Operations phase system safety integration

Safety instrumentation system (SIS) life cycle operation and maintenance (O M) phase details. SIF, safety instrument functions SIL, safety integrity level. 

In September 1963, the USAF released MIL-S-38130. This specification broadened the scope of the system safety effort to include aeronautical, missile, space, and electronic systems. This increase of applicable systems and the concept s growth to a formal Mil-Spec were important elements in the growth of system safety during this phase of evolution. Additionally, MIL-S-38130 refined the definitions of hazard analysis. These refinements included system safety analyses system integration safety analyses, system failure mode analyses, and operational safety analyses. These analyses resulted in the same classification of hazards, but the procuring activity was given specific direction to address catastrophic and critical hazards. 

The objective of the realisation phase is then to create the SIS conforming to the specification, especially in terms of safety functions and allocating SIL. This paper focuses on system requirements (Part 2), and does not develop software aspects (Part 3). The realisation phase consists of design requirement specification (for subsystems and elements), design and development, integration (software integration refers to Part 3), operation and maintenance, validation, modification, and verification. 

The computer system requirements define, as a minimum, the functional and non-functional properties of the computer system that are necessary and sufficient to meet the safety requirements for the plant that have been defined at a higher design level. The specification of computer system requirements is a representation of the necessary behaviour of the computer system. Precise defiiution of the interfaces to the operator, to the maintainer and to the external systems is an integral part of the product provided as the output of this phase. At this stage, the definition of interfaces is limited to the functional and non-functional properties of these interfaces then-design or implementation may be as yet undetermined. 

VI-10] SERIZAWA, A., et al.. Two-phase flow in natural circulation system of the integrated modular water reactor (IMR), The 6th International Conference on Nuclear Thermal Hydraulics, Operations and Safety (NUTHOS-6), N6P132, Nara, Japan (2004). 

The safety assessment therefore needs to consider the implication of unwanted operation (for instance via the functional hazard assessment as a specific functional failure mode applied to specific flight phases). The usual design practice (to ensure high system integrity) is to design parallel multiplex systems. However, when it is important to avoid unwanted operation, items may be put in series to avoid unwanted operation (Lloyd and TVe, p. 47) as demonstrated for the angle-of-attack (A of A) sensors in Fig. 6.4. 

---