Inherent safety, protection layers and fail-safe behaviour

Begin with the source of potential harm

Elimination removes a hazard source; substitution changes it to a less hazardous alternative, with new hazards checked. Inherently safer design aims to reduce danger through the nature of the system, such as smaller inventories or lower required energy. It is most useful while requirements and architecture can still change. A reduction is meaningful only if the intended service remains workable.

Protective engineering measures address an exposure or consequence path: separation, containment or a defined protective function, for example. Administrative measures depend on work organization and actions, and personal protective equipment depends on suitable use and condition. These can contribute, but they do not remove the same source in the same way. The hierarchy of controls is a general preference, not evidence that any particular implementation works.

Use a physical account without inventing a harm threshold

Translational kinetic energy is E=½mv², with mass m and speed v. Mass enters linearly and speed quadratically. The figure compares supplied mass and speed choices, so a learner can distinguish changing the source from adding a layer around an unchanged source. Neither curve measures injury likelihood.

An impact also depends on geometry, contact, stopping behaviour and the exposed person or object. Other forms of stored energy may remain when translation stops. A small energy result cannot establish that a pinch, sharp edge, electrical circuit or suspended load is safe. Identify which hazard the model actually changes before claiming an overall safety improvement.

Define a failure response for the complete system

Fail-safe behaviour means reaching or maintaining a state that addresses the defined hazards when specified failures occur. “Power off” is not a universal safe state: loss of motion can be helpful while loss of cooling or support can create another problem. A command to stop is also different from verified stopping; stored energy and response time remain part of the scenario.

For each protective function, define the initiating condition, sensing, decision, final action and evidence that the action occurs. Review bypass, testing, maintenance and shared dependencies. Two layers sharing one sensor or one energy supply may fail together. Protection needs validation against credible conditions, including failures, rather than a count of devices or a reassuring label.

Isolate the effect of mass and speed

Supply an initial translating mass of 20 kg at 2 m/s. Its kinetic energy is ½×20×2²=40 J. Suppose a different architecture can deliver the same stated service with 5 kg at 1 m/s: energy becomes ½×5×1²=2.5 J.

Mass has been divided by four and speed by two, so energy is divided by 4×2²=16. The result compares one energy source. It supplies neither an acceptable impact threshold nor the time or force needed to stop. The revised service, other hazards and the necessary protective functions still require their own evidence.

Try the reasoning

1. Would halving speed while keeping mass fixed halve kinetic energy?

   Show the answer and reasoning

   No. It quarters the translational kinetic energy because speed is squared.

2. Does a barrier eliminate the moving part’s stored energy?

   Show the answer and reasoning

   No. It changes a possible exposure path while the energy source remains.

3. Why can “switch off on fault” fail as a complete safe-state requirement?

   Show the answer and reasoning

   Loss of power can remove a needed support or cooling function, and residual energy may persist. The whole hazard scenario determines the required response.

What to carry forward

Reduce sources where feasible, then justify each protective function and its behaviour under specified failures.