Safety cases information availability

Gary Lang and Rhiatmon Hardy, UK HSE, paper submitted to the committee, April 2012. More information on HSE and safety cases is available at http //www.hse.gov.uk/offshore/safetycases. htm. 

The third and fourth disks include Occupational Health and Safety (OHS) information. These disks contain data bases on Resource Organizations, Resource People, Case Law, Jurisprudence, Fatalities, Mining Incidents, and ADISCAN. Furthermore, information on Noise Levels, National Institute for Occupational Safety and Health (NIOSHTEC) Non-Ionizing Radiation Levels, and a Document Information Directory System is readily retrievable. These CD-ROM materials are available from the Canadian Center for Occupational Health and Safety, 250 Main Street East, Hamilton, Ontario L8N 1H6. 

As a consequence of the toxicity related to the presence of aristolochic acid in plant preparations, several health institutions, such as the US Food and Drug Administration, Therapeutic Goods Administration have recently published safety information to prevent further cases of intoxication (information available at web address http //www.cfsan.fda. gov/ dms/ds-bot.html) [471], So detecting aristolochic acids in plant species that could be used in herbal remedies, and also in herbal preparations of uncertain composition, has attracted great priority in recent years to help prevent future adverse reactions. Aristolochic acids present in medicinal plants or herbs are analyzed by soxhlet extraction followed by TLC in the Chinese pharmacopoeia [412]. Another report used multiple ultrasonic extraction followed by HPLC analysis [472]. Ong s laboratory reported a method using a home made pressurized liquid extraction (PLE) system in dynamic mode to extract aristolochic acid in medicinal plants, followed by gradient elution HPLC [473]. Several scientific communities described various analytical methods for... 

Note that in discussing availability and performance one needs to make reference to the stakeholders responsible for hosting the system. In practice this could be the healthcare organisation, software manufacturer or a third party. The principles of fault tolerance and resilience remain the same irrespective of which party takes commercial responsibility. However the stakeholder responsible for implementing controls will vary as will the information available to safety case developers. In this... 

On occasion one encounters a situation where information is simply not known and no practicable assumptions can be made. In this case we may have an opportunity to undertake a part-assessment perhaps until a time when the information becomes unavailable. This is a perfectly reasonable approach so long as this limitation is formally documented as a constraint on the analysis and the project generally. It may even be appropriate to document which areas of the analysis have potential to change once more information does become available. Clearly it is important to monitor the provision of the information on which the safety case is dependent and build this into the project plan. If one believes that the information may not be available or forthcoming then this should represent a risk to the project and be documented and escalated accordingly. 

Each case study consists of a literature review on the effects of deregulation in that particular industry, followed by interviews with key industry representatives (selected to represent the views of labor, corporate management, and safety regulators). Interviewees occasionally also provided data or references to support their assertions. The relative degree of reliance on published literature versus interviews varied between the three case studies, depending on the extent of information available in the published literature. 

We all know that the best decision-making processes are those utilizing the most objective information available. This is certainly the case with regard to safety. 

Security of data has become an important consideration. With the expanded use of the Internet, unauthorized individuals may gain access to private and confidential information found in safety software and applications. It is illegal to make some personal information available. Examples are human resource information, medical information, and other data that may link to accident and injury or illness cases. One kind of security involves keeping secure data and information on computers that do not link to other applications. Another kind of security involves encryption techniques for secure data and information. When data and applications reside in other locations, the communicafion interfaces must be secure along with the remote computer systems themselves. 

The other scenario is where the recipient of the report does not accept that the identified problem exists. In this case, the Exception Report should produce some evidence as to why the problem is not valid. It may be that the Road Safety Audit Team did not have all the information available, or that the scheme design has changed since the plans used in the audit were prepared. 

A case-study approach is appropriate for exploratory studies such as this (Yin, 1994). For the subject of the study, an acdderrt was needed where detailed information was available to form a Current Reahty Tree - the situation at the time of the accident. From this, it should be possible to generate safety recommendations to form a Future Reality Tree - the situation we would like to bring about The accident used for the study was the Ansett (New Zealand) Dash 8 controlled flight into terrain, near Palmerston North in New Zealand, because litigation had made the necessary information available. 

This involves the knowledge of the order of the discontinuity. Numerical approaches to determine this order work only reliable for orders 0 and 1 [G084]. We therefore suggest to restart the integration method for safety reasons. When restarting a multistep method, much time is spent for regaining the appropriate integration step size and order. The best one can do is to use the information available from the last time interval before the discontinuity in the case of the BDF method for... 

The first version of the SAC document should be created with the Technical Safety Report because it is strongly related to the argumentation in this document. Furthermore the SACs must be available in a form that they can be transferred into the user handbooks. The end version of the SAC document must be created after completion of the validation report and together with finalization of the Safety Case. Fig. 2 lists also all potential kinds of SAC users who have to be informed about the SACs. 

On behalf of the UK nuclear industry we have also been developing a more rigorous approach to claim decompositioa While the details have yet to be published this has involved an empirical study of a large number of safety cases available to Adelard (and reflecting the take up of the cases approach) allowing an informal empirical study of what is needed for a claims decomposition language. 

Other characteristics have reduced the effectiveness of certain safety cases produced to meet the requirements of ISO 26262. These include lack of focus and brevity unnecessary repetition of information available elsewhere and the use of inappropriate means of expression (e.g. use of GSN where a table might be more effective and vice versa). Similarly, safety cases in the automotive industry are as susceptible as those in other industries to deficiencies such as fallacies and failures to acknowledge limitations. These weaknesses are found in safety cases in other industries but, we believe, may best be countered by didactic material that is targeted specifically at the automotive industry in order to improve outreach. 

The end users need not be given the full safety case, since they do not need to know all the information contained in it. However, the parts dealing with emergency arrangements and with limitations for safe use must be available to them (e.g. through updated operational/maintenance manuals). 

---