Latent-failure risk estimates for computer control

It is shown that critical computer controls using unmonitored safety circuits are unsafe. Analysis supporting this result leads to two additional, important conclusions: (1) annual maintenance checks of safety circuit function do not, as widely believed, eliminate latent failure risk; and (2) safety risk remains even if multiple, series-connected protection circuits are used. It is shown analytically that latent failure risk is eliminated when continuous monitoring is used. The models and metrics employed can be applied by designers and reliability analysis in evaluating their specific computer control applications