Failure Modes

A failure mode is a specific way a system can stop performing its function, together with its cause, its consequence and the time available to respond. Analysing failure modes means enumerating them deliberately rather than discovering them, and deciding for each whether to prevent it, detect it, or tolerate it.

• The standing biomass concentrates the entire value of a production cycle in a system that depends on continuous operation.
• Failures are coupled: one failure changes the conditions under which the next is more likely, so events cascade.
• A failure that is not detected is functionally the same as one with no protection at all.
• Redundancy misplaced is money spent without reducing risk, and a shared dependency can make two devices fail as one.
• Insurance and financing decisions both rest on how the failure risk has actually been addressed.

• Enumerate failure modes deliberately at design, with the cause, the consequence, the time to consequence, the means of detection and the protection for each.
• Look for shared dependencies. Two pumps on one board, or a sensor and its alarm on one power supply, are one failure and not two.
• Detection must be independent of the thing it monitors, or a single failure removes both the function and the knowledge of its loss.
• Allocate redundancy by time to consequence and by the value at risk, not evenly across the plant.
• Prefer failures that are obvious over failures that are quiet, and design instruments and actuators so that loss is announced.
• Divide the plant where it is affordable to do so, since independent loops confine a failure to part of the biomass.
• Assume that any single protection can fail, and ask what covers the fish if it does.

• Provide emergency oxygen that is independent of mains power and of the normal delivery path.
• Power monitoring and alarms separately from the plant they monitor.
• Provide standby capacity on the fast-acting duties, with automatic changeover and an alarm on operation.
• Consider several independent loops rather than one large one, weighing the capital against the biomass exposed to any single event.
• Design overflow and drain routing so that a blockage or a level failure does not empty a tank.
• Provide redundant measurement on the critical parameters so a plausible sensor failure is detectable.
• Hold spares for the components whose failure acts fastest, since procurement time is part of the consequence.
• Write the emergency procedures at design, when the failure analysis is fresh.

• Test protective systems functionally on a schedule: standby power on load, changeover, alarms including the out-of-hours path, and emergency oxygen.
• Exercise standby equipment rather than leaving it idle.
• Review near misses as seriously as incidents, since a near miss is a cascade that stopped early by chance.
• Keep the emergency procedures current and practised with the people who would actually be on site.
• Maintain the spares holding against the failure analysis, not against what happens to be cheap.
• Reassess the failure analysis after any modification to the plant.

• Test standby generation on load and record the changeover time.
• Test emergency oxygen delivery under a simulated loss of the normal supply.
• Test the full alarm path including out-of-hours notification and escalation.
• Exercise standby pumps and automatic changeover.
• Audit spares against the failure analysis and against supplier lead times.
• Review and rehearse the emergency procedures, and update them after any plant change.

• Providing redundancy without independence, so both units share a supply, a controller or a network.
• Powering the alarm from the system it monitors.
• Owning standby equipment that has never been tested under load.
• Allocating redundancy by equipment cost rather than by time to consequence.
• Trusting a single sensor on a parameter that acts fast.
• Treating near misses as non-events and losing the warning they contained.
• Holding spares by price rather than against the failures that cannot wait for delivery.
• Writing emergency procedures that have never been rehearsed by the people who would use them.

Structured failure analysis, carried out systematically at design, converts an intuition about risk into a list that can be argued with. Enumerating each function, the ways it can fail, the consequence, the time available and the existing detection makes gaps visible — most usefully the failures that are currently undetectable, which are the ones that turn into cascades.

Dividing the plant into independent loops is the most effective structural protection available, because it converts a total loss into a partial one. It costs capital, duplicated equipment and floor area, and it complicates operation. Whether it is justified is a calculation against the value of the biomass a single loop would hold and the probability of an event that affects a whole loop, and it is a decision that cannot be revisited after construction.

Failures are certain; total losses are not. Enumerate the failure modes at design, order them by time to consequence, and allocate detection and redundancy against that order rather than against equipment cost. Make protection independent of what it protects, test it functionally rather than inspecting it, treat near misses as warnings, and remember that losses come from sequences, not single events.