Safety-critical assumptions

Some of the most basic assumptions that shape investigators practice concern the safety-critical nature of airline operations. Investigators assume airline accidents to be catastrophic. And they see failure and error as inevitable features of organisational activity. Taken together. 

This catastrophic thinking is also applied to their own organisations and airlines. There is a pervasive assumption that an air accident will damage or destroy the airline just as much as the airliner involved. Investigators have seen this before  

It s things like how close to a smoking crater are you Like the Manchester Airtours fire, all people saw after that was a smoking hull with Airtours on the side, and that was the end for them. (Si5-6) 

You would say, holy shit we nearly repeated someone else s accident -and that s the end of the airline. It would do so much damage to the airline, forgetting about the death and destruction on the day. (Si2-1) 

In an ideal world it [error] would be close to zero, but because of reality we have humans involved that think in different ways and act differently. .. if you put different people in different situations [errors] are inevitable. (Si3-9) 

---

One way to prepare for failures is to provide alternative sources of information and alternative means to check safety-critical information. It is also useful for the operators to get additional information the designers did not foresee would be needed in a particular situation. The emergency may have occurred because the designers made incorrect assumptions about the operation of the controlled system, the environment in which it would operate, or the information needs of the controller. 

The Hopkins team assumed from the outset that safety interventions could only take root if the front line staff were aware of the hazards patients faced and a need for change. A positive safety culture was regarded as essential, by no means sufficient to produce change but a necessary foundation. The safety critical attitudes, beliefs and behaviours need to be embedded at all levels of the organization, so that as far as possible everyone begins with a shared set of assumptions. 

The widespread use of pointer and reference types makes it impossible in practice to perform full static analysis except on small snippets of code because of the potential for aliasing. It is not possible to avoid reference types in Java, and it is only possible to avoid pointers and references in C++ if polymorphism is not used. In order to perform useful analysis of larger sections of code, it is necessary to make sweeping assumptions to limit the extent of aliasing. While these assumptions may frequently hold, this approach cannot be justified in safety-critical work. 

In this work, we experimented with a new integration of CBD supported by the OCRA tool and MBT supported by QuickCheck. The goal of the integration is to exploit the contract-based refinement to make explicit the assumptions of the model used for testing. The approach has been applied to the AUTOSAR measures to protect safety-critical communication from communication failures as specified by the IS026262 standard. The assumption of the AUTOSAR protection mechanism has been formalized with OCRA on an airbag example. 

Maintaining the assumptions and notations presented in Section 8.5.1, the expected safety criticality is given by Equation (8.24). 

A third important assumption relates to selecting the critical response. EPA assumes that if the dose is below that required to cause the most sensitive response, then other deterministic responses will not occur. However, if other responses have shallower slopes in the dose-response curves near their thresholds, estimating RfD on the basis of the critical response may not be sufficiently protective to preclude a noncritical response from occurring. For this reason, EPA may use information on the slopes of dose-response curves to determine the critical response and the number of safety factors to be applied, although EPA rarely does so. 

Using a constant corrosion rate multiplied by the adsorption efficiency measured as described above, the rate of hydrogen absorption into the metal was calculated, and susceptibility to HIC was assumed to be established once a critical hydrogen concentration (Hc) was reached. A more detailed discussion of this simple conservative model, including a description of the determination of Hc from mechanical experiments, is described elsewhere (33). The conservatism in the model arises from the assumption that all the hydrogen absorbed is retained by the metal rather than released by oxidation as the corrosion process proceeds through the metal. As was emphasized in the introduction, such a conservatism is acceptable in a model where safety is the primary requirement. The approach described would be too conservative for an industrial service model. 

Health organizations throughout the world utilize a safe dose concept in the dose-response assessment of noncancer toxicity. This safe dose has often been referred to by different names, such as acceptable daily intake (ADI), tolerable daily intake (TDI) or tolerable concentration (TC), minimal risk level (MRL), reference dose (RfD), and reference concentration (RfC). The approaches used by various health organizations share many of the same underlying assumptions, judgments on critical effect, and choices of uncertainty (or safety) factors. 

Scientists then determine the appropriate uncertainty (or safety) factors to apply to the no-observed-adverse-effect level (NOAEL) or lowest-observed-adverse-effect level (LOAEL) for the critical effect, based on considerations of the available toxicity, toxicodynamic, and toxicokinetic data. Uncertainty factors (UFs) used in the estimation of safe doses are necessary reductions to account for the lack of data and inherent uncertainty in these extrapolations. Other areas of uncertainty include extrapolations of subchronic-to-chronic exposure, LOAEL to NOAEL, and use of an incomplete database. The major assumptions underlying each of these UFs are described in Table 1. 

The safety technical assessment of the cooled SBR is based on an assumption vidiich has been confinned by industrial experience. The overwhelming majority of all reactions performed in a SBR can be described mth satisfying accuracy with a formal kinetic rate law of second order. This statement is especially valid up to a feed time corresponding to SO % of stoichiometric addition, but for most reactions it even holds true over the complete feed time. This is extremely helpfiil as the schematic presentation of industrially common modes of operation, isothermal and isoperibolic, shows, that the critical process phase is limited to the time necessary to add SO % of the stoichiometric amount. This is shown in Figure 4-49. 

Setting up a safety information system for a single project or product may be easier. The effort starts in the development process and then is passed on for use in operations. The information accumulated during the safety-driven design process provides the baseline for operations, as described in chapter 12. For example, the identification of critical items in the hazard analysis can be used as input to the maintenance process for prioritization. Another example is the use of the assumptions underlying the hazard analysis to guide the audit and performance assessment process. But first the information needs to be recorded and easily located and used by operations personnel. 

---