Safety critical operation

The integrity of safety instrumented systems is usually dependent on proof testing at specified intervals (often at a frequency between monthly and three-monthly). Safety management systemst2j[Pg.118]

Ensure that those performing safety-critical operations have appropriate skills and physical resources (including adequate rest). 

Create management of change procedures and ensure they are being followed. These procedures should include hazard analyses on all proposed changes and approval of all changes related to safety-critical operations. Create and enforce... 

Safety Risk Assessment by Monte Carlo Simulation of Complex Safety Critical (Operations... 

This paper gives an overview of performing safety risk assessment of a safety critical operation with support of Monte Carlo (MC) simulation. The approach is outlined for an air traffic example involving aircraft departing from a runway, which is occasionally crossed by taxiing aircraft. At the airport considered, a Runway Incursion Alert System (RIAS) is installed to warn the air traffic controller in case of impending runway incursions. The paper explains the key issues to be mastered in performing a MC simulation supported safety risk assessment of this kind of operation. 

Another well-known technique of hazard identification is the HAZOP (HAZard and OPerability) method. With this method, hazards are identified and analyzed using sessions with operational experts. At the same time, the experts come up with potential solutions and measures to cope with the identified hazards (Kletz, 1999). The advantage of HAZOP with respect to the functional approach is that also nonfunctional hazards are identified during the brainstorm with operational experts. However, in applying HAZOP, one needs to take care that hazard analysis and solution activities do not disturb the hazard identification process, which could leave certain hazards unidentified or inappropriately solved . Leaving such latent hazards in a design typically is known to be very costly in safety critical operation. 

K. Greb, A. Seely, Design of Microcontroller for Safety Critical Operation, Microcontroller-... 

Dutyholders should ensure that written procedures are in place, and consistent with current good practice, for safety-critical operating activities in the transfer and storage of fuel. 

Any safety-critical operations must be clearly identified and assured of operation. 

It is Strongly reconunended that an FMEA be used to investigate further how a particular failure (which leads to a hazard) can come about. The FMEA should not be used as the primary safety analysis tool. A more appropriate application is to hazard and operability (HAZOP) a particular part of the plant. Once the safety-critical operations have been identified, then FMEA can be used very selectively to focus on how particular failure modes might lead to process deviations and thus create a hazard. The primary reason for this is that FMEAs are a very laborious effort and easy to become bogged down. But their strength is going to the piece-part level, as necessary, to determine root causes, and this of course is paramount in understanding how to control a hazard. 

Blom, H.A.P., Stroeve, S.H., De Jong, H.H. 2006. Safety risk assessment by Monte Carlo simulation of complex safety critical operations. In F. RedmiQ T. Anderson (Eds.), Developments in Risk-based Approaches to Safety Proceedings of the Fourteenth Safety-critical Systems Symposium, Bristol, U.K., 7 9 Febniary 2006 Springer. 

Although all instmctions/procedures have the same purpose and objectives, their significance varies and does so in direct proportion to the consequences of failure to comply. For example, a misunderstanding when reading the instructions on expense submissions may lead to inefficiency and delayed payment but, in reality, the consequences are unlikely to have any more impact than to inconvenience a small number of people. However, failure to comply with the instruction/procedure covering a safety critical operation or maintenance task could (as previously shown) result in fatalities. 

The SSHA defines the safety-critical functions, the component fault conditions, generic hazards, and safety-critical operations and environments associated with the subsystem under the column heading Hazardous Condition. This approach allows use of the same form for the PHA, SHA, and SSHA. Separately addressing all four hazardous conditions (generic hazards, safety-critical component fault conditions, safety-critical operations, and environment) for each SSHA provides a better opportunity to identify all hazardous conditions. A sample SSHA is shown in a columnar matrix format in Figure 3.10. 

---