Planning system safety assessment

Maintainability is considered to be complementary to reliability. RBDs are used in order to allocate and predict numerical maintainability parameters. Numerical maintainability requirements are allocated from system level to sub-system levels by the use of RBDs and MTBE data. Main sources for performing preventive/scheduled maintenance analysis are the EMECA and system safety assessment. Failure modes considered in FMECA are used to determine preventive/scheduled maintenance tasks and intervals in MSG-3 analysis or RCM analysis. MTBE data of the equipment is used while planning the Qualitative Maintainability Analysis (QMA) of a system and performing MTTR predictions. MTTR predictions are used to estimate the maintainability of the system and to make a determination of whether or not the required maintainability could be achieved with the proposed design. 

Stage Gate SG2 forms the most important strategic milestone in the integrated life cycle becanse it determines the finther comse of the project. The developed design specification, the re-worked plans and the updated effort and cost estimates allow management to re-evaluate the project and to decide upon its future. If the decision is to continue the project, the activities of System Safety Assessment (SSA) and of system development are triggered. Those activities are monitored by project control. 

A strategy is therefore needed to facilitate the planning of a system safety assessment Not only does it ensure that we do not run into the hurdles discussed above, but it also assists a third party such as the customer, the certification authorities (e.g. CAA), your fellow designers, or even your boss, to read and understand the methodology used to argue and validate/prove safety. How do we compile a safety assessment strategy The following basic elements have to be considered ... 

Under certain circumstances the safety criteria may be amended to suit the specific programme requirements (e.g. UAV safety criteria, or Military Operational Safety Criteria). However, this is subject to substantiation and agreement by the applicable regulatory authority, thus the declaration of the safety criteria (either in a separate safety criteria report, or as part of a safety plan or an early release of a preliminary system safety assessment). 

If the system safety assessment is to determine the safety requirements and influence the design, then the safety programme plan needs to be integrated into the development process. 

In order to produce believable RACs or any other quantitative risk assessment, reliable, valid data are required. Even though considerable data exist, they are not necessarily available or in the correct format. Improvements can be made in the sharing of lessons learned, mishap information, reliability data, and the other information needed to support the system safety effort. A well-organized effort to identify and catalog existing databases and to develop plans for the systematic collection and dissemination of new data would benefit the entire safety community. 

The purpose of the system safety program plan (SSPP) is to identify the specific system safety requirements for a given project, to include specified system safety tasks, risk assessment methodology and risk acceptance criteria, system safety products and milestones, and system safety organization. 

In lEC 62061 it s possible for a SPECS supplier to self-assess a Safety Related Electrical Control System, but when developing a safety system such as SIL3 Hoist Monitor or the SIL3 Hoist Protector the use of a 3rd party organization to make a Functional Safety Assessment against lEC 62061 2005+Al 2012 is recommended. The 3rd party organization should be involved already when the development project starts, when the safety plan is established. 

In the planning phase the customer requirements have to be assessed and the respective process and resources planning is performed and detailed in a System Safety Plan. 

Following the completion of the first draft design of the planned installation, the necessary requirements derived from experience must be established. Applicable laws and technical rules must be observed. In the event that requirements based on experience cannot adequately guarantee system safety, special attention must be devoted to failure effect on the environment. Qualitative analysts will be continued step by step until unequivocal assessment is possible. In the event that qualitative analysis does not furnish a clear statement concerning system safety, and if the expected danger for the environment due to the behavior of the system under consideration requires it, quantitative analysis should follow qualitative analysis. As a rule, quantitative analysis concerns only particularly critical subsystems indicated in the scope of qualitative analysis. 

The Facility Description provides information needed to verify that the design and operating philosophies are consistent with the Safety Management System and the assumptions and outputs of the Formal Safety Assessment. In addition to a description of the facility itself, the Facility Description should also discuss interactions with existing and planned facilities. 

D. Macdonald, Practical industrial safety, risk assessment and shutdown system Newness. Planning Your Safety Instrumented System White Paper Honeywell. 

Abstract. In this work, we outline a cross-domain assurance process for safety-relevant software in embedded systems. This process aims to be applied in various different application domains and in conjunction with any development methodology. With this approach we plan to reduce the growing effort for safety assessment in embedded systems by reusing safety analysis techniques and tools for the product development in different domains. 

---