Dieser Leitfaden ist derzeit auf Englisch verfügbar.
Technology / Technical guide
Fail-Safe & Fail-Operational: Wind Control Concepts
Fail-safe and fail-operational describe required behaviour under defined failures. They do not identify one universal physical response. A design can preserve a critical function while suspending another, and a loss of electrical power can leave mechanical energy present.
The tolerated failure and preserved function define the claim.
Understand what must remain effective before interpreting a response label as stop, continue or recover.
01 / Fault and failure
A cause and its functional effect are different.
A fault concerns an underlying abnormal condition; a failure concerns loss or impairment of a defined function.
A fault concerns an underlying abnormal condition; a failure concerns loss or impairment of a defined function. The same fault can have different effects at component and system levels. A failed sensor does not automatically mean every other function has ceased.
Conversely, a healthy-looking device indication cannot establish that the required system function remains available. Fault-management reasoning connects the cause, information and functional consequence instead of treating a component label as the full outcome.
02 / Two objectives
Preserving service and preserving critical functions differ.
Fail-operational describes continued required operation through a specified fault condition.
Fail-operational describes continued required operation through a specified fault condition. Fail-safe concerns achieving or maintaining the defined safe behaviour, which may preserve a critical subset of functions while suspending other objectives.
NASA’s fault-management handbook draft uses these terms with explicit functions and fault assumptions. That conceptual distinction does not provide wind-equipment requirements. A claim without its function and tolerated condition cannot establish what continues or what is relinquished.
03 / Safe-state meaning
Stopping is not the definition of every safe condition.
A safe condition is defined by the relevant hazards and required functions.
A safe condition is defined by the relevant hazards and required functions. It can involve maintaining a particular capability rather than simply removing all output. The physical end state and the means of sustaining it are separate questions.
For a rotating system, zero electrical output does not necessarily mean zero motion. Similarly, an electrically powered indication becoming unavailable does not establish the state of a mechanical brake. These logical gaps explain why fail-safe should not be translated automatically into “power loss means stopped”.
04 / Energy and signals
A response depends on what remains available.
A response can depend on stored mechanical energy, an actuator supply or valid state information.
A response can depend on stored mechanical energy, an actuator supply or valid state information. Failure of one of those paths can change which behaviour is physically achievable. Naming a response does not create the energy or observation it requires.
Loss of observation and loss of actuator action are different failure conditions. Continuing with unverified feedback also differs from continuing with an established alternative observation. The redundancy guide explains the limits of that information path.
05 / Claim boundary
Tolerance applies to stated failures and duration.
A design that tolerates one specified failure class may not tolerate a shared cause affecting several paths.
A design that tolerates one specified failure class may not tolerate a shared cause affecting several paths. Required duration and operating conditions also matter. Continued operation immediately after an event is different from maintaining a complete service indefinitely.
Recovery is not guaranteed by the initial response. The state-machine guide distinguishes logical transitions from physical effects; a response label should not collapse these outcomes.
06 / Product scope
Construction does not establish failure behaviour.
Electric yaw is confirmed for all current MARSTON models, but their behaviour after power loss, failed feedback or other faults is not assigned here.
Electric yaw is confirmed for all current MARSTON models, but their behaviour after power loss, failed feedback or other faults is not assigned here. A brake construction description alone cannot establish its energised/de-energised action or complete turbine response.
No fail-operational duration, fail-safe certification, SIL claim or protection sequence is provided. These concepts explain functional boundaries without suggesting disconnection, fault injection, brake operation or recovery commands.
Continue the review with Redundant Sensors: Voting, Agreement & Common Causes.
Continue the review with Wind Control State Machines: State, Trigger & Completion.
Continue the review with Rotor Braking: Net Torque, Deceleration & Energy.
General background: NASA fault-management handbook draft: fault tolerance and response terminology. These references explain industry concepts; they are separate from the applicable MARSTON product and project documents.
Key concepts and conditions.
Read each quantity with its reference, units and stated conditions. A general relation does not establish a model-specific value.
| Concept / quantity | Meaning / relation | Conditions / limits |
|---|---|---|
| Fault | Underlying abnormal condition | Its system effect depends on the affected paths. |
| Failure | Loss or impairment of a defined function | Component and system boundaries differ. |
| Fail-operational | Specified continued required function | Fault class, conditions and duration are explicit. |
| Fail-safe | Defined behaviour preserving relevant safety objectives | Not synonymous with every function stopping. |
| Response capability | Remaining energy, observation and actuator paths | A label cannot supply missing resources. |
Engineering questions.
Does fail-safe always mean the rotor stops?
No. Its required safe behaviour must be defined for the actual system.
Does no electrical output mean no mechanical energy?
No. Rotation can retain energy independently of delivered electricity.
Is a failed observation the same as a failed actuator?
No. They affect different paths and possible responses.
Does one tolerated fault establish all-fault protection?
No. Tolerance belongs to the specified failure conditions.
Does a brake type establish its power-loss action?
No. The actual actuation and complete-system behaviour need separate evidence.
Is a MARSTON SIL or fail-operational claim made?
No certification, response sequence or capability is assigned here.
Technical enquiry
Discuss the technical question.
Fail-safe and fail-operational describe required behaviour under defined failures. Share the model and applicable operating or design information for an engineering discussion.