Safety case assumptions

Assumptions are an integral and inevitable element of any safety case. Assumptions impact on the scope and nature of the arguments and evidence presented. For example, assumptions made concerning the lifetime and maintenance of a system can affect the details of probabilistic risk assessment. Similarly, assumptions made regarding the independence of system functions will determine whether function interactions are explicitly addressed in the safety case. 

The systematic evaluation of substance properties and predictable or actual exposure patterns over the entire life-time of a substance within the scope of risk assessment is as yet a relatively recent instrument, for which harmonised scientific rales were created in the EU for the first time in 1997 in the form of the Technical Guidance Documents (TGD). An essential element in this range of instruments is how to deal with shortcomings in knowledge. Wherever information is missing, standardised worst-case scenarios are conceived taking into account appropriate safety factors . If under these worst-case assumptions a rele-... 

Screening assessments incorporate variability and uncertainty implicitly, by using worst-case assumptions and safety factors. As mentioned earlier, these have rarely been based on a quantitative analysis and may not take account of the full range of uncertainties, so in principle they should be reviewed to determine whether they provide adequate margins of safety. 

The relief sizing methods described in Chapters 6, 7 and 8 make worst case assumptions about the vessel flow regime (see (1.) below) in terms of the,extent to which it causes two-phase flow to enter the relief system. It is therefore not necessary to know the vessel flow regime in order,to safety use these sizing methods. However, it may sometimes be desirable to determine it and calculate whether, or how much, two-phase relief would occur, because . , ... 

The one-hit or linear multistage models should always be among the models employed because they are usually among the more conservative procedures. Reasonable worst-case assumptions must often be made to err on the side of safety. 

Quantitative risk assessments have been performed on a variety of flame-retardants used both in upholstered furniture fabric and foam. The National Research Council performed a quantitative risk assessment on 16 chemicals (or chemical classes) identified by the U.S. Consumer Product Safety Commission (CPSC). The results were published in 2000.88 The 16 flame-retardants included in this NRC study were HBCD, deca-BDE, alumina trihydrate, magnesium hydroxide, zinc borate, calcium and zinc molybdates, antimony trioxide, antimony pentoxide and sodium antimonate, ammonium polyphosphates, phosphonic acid, (3- [hydroxymethyl]amino -3-oxopropyl)-dimethylester, organic phosphonates, tris (monochloropropyl) phosphate, tris (l,3-dichloropropyl-2) phosphate, aromatic phosphate plasticisers, tetrakis (hydroxymethyl) hydronium salts, and chlorinated paraffins. The conclusions of the assessment was that the following flame-retardants can be used on residential furniture with minimal risk, even under worst-case assumptions ... 

Typical results from this study are shown in Fig. 2. Here the breakthrough curves at the target are shown for both cases. As can be seen, the breakthrough in the heterogeneous case is much faster than would have been expected if calculated using homogeneous case assumptions. The consequence for the practical safety assessment of a pollution incident are self evident. 

Comparison of results of dietary toxicity studies and estimated or calculated residues in avian food categories provide more than adequate margins of safety. As shown above, when a series of redundant worst-case assumptions arc made and the highest residue food item (short rangegrass) is used, the acute and chronic MOS values are 12.8 and 3.4, respectively (Tables 8.9 and 8.10). When actual residues (spinach) are used, the acute and chronic MOS values are 29 and 8.0, respectively. Further, when an additional conservative I Ox factor is applied to the exposure (i.e. 10 applications), the acute MOS values arc J-3 or greater. 

One of the fundamental principles to be observed in the field of safety technology is that a hazard assessment has to be based on worst case assumptions. This applies in all cases, whether a physical unit operation or the safe handling of substances, mixtures or a chemical reaction is evaluated. This principle has already influenced the design of hazard testing methods in part. For example, the majority of methods to screen the... 

Assumptions that are made at the time of carrying out a safety assessment may later be proven valid or invalid. It is therefore sensible (and indeed desirable) to revisit assumptions from time to time and either declare them as facts or revisit the safety case to investigate the effect of the assumption being invalid. 

On occasion one encounters a situation where information is simply not known and no practicable assumptions can be made. In this case we may have an opportunity to undertake a part-assessment perhaps until a time when the information becomes unavailable. This is a perfectly reasonable approach so long as this limitation is formally documented as a constraint on the analysis and the project generally. It may even be appropriate to document which areas of the analysis have potential to change once more information does become available. Clearly it is important to monitor the provision of the information on which the safety case is dependent and build this into the project plan. If one believes that the information may not be available or forthcoming then this should represent a risk to the project and be documented and escalated accordingly. 

