationship among drivers’ and animals’ attributes, roadway and environmental factors, and AVCs. Findings of this study show that speed limit, rural versus urban, and presence of white-tailed deer habitat have an increasing effect on AVC risk, whereas male animals, high truck percentage, and large number of lanes put a decreasing effect on AVC probability.     

Accident investigation reporting deficiencies related to organizational factors in machinery space fires and explosions

Careful accident investigation provides opportunities to review safety arrangements in socio-technical systems. There is consensus that human intervention is involved in the majority of accidents. Ever cautious of the consequences attributed to such a claim vis-à-vis the apportionment of blame, several authors have highlighted the importance of investigating organizational factors in this respect. Specific regulations to limit what were perceived as unsuitable organizational influences in shipping operations were adopted by the International Maritime Organization (IMO). Guidance is provided for the investigation of human and organizational factors involved in maritime accidents. This paper presents a review of 41 accident investigation reports related to machinery space fires and explosions. The objective was to find out if organizational factors are identified during maritime accident investigations. An adapted version of the Human Factor Analysis and Classification System (HFACS) with minor modifications related to machinery space features was used for this review. The results of the review show that organizational factors were not identified by maritime accident investigators to the extent expected had the IMO guidelines been observed. Instead, contributing factors at the lower end of organizational echelons are over-represented.     

Road factors and bicycle-motor vehicle crashes at unsignalized priority intersections

In this study, the safety of cyclists at unsignalized priority intersections within built-up areas is investigated. The study focuses on the link between the characteristics of priority intersection design and bicycle–motor vehicle (BMV) crashes. Across 540 intersections that are involved in the study, the police recorded 339 failure-to-yield crashes with cyclists in four years. These BMV crashes are classified into two types based on the movements of the involved motorists and cyclists:

• • 

  type I: through bicycle related collisions where the cyclist has right of way (i.e. bicycle on the priority road);

• • 

  type II: through motor vehicle related collisions where the motorist has right of way (i.e. motorist on the priority road).

The probability of each crash type was related to its relative flows and to independent variables using negative binomial regression. The results show that more type I crashes occur at intersections with two-way bicycle tracks, well marked, and reddish coloured bicycle crossings. Type I crashes are negatively related to the presence of raised bicycle crossings (e.g. on a speed hump) and other speed reducing measures. The accident probability is also decreased at intersections where the cycle track approaches are deflected between 2 and 5 m away from the main carriageway. No significant relationships are found between type II crashes and road factors such as the presence of a raised median.     

一起电梯溜车伤人事故的分析

结合一起电梯溜车伤人事故,对制动器检测开关和接触器等部件进行分析,并进一步探讨制动器控制电路的设计和制动器的维护保养,从而预防制动器故障和事故。     

基于Web GIS的瓦斯事故预警系统设计

 本文结合Web GIS技术、空间数据库技术和瓦斯事故预测理论,基于SuperMap IS.NET开发平台,采用ORACLE 10数据库系统和SuperMap SDX+空间数据库引擎,以C/S与B/S混合模式设计了一种煤矿瓦斯事故预警系统。对系统实现的技术路线、功能模块、空间数据库和关键技术分别进行了阐述。该系统的实现,是对瓦斯灾害防治技术有益的探索,对保障矿山安全生产和可持续发展具有重要意义。     

Accidental release of hydrogen from a cryogenic tank

Liquid hydrogen at 20 K was harmlessly released at Turin’s Porta Susa station over a period of seven hours on 9 July 1991 through the safety valve of a dewar-type tank on a railway wagon following the loss of the vacuum between its two walls. Commercially available programs were unable to model this type of release in the unusual conditions in which this hydrogen had been stored. A model illustrating the course of the accident was therefore worked out. A start was made by examining the changes in the physical and thermodynamic properties of the hydrogen progress in the dewar to find out how long it had taken to build up the pressure needed to open the safety valve.Owing to the complex geometry of the insulating layer in the interspace of the dewar on which the liquefaction of the air took place, the heat exchange coefficient could not be determined a priori. It was therefore assumed and subsequently quantified by means of an iterative process. The thermodynamic data were then used to examine the outflow of the hydrogen from the venting line. Flow dynamic calculations showed that the hydrogen was entirely lost through the safety valve and that pressure losses along the approx. 3-m line were negligible. The model also showed that the speed of the outflow was subsonic. The speed evaluated will enable the dispersion of the hydrogen and hence the areas at risk to be evaluated in the subsequent stages of the study.     

两次GIS事故后的分析和思考

最近在某电网公司接连发生了两次220kV GIS的设备事故。本文主要对这两次事故的原因和暴露的问题进行分析,提出相应防范对策,以及介绍一些后期整改的情况。     

压水堆核电厂蒸汽发生器传热管破裂事故处理的研究

本文叙述了在清华大学压水堆核电厂全尺寸模拟机上，应用应急操作规程，对蒸汽发生器传热管破裂事故（ＳＧＴＲ）进行了实验研究，总结了处理ＳＧＴＲ事故的体会，介绍了ＳＧＴＲ事故停堆后，操纵员最紧要的干预操作，以及如何干预，何时干预等问题。作者还对ＳＧＴＲ事故处理中，是否必须停反应堆冷却剂泵提出了自已的看法。     

谈加大安全投入的科学原理及运作

从事故损失规律、安全投入的效益产出规律等方面对安全投入的科学性、紧迫性和具体运作进行了探讨。