Safety cases structure

The Safety Case structure proposed by the lADC is as follows ... 

The subsystem level safety cases are delivered and submitted for approval as and when required prior to individual projects woiks being delivered and most often in advance of the system safety case delivery. Some of the project level deliverables are completed at the same time as the system coimnissioning and are, therefore, delivered and submitted at the same time with the system safety case, but to different approvals/acceptance bodies. However, in order to secure delivery of the complete safety argument, the system safety case structure and fact net must be completed well in advance, with all the subsystem level safely arguments relevant to the system level argument identified and completed as part of the subsystem level safely case s delivery and acceptance process. 

The decision is encountered when there is - or is likely to be - an unjustified assurance deficit, which is unlikely to be remedied within the bounds of the original safety management plan and proposed safety case structure. The (potential) presence of this assurance deficit should be communicated to Management in a timely manner. In addition to this communication, activities should be undertaken to identify possible methods of addressing the assurance deficit. These activities are... 

Keywords System Safety Complexity Safety Analysis Software Engineering Formal Methods OF-FMEA Safety Claim Structure Safety Case Safety Assessment... 

ASCE (Adelard Safety Case Editor) Tool for Safety Case Document Construction—a hypertext tool for constructing and reviewing structured arguments (http //adelard.com/software/asce/). 

Because these drug candidates have potential biological activity, precautions should be taken to limit worker exposure during scale-up operations. Personal protective equipment requirements and adequate containment and ventilation provisions should also be defined as part of the safety review process. Often this assessment can be difficult because the material produced from the pilot plant will be used for toxicology evaluation purposes. In these cases, structure-activity relationship evaluations with regard to the relative toxicity of the compound may be appropriate to estimate the extent of risk. 

The safety case provides a structured argument, supported by a body of evidence, that provides a compelling, comprehensible and valid case that a system is acceptably safe for a given application in a given context [6]. Let s break that definition down into its component parts. 

The safety case is not a dashboard of data or a set of performance metrics. Its depth and interpretation is much greater and the foundation of the safety case is the concept of a structured argument The articulation of hazard s causes and, importantly, the controls provides a rounded rationale from which any conclusions relating to overall degree of cUnical risk will be drawn. The argument will be underpinned by... 

Sections 13.2 and 13.4 discussed the SWIFT method for hazard derivation and the need for brainstorming. These techniques are often carried out in a workshop environment involving key stakeholders and domain experts. The act of employing this methodical evaluation of the system is important evidence which raises confidence in the safety case and provides non-specific but nevertheless important risk mitigation and diligence. This is particularly the case where structured documentation is made available to support the workshop and a clear set of inputs and outputs are defined. 

Writing a coherent and concise safety case is an art and requires skills that only come through experience. Structure is vital as without this it is impossible to fluently articulate the safety argument in a logical manner. It is a good idea to draft out the structure first formulating section headings which flow and tell a story. Ultimately tlie report should draw some clear conclusions on risk acceptability and make recommendations on next steps. 

The risk analysis and evaluation will form the heart of the safety case. It is here where the argument and evidence is set out to justify the report s safety claims. This information is inextricably linked to the detail in the hazard register but in the safety case one has the opportunity for further explanation and elaboration. The hazard register typically has a formal structure to support cohesion and consistency between hazards. The fiee-form text of the safety case facilitates articulation and openness enabling us to support our argument with direct and indirect evidence. Essentially the text provides the necessary inference between the hazards, causes, controls and evidence that is needed to justify the argument. 

Note that where hazard registers are large it might be easier in the safety case to refer out to a dedicated document, appendix, annex or electronic report. Whatever format is chosen, it should be complete, intuitively structured aud be readily accessible to the intended stakeholders. 

The safety case is only likely to be compelling if it is structured and logical. The SMS should contain a standard template for the safety case. 

Leplat has noted that many accidents relate to asynchronous evolution [112], where one part of a system (in this case the hierarchical safety control structure) changes without the related necessary changes in other parts. Changes to subsystems may be carefully designed, but consideration of their effects on other parts of the system, including the safety control aspects, may be neglected or inadequate. Asynchronous evolution may also occur when one part of a properly designed system deteriorates. 

STPA can be used to further refine these constraints and to evaluate the resulting designs. In the process, the safety control structure will be refined and perhaps changed. In this case, a controller must be identified for the stabilizer legs, which were previously not in the design. Let s assume that the legs are controlled by the TTPS movement controller (figure 9.3). 

In some cases, general requirements and policies for an industry are established by the government or by professional associations. These can be used during an accident analysis to assist in comparing the actual safety control structure (both in the plant and in the community) at the time of the accidents with the standards or best practices of the industry and country. Accident analyses can in this way be made less arbitrary and more guidance provided to the analysts as to what should be considered to be inadequate controls. 

One consequence of the completeness of a STAMP analysis is that many possible recommendations may result—in some cases, too many to be practical to include in the final accident report. A determination of the relative importance of the potential recommendations may be required in terms of having the greatest impact on the largest number of potential future accidents. There is no algorithm for identifying these recommendations, nor can there be. Political and situational factors will always be involved in such decisions. Understanding the entire accident process and the overall safety control structure should help with this identification, however. 

The public water safety control structure in Ontario started out with some weaknesses, which were mitigated by the presence of other controls. In some cases, the control over hazards was improved over time, for example, by the introduction of operator certification requirements and by requirements added in 1994 for continuous monitoring of chlorine residuals and turbidity in wells directly influenced by surface water. While these improvements were helpful for new wells, the lack of a policy to apply them to the existing wells and existing operators left serious weaknesses in the overall public health structure. 

The nonprescriptive nature of the safety case means that the structure and organization of the documentation will vary according to the needs of the facility. The risks and management activities associated with a nuclear power plant, for example, are quite different from those for a freight railroad. Therefore, the respective safety cases are likely to be quite different. Nevertheless, it will usually be found that a Safety Case has three principal sections ... 

---