SAFETY ASSESSMENT APPROACH

The safety assessment approach proposed in this study aims at evaluating the estimated consequences of potential damage mechanisms. As a result, post-earthquake safety of a school building is not judged based only on the level of increase of the seismic vulnerability of the school, but also on the basis of the estimated risk associated with the building and its occupants. Towards this aim, the likely consequences of a potential failure of both structural and non-structural components are taken into account. 

System Interactions. The presence of unintended interactions between nominal behaviours complicates the assessment approach. We expect that the constrained scope will lead to a small set of interaction classes to analyse for any given training scenario, generalised from the results of particular assessments. For example, the presence of fictional elements in training scenarios is expected to give rise to a general class of interactions as well as specific issues for particular elements. As part of the analysis of the effectiveness of the safety assessment approach, we intend to provide for feedback and review of interaction analyses. 

In this paper we describe an attempt to adapt the Model Based Safety Assessment approach in order to deal with Information Security aspects. We believe that the reuse of safety models and assessment tools should reduce the cost of security assessment. In the following of the paper, we first summarize the main aspects of the Model Based Safety Assessment methodology. Then we explain the adaptation of models to deal with security and we describe how we used two safety assessment tools to perform security analysis. Finally we list several preliminary lessons learnt. 

To implement the Model Based Safety Assessment approach we have been using the AltaRica language and associated tools [2]. Each of the nodes in the previous diagram is modelled formally by an AltaRica node selected in a predefined library. For instance, nodes Dataflowla and Dataflowlb are instances of the formal node DataFlow that has two inputs I and R and one output O. When it is in its correct mode and its resource is in its correct mode, this node propagates on its output the value of its input, it does not propagate any value if the node or its resource is in the lost mode and otherwise an erroneous value is propagated. 

Therefore, there is a need for developing a comprehensive deterministic safety assessment approach, which should be able to consider the contributions of the various defence in depth provisions to the overall safety aim of defence in depth. 

Tiered ToxicologicaUSafety Approach Botanical substances may be used at variable levels in personal care products. This together with the type of product to which the extract is being added will define the level of exposure to the consumer. The safety assessment approach can be flexible based on the level of botanical or natural substances in the product. The approach to these extracts is based on tiers. The first tier would be based on very conservative assumptions using worst-case scenarios and the last tier would require an in-depth knowledge of the exact composition if the botanical extract to be used and specific toxicological data to address all relevant endpoints. The three tiers addresses Type I dermal and systemic endpoints. Explanation as to how these tiers were set is provided in detail in the corresponding book chapter. 

The SESAR safety assessment approach typically uses static risk modelling techniques safety criteria and objectives are identified based on accident incident models and further safety requirements are derived using Fault Trees, Failures Modes and Effects Analysis or similar techniques. This section presents criteria to identify specific cases where DRM application is required. 

Wang J., (1994) Formal Safety Assessment Approaches and Their Application to the Design Process", PhD Thesis, Engineering Design Centre, University of Newcastle upon Tyne, July, 258p. 

There is no one correct way of conducting a safety assessment. It all depends on the system complexity and on the safety assessment approach utilised (see Chapter 2). That does not mean to say that the assessment has to be analysed from a single approach only for, more often than not, a combined approach is far more feasible to identify and analyse the range of possible hazards (see Chapter 6). The following section will broadly contrast/compare the maimer in which the goal-based approach (Chapter 5) and the risk-based approach (Chapter 4) are applied during a system safety assessment. 

In risk characterization, step four, the human exposure situation is compared to the toxicity data from animal studies, and often a safety -margin approach is utilized. The safety margin is based on a knowledge of uncertainties and individual variation in sensitivity of animals and humans to the effects of chemical compounds. Usually one assumes that humans are more sensitive than experimental animals to the effects of chemicals. For this reason, a safety margin is often used. This margin contains two factors, differences in biotransformation within a species (human), usually 10, and differences in the sensitivity between species (e.g., rat vs. human), usually also 10. The safety factor which takes into consideration interindividual differences within the human population predominately indicates differences in biotransformation, but sensitivity to effects of chemicals is also taken into consideration (e.g., safety faaor of 4 for biotransformation and 2.5 for sensitivity 4 x 2.5 = 10). For example, if the lowest dose that does not cause any toxicity to rodents, rats, or mice, i.e., the no-ob-servable-adverse-effect level (NOAEL) is 100 mg/kg, this dose is divided by the safety factor of 100. The safe dose level for humans would be then 1 mg/kg. Occasionally, a NOAEL is not found, and one has to use the lowest-observable-adverse-effect level (LOAEL) in safety assessment. In this situation, often an additional un-... 