Section 11.1.6 introduced the notion of assumptions and constraints on the assessment. It can be valuable to revisit these in the safety case as they may well have... 

The safety case should contain sufficient information about the facility to verily that the design and operating philosophy is consistent with the SMS and with the assumptions and outputs of the formal risk analysis. Using an offshore platform as an example, the safety case will generally contain the following minimum information. 

Implicit Assumptions If assumptions are not exactly recorded in the safety case it is difficult to notice, when these pre-conditions change and how this influences the argumentation. 

All the Assumptions on which the Safety Case depends, including the high-level Assumptions mentioned above, should be presented directly, and/or by reference. Assumptions usually relate to matters outside of the direct control of the organisation responsible for the Safety Case but which are essential to the completeness and/or correctness of the Safety Case. Each Assumption must be shown to be valid or at least reasonable according to the... 

C003 is a reminder that the eventual conclusion of the Safety Case will probably be subject to certain Assumptions and outstanding Issues that need to be addressed and possibly to some Limitations on the ATM service(s). 

A management-risk analysis method would not only inform safety cases, it would also be complimentary to an organisation s audit function. For example, a checklist to inform audits could be made of processes or activities that are deemed particularly risky or that rely on assumptions in which there is limited confidence. In addition, the frequency or thoroughness of audits and the focus of safety assessments may also be increased for parts of a management system that are considered similarly risky, or whose failures could lead to particularly severe consequences. In these ways, both the efficiency and the effectiveness of audits and safety assessments could be improved. 

Assumptions can be considered legitimate and acceptable where there is a genuine lack of information or lack of understanding that cannot easily be resolved at the time the safety case is presented. For example, an assumption made regarding system maintenance procedures may be considered acceptable if the procedures have not been fully defined at the time of safety case production, and responsibility for their production lies outside of the safety case developer s duty. 

Broad Studies of Flame Retardants. Several broad studies of health, safety, and environmental factors of flame retardants have been published by public agencies. A critical review by a US government-appointed toxicology panel was conducted to facilitate CPSC regulations on flammability of furniture upholstery (145). The panel found ammonium polyphosphate, alumina trihydrate, zinc borate, hexabromocyclododecane, decabromodiphenyl ether (oxide), PYKOVATEX CP, and THPC to be usable with minimum risk on residential furniture even with worst-case assumptions. Antimony trioxide, several organophosphates, chlorinated paraffins, and molybdate salts were said to need more exposure studies. 

One final concern with the use of the feature model is its central role in deciding what reusable artefacts are included. If the feature model is incorrect, it has consequences for the validity of the hazard assessment, the safety claims and the entire safety case. To offset this concern, we note our assumptions that ... 

This section provides the reader with an overview of why the Safety Case was developed, the facilities and operations that it covers, and who it was written for. The summary should provide a brief statement as to the assumptions, conclusions. 

The Nimrod Safety Case process was fatally undermined by a general malaise a widespread assumption by those involved that the Nimrod was safe anyway (because it had successfully flown for 30 years) and the task of drawing up the Safety Case became essentially a paperwork and tickbox exercise. 

The Assumptions Register contains a list of the assumptions used to develop the Formal Safety Assessment and its matching safety case. 

Let us start by covering an issue that impacts the safety culture, namely the definition of safety. The assumption is made that everyone understands the term safety , but that is not necessarily the case. If a safety culture is to be sustained or developed, a mutually agreed upon definition is needed for the term safety . While this may seem to be unnecessary, a second look shows that after all these years, a clear concise definition is still debated and discussed. If an organization is working with multiple definitions or vague concepts, then the potential for improving the safety culture is reduced. 

In both cases, part of the functions will be executed in a more predictable way (under a stronger failure or timeliness model), while other functions, the complex ones, will execute in a less predictable part of the system. The system separation in two parts makes it easier to enforce the properties assumed for the better part, while safety is ensured by making the system adjustable at run-time the complex functions will only be used for control when a certain set of assumptions is satisfied. For that, the system must encompass a safety manager that observes relevant variables, verifies if predefined safety rules (assumptions) are met, and adjusts the system configuration and operation whenever necessary. 

Contracts separate a requirement into assumptions and a promise [2]. The assumptions specify the required behavior of the environment, while the promise states the expected functionality provided by the component. This separation allows to reason about the correct decomposition of requirements [4,7], which is essential for a modular safety case. The assertions themselves are described in a formal, pattern-based language, which can be translated to many target languages such as LTL or timed-automata [1] in order to enable automated verification. ... 

The distribution of burnable absorbers must result in a radial core power distribution in line with the assumptions of the safety case. 

---