Equipment is designed and built so that it stays single fault safe, or so that the risk management process finds the risk still acceptable: it is single fault safe if it uses a single means of risk reduction with negligible probability of failure (reinforced insulation, a high-integrity component, a suspended mass with a tensile safety factor of eight) or if a single fault will be found within the expected service life before the second means fails or the second means' failure in that life is negligibly probable; a fault that causes another fault counts as one; only one fault at a time is applied in testing. Which failures are tested is decided by the risk analysis: failure of any single component that could produce a hazardous situation, including those of 13.1, is simulated physically or theoretically, taking account of the risk across the service life, reliability, safety factors and ratings, with highly probable or undetectable failures always simulated; failures of double or reinforced insulation and of high-integrity components are not simulated. Compliance is determined by the tests for the single fault conditions of 13.2 and for the failures the risk analysis identifies, none of which may lead to a hazardous situation of 13.1 or other unacceptable risk.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.