The stressor to impact approach is used when the impact of a substance is unknown. It is, for example, used in the guidance on information requirements and chemical safety assessment developed by the European Chemicals Agency [28] for the implementation of REACH. 

Food Allergy Immunological Aspects and Approaches to Safety Assessment... 

It is appropriate here to consider briefly some of the experimental approaches that are contained within such decision trees, and that continue to provide the bases for protein allergenicity safety assessment. 

The approach to safety assessment recommended by IFBC/ILSI [70] was somewhat guarded about the potential utility of animal models and noted at that time that there were available no suitable methods. However, a somewhat different view was expressed in 2001 in the recommendations deriving from the FAO/WHO joint consultation [71]. In this case one of the conclusions reached was that animal models might contribute valuable information on the likely allergenicity of foods derived from GM crops. Although progress in the development of animal models appropriate for safety assessment predated the publication of the FAO/WHO recommendations, further momentum was provided for research in this area [4, 9, 87-98],... 

General References Guidelines for Hazard Evaluation Procedures, Second Edition with Worked Examples, American Institute of Chemical Engineers, New York, 1992 Layer of Protection Analysis A Simplified Risk Assessment Approach, American Institute of Chemical Engineers, New York, 2001 ISA TR84.00.02, Safety Instrumented Functions (SIF)—Safety Integrity Level (SIL) Evaluation Techniques, Instrumentation, Systems, and Automation Society, N.C., 2002. 

In 1993, the Center for Chemical Process Safety (CCPS) published Guidelines for Safe Automation of Chemical Processes (referred to henceforth as Safe Automation). Safe Automation provides guidelines for the application of automation systems used to control and shut down chemical and petrochemical processes. The popularity of one of the hazard and risk analysis methods presented in Safe Automation led to the publication of the 2001 Concept Series book from CCPS, Layer of Protection Analysis A Simplified Risk Assessment Approach. This method builds upon traditional process hazards analysis techniques. It uses a semiquantitative approach to define the required performance for each identified protective system. 

Tapia, M.S. and Welti-Chanes, J. 2002. Approaches for safety assessment of minimally processed fruits and vegetables. In Engineering and Food for the 21st Century (J. Welti-Chanes, G.V. Barbosa-Canovas, and J.M. Aguilera, eds), pp. 671-695. CRC Press, Boca Raton, FL. 

The usual way in which transition (or flow ) between the different phases is handled in safety assessment is to use a tiered testing approach. Each tier generates more specific data (and costs more to do so) and draws on the information generated in earlier tiers to refine the design of new studies. Different tiers are keyed to the... 

While they were not quite as sweeping in approach as the aforementioned guidelines, a toxicologist working in pharmaceutical safety assessment should become familiar with the all the other ICH Guidelines in the S series. 

This approach appears somewhat irrational and without much scientific merit, since many of these new molecules are minimally toxic or nontoxic by this sort of acute evaluation. As in the case of interferons or monoclonal antibodies, the toxic effects observed in humans might not be predicted from safety assessments in rodents. An appropriate test species should be selected. Is the rat or mouse the appropriate species to evaluate a species-specific rDNA protein such as human growth hormone or interferons, or would nonhuman primates be more suitable Does the nonhuman primate really offer any advantages There is some consensus that the nonhuman primate may be a more appropriate species for testing some rDNA human proteins. 

The other way to express a relative dose in animals or humans is to do so in terms of body surface area. There are many reasons for believing that the surface area approach is more accurate for relating doses between species (Schmidt-Nielson, 1984), and especially between test animals and humans, but this is still a less common approach in safety assessment, although it is the currently accepted norm in several areas carcinogenesis and chemotherapy, for example. 

The entire safety assessment process that supports new product research and development is a multistage effort in which none of the individual steps is overwhelmingly complex, but for which the integration of the whole process involves fitting together a large and complex pattern of pieces. This paper proposes an approach in which integration of in vitro test systems calls for a modification of... 

Some would say that this is the current state of the art. Much of the necessary library could be assembled from test systems that have been extensively evaluated and have already undergone extensive validation (Gad, 2000, 2001). Three critical steps must be taken for the eventual fulfillment of these objectives (1) acceptance of a scientific approach to the problem of safety assessment (2) development of an operative validation and acceptance process for new test procedures (3) clear enunciation of an acceptance criterion for new test designs by regulatory authorities. 

---