Safety-critical situations

Due to the importance of hardware testing on test tracks during development, a common practice for the evaluation in safety-critical situations is introduced here. In order to achieve a subjectively realistic but objectively uncritical situation for active safety functions, so-called targets are used on test tracks instead of real traffic participants. Whereas most targets are designed for sensor or system testing, some are also suitable for behavioral studies. Many targets represent vehicles, or what a sensor or driver can perceive of a vehicle. For radar this means that a triple reflector made of... 

To err is human how to improve risk recognition and decision-making in safety-critical situations. 

Model Based Safety Assessment aims at supporting the Preliminary System Safety Assessment (PSSA) [8]. Before the PSSA is performed, the Functional Hazard Analysis identifies the Failure Conditions (e.g. safety critical situations of the system) and assesses their severity on a scale going from No Safety Effect (NSE) to Catastrophic (CAT). Then, during the Preliminary System Safety Assessment, safety models (or alternatively fault-trees) axe built and analysed. A safety model describes formally in which node a fault occurs and how this fault propagates inside the system architecture in order to cause a Failure Condition. 

Essentially, alarms exist to alert the operator to a change of condition in the system. Typically, if unattended to, these changes may result in either a safety-critical situation or a non-optimal system. The alarm system has two main roles ... 

Oppenheim, I., Shinar, D., Carsten, O., Barnard, Y., Lai, F., Vanderhagen, F., Polet, P. et al. 2010a. Critical review of models and parameters for driver models in different surface transport systems and in different safety critical situations. In 1. Oppenheim (Ed.), ITERATE deliverable 1.1. 

The secondary quality attributes are properties which should prevent an error from resulting in a safety critical situation ... 

Decisions in safety-critical situations (from Safety Diagnosis Questionnaire,... 

Preventive measures provide conditions where the incident is unlikely to happen, but its occurrence cannot be totally avoided. In this category, we find measures such as inventory reduction for critical substances, the choice of a continuous rather than a batch process leading to smaller reactor volumes, and a semi-batch rather than a full batch process providing additional means of reaction control. Process automation, safety maintenance plans, etc. are also preventative measures. The aim of these measures is to avoid triggering the incident and thus reducing its consequences. In the frame of mnaway risks, a mnaway remains theoretically possible, but due to process control, its severity is limited and the probability of occurrence reduced, such that it can be controlled before it leads to a critical situation. 

This definition needs some explanation. The viewpoints mentioned in it represent the stakeholders concerns about the system (the trustee) under consideration. A viewpoint can represent an individual user who decides about involving herself/himself in the co-operation with the system depending on its trustworthiness (consider for instance e-commerce or e-health applications) or can represent a class of users. An example of a latter is a non-profit institution which assesses a given Web service on behalf of its users (this is what Health On the Net foundation [1] does for the users of e-health services). A viewpoint can be highly formalized, for instance in the situation where the criteria to be met by the trust case (to consider it satisfactory) are documented and supported by regulations (like in the case for safety critical applications [2]) or are documented and widely accepted (which is the case for security critical systems [3]). For some viewpoints satisfactory may mean convincing and valid whereas for some other satisