Classifications safety critical systems

Consolidation is starting to take place in secure systems through the adoption of the MILS architecture to support multiple applications at different security classifications, where multiple processor platforms with air-gap security have been used previously. However, there are a number of challenges which need to be addressed in order to use multicore processors in secure systems. Many of these apply to safety-critical systems, as discussed earlier, but there the adoption of multicore also presents a challenge which is unique to security, that of covert channels of communication. 

Praxis Critical Systems developed the Certification Authority (CA) for the MUL-TOS [MULTOS] smart card scheme on behalf of Mondex International. The approach taken is detailed in [Hall 2002a] and [Hall 2(X)2b]. Unlike some of the other example projects the MULTOS CA is security critical rather than safety critical and was developed to meet the requirements of ITSEC E6, a security classification broadly equivalent to SIL4 in the safety world [ITSEC 1991]. The system was COTS based and incorporated C++ (for the user interface GUI) C (for interfaces to specialized encryption hardware) an SQL database Ada 95 and SPARK (for the key security-critical functions). 

The structure of our safety mechanisms classification for the specific classes of technical safety requirements is influenced by Wu and Kelly s hierarchy [19], Guidelines on safety-critical and fault-tolerant systems [7,12,16] were important sources during the development of our safety-mechanism hierarchy. 

In September 1963, the USAF released MIL-S-38130. This specification broadened the scope of the system safety effort to include aeronautical, missile, space, and electronic systems. This increase of applicable systems and the concept s growth to a formal Mil-Spec were important elements in the growth of system safety during this phase of evolution. Additionally, MIL-S-38130 refined the definitions of hazard analysis. These refinements included system safety analyses system integration safety analyses, system failure mode analyses, and operational safety analyses. These analyses resulted in the same classification of hazards, but the procuring activity was given specific direction to address catastrophic and critical hazards. 

Whilst we are on the subject of severity classification, it may be useful to clarify the use of the term safety critical , which is often used as the basis for design guidance, continued airworthiness, and maintenance. To this purpose, the following information is summarised from a draft FAA memorandum (ANM-03-117-10), which provides the criteria for identifying flight-critical system components as applied to large aircraft. First, we need some definitions ... 

In accordance with the applicable safety criteria, each failure mode classification can now be allocated a quantitative and/or a qualitative safety target based on its level of criticality. Table 3.3 shows the safety criteria typically used for large civil transport aircraft. These safety targets will then become a design objective (or safety goal) for the system architects to achieve. 

Risk Assessment 2 2B (see Tables 2.1-2.3). Liquid contact with parts is assessed as a critical occurrence, since the potential damage to the parts would most likely render them unusable. The likelihood of such a mishap is considered highly probable, based on the proposed system design. The risk assessment matrix (Table 2.3) indicates that a risk classification of 2B is unacceptable. Therefore, the system safety precedence tells us that such risk should be approached with the intention of elimination, or possible reduction to an acceptable level. 

The classification of the clean room for preparation of radiopharmaceuticals should be the outcome of a risk assessment and could be class B, C or D [11, 16, 17]. The risk assessment should take into account the use of closed systems, the time between preparation and use and the namre of the product. The critical working zone should be class A and can be realised with a radiopharmacy safety cabinet, an isolator or a hot cell (see Sect. 15.6.4). A compromise to respond to these demands could be an extra airlock between the clean room clothing area (first lock) and the preparation clean room [21]. The first lock has an overpressure of 10-15 Pa to the outside world for keeping out particulate matter (product protection). The second lock has an extra underpressure of — 10 to —15 Pa relative to the clean room to realise a deep underpressure (the so-called sink) for radioprotection and GMP-overpressure of 10 to 15 Pa between the clean room and this extra lock. See also Fig. 27.1. 

Abstract Multicomponent materials based on synthetic polymers were designed and used in a wide variety of common and hi-tech applications, including the outdoor applications as well. Therefore, their response to the UV radiation and complex weathering conditions (temperature, seasonal or freeze—thaw cycles, humidity, pH, pollutants, ozone, microorganisms) is a matter of utmost importance in terms of operational reliability and lifetime, protection of the environment and health safety. This chapter offers an overview of this subject and a critical assessment of more particular topics related to this issue. Thus, various types of multicomponent systems based on thermoplastic and thermosetting polymer matrices were subjected to natural and/or simulated UV radiation and/or weathering conditions. Their behavior was evaluated in correlation with their complex formulation and taking into consideration that the overall effect is a sum of the individual responses and interactions between components. The nature and type of the matrix, the nature, type and size distribution of the filler, the formation of the interphase and its characteristics, the interfacial adhesion and specific interfacial interactions, they all were considered as factors that influenced the materials behavior, and, at the same time, were used as classification criteria for this review. 

Another aspect of this issue is the classification of a problem. It is common practice for COTS vendors to assess the significance of the identified problems and suggest corrective action accordingly. For exanple, a problem that is considered critical will require immediate update, also changing the version of the COTS component. For a problem that is considered less critical or minor the COTS vendor may alert users about it but not correct it until the planned update of the component. However a problem that was considered minor may be critical for the operational context of the system. Hence developers will need to establish a process to assess the severity of each identified issue and request the issue to be reclassified as critical (and hence to be corrected). If this cannot be done then the issue has to be mitigated either by design (architecture) or procedures. The latter will have further impact on operations and will require fiill safety re-evaluatioa... 

---