Safety critical function

For mechanical systems (e.g. (a) and (b) above), it is important to ensure that, during maintenance, the safety functions of equipment are recognised. Otherwise, they may be replaced with unsuitable equipment. For instance, it is preferable for flow restrictors to use an orifice welded within a short length of pipe, so that it cannot easily be left out, rather than, an orifice plate that slips between pipe flanges. It is desirable to have some method of clearly indicating that such equipment has a safety critical function. 

Already now, in cars of the upper class, there are about 80 ECUs (Embedded Computing Units) and five or more bus systems, controlling comfort as well as safety critical functions. Most of the innovations (80-90%) in cars are ICT-driven, especially product individualization and differentiation are based on ICT. The cost of electronics and software in such a car will rise from 25% to more than 40%. On the other hand, according to reports at the 2003 informatics conference in Germany, 55% of car failures are caused by electronics and software, and the X-by-wire implementation plans had to be delayed by major players in the field by years. Diagnosis and maintenance in the field are again a challenge—because of complex electronic systems. 

For complex devices with safety critical functionality, more extensive analysis may be justified. A new technique called Random Intelligent Failure Injection Technique (RIFIT) can provide diagnostic coverage via computer simulation of the complex circuit (Ref. 16). Internal faults can be simulated and diagnostics can be measured. The results of a RIFIT analysis can be incorporated into the FMEDA. 

This standard would establish a consistent approach to mine hoisting risk assessments used to determinate safety integrity levels of safety related control functions at mine projects. Opinions differ as to the SIL requirements for various safety critical functions such as midshaft overspeed SILl, some people feel SIL2 end of wind overspeed at a high speed 100 persons drum hoist without shaft end arrestors, higher than SIL3. 

Hoist safety system—focused on safety critical functions only over speed, overwinds, and emergency stops. The system may also have a mechanical device that fulfils the function of speed and distance protection. 

As a first-step evaluation of large, software-intensive systems, this technique has the added advantage of providing for the separation of software interfaces into safety-critical and non-safety-critical functions, which greatly facilitates the overall analysis effort. Obviously, proper performance of a software analysis in the preliminary stages will also reduce the potential cost of any subsequent analyses. 

Finally, it is important to note that the approach presented in this paper is suitable for safety-critical product-lines where the impact of variation can be traceably identified, examined and justified. For example, aerospace and automotive applications often satisfy this criterion by being driven by the need to reduce unnecessary complexify in order to simplify the design, and therefore the assessment, of safety-critical functions. To this end, this approach is not suitable for novel and complex applications in poorly understood... 

In the system safety analysis process, you will come across IT-driven or microprocessor-based systems. While performing any of the system safety analyses, numerous hazardous situations will be discovered. The first step is to decide whether there are any software controls in those particular subsystems. If there are, then it can be considered a safety-critical subsystem. More formally, a safety-critical subsystem is one in which the operations must work properly or a hazardous situation will result. Safety-critical software is a software within a control system that contains one or more hazardous or safety-critical functions. 

Testing should be designed to confirm that safety-critical functions are being performed properly. 

We see that the approach presented in this paper is in line with the approach from PSA when it comes to defining organizational barrier elements as the roles or personnel onboard. We will however claim that our concept of safety critical functions has one major advantage when it comes to implementation of barrier management. The actual relationship between positions/roles (organizational barrier elements) and operational barrier elements has to be represented and understood in order to conduct a more holistic barrier management. Identifying safety critical tasks and positions and the relationship to operational and technical barrier elements makes it possible to ... 

Actuation 2015 is a European collaborative research and development project. The project aims to develop and validate a common set of standardized, modular, and scalable Electro Mechanical Actuator (EMA) resources for all actuators and all types of aircraft (Actuation 2015). Safety critical functions for flight control, high lift, landing gear, door, thrust reverser have to be developed. 

In future work, we want to further investigate how complex software safety requirements, such as freedom from interference, are formalized using our approach, and we want to identify suitable safety patterns for them. These complex safety patterns are challenging, since they are composed by different mechanisms and ensure safety through their collaborative behavior. Moreover, we want to conduct a controlled experiment to quantify the benefits our approach and understand the concrete benefits in terms of effort saving when applying it to the development of the complete software for a given safety-critical function. 

It is Still helpful and valid though, to follow the work flow recommended by the lEC 14971 standard in order to identify foreseeable hazards based on intended use and safety-critical functions of the system, since the critical functionality that might possibly induce harm is identical for safety- and security analysis. The same applies to hazards. The difference is the hazardous situation, meaning the way people and the environment in general are exposed to hazards. 

The following example illustrates the proceeding of risk analysis based on the adapted lEC 14971 workflow [Fig. 2]. The example starts with the identification of one intended use, specifically a single safety-critical function the prevention of unwanted movement, or - formulated in the positive sense - the maintenance of the intended and adjusted position. The corresponding hazard is the leaving of this intended and adjusted position by means of an unwanted movement. 

Figure 2.30 Functional block diagram (FED) of safety-critical function.

Correct operation of safety functions and safety-critical functions (SCFs)... 

CPSCF Computer Program Safety-Critical Function... 

Plant operators inspect and monitor the equipment for which they are responsible on a day-to-day basis. It is, for example, a requirement that crane operators inspect and test certain safety critical functions such as brakes daily before they start to operate the crane. 

As later-generation aeroplanes were developed, more safety-critical functions were required to be performed. This generally resulted in an increase in the complexity of the systems designed to perform these functions. The likely hazards to the aeroplane and its occupants that could arise in the event of loss of one or more functions (provided by a system or that system s malfunction) had to be considered, as also did the potential interaction between systems performing different functions. 

Safety critical A term applied to a condition, event, operation, process or item which is essential to safe system operation or use (e.g. safety critical function, safety critical path, safety critical item, etc.). All interactions, elements, components, subsystems, functions, processes, interfaces, within the system that can affect a predetermined level of risk. 

The SSHA defines the safety-critical functions, the component fault conditions, generic hazards, and safety-critical operations and environments associated with the subsystem under the column heading Hazardous Condition. This approach allows use of the same form for the PHA, SHA, and SSHA. Separately addressing all four hazardous conditions (generic hazards, safety-critical component fault conditions, safety-critical operations, and environment) for each SSHA provides a better opportunity to identify all hazardous conditions. A sample SSHA is shown in a columnar matrix format in Figure 3.10. 

---