dxmnkd316
Lucia Apologist
Making a truly redundant system is incredibly expensive. It does no good to have backup generators or batteries if the single motor in the freezer itself fails, or the single door seal gets damaged so the cooling system can't keep up. Every component in the chain has to be redundant, possibly multiply redundant depending on the failure rate of the individual components and the probability of success that you are targeting. If you set the bar as, say, it being acceptable to see only one freezer failure at only one hospital (out of 10,000+ hospitals) every 10 years, you will be stunned by how many layers of redundancy will be required.
The FAA mandates that we design commercial aircraft to have catastrophic incidents due to equipment failures less than once per every billion flight hours for a given aircraft type, so aircraft end up carrying around a *lot* of equipment that might only get used once in the life of the fleet, just to backstop that one really, really bad day when 3 other things failed first. Plus, of course, we had to pay a bunch of engineers for several years to sort through all the possible permutations of failure scenarios to KNOW that that one extra backup might be needed in that bizarre case.
That's a level of expenditure that typically would not have a positive ROI for a hospital, so it does not surprise me at all that they encounter failures on a relatively frequent basis (compared with truly redundant systems like aircraft).
Can confirm in the chemical world. It’s not as crazy as aircraft, but LOPA and SIS systems are incredibly expensive to install and maintain. It’s a complete culture shock to go from no SIS to even a little SIS.
The discussions I’ve been in when someone says we need a “safety-rated redundant protection” usually don’t go well. “What’s fully redundant? Let’s start with the second control system. Now, do we need a secondary room for this redundant control system? Should it be in a separate building? I assume we also need to run the conduit and wiring separately with backup power. Do we need an instrument located in a separate place on the pipe if the failure mode is clogging? Can we even use the same technology? Ok, you’ve answered those, now we need to get funding; double the controls budget. Now, let’s talk maintenance requirements. If you can’t guarantee to me that Maintenance won’t inspect this correctly - oh, and someone has to sign off on the craftsperson being competent to maintain this - and at or more often than the required frequency, then we can’t claim the protection credits the system is rated for.”
and so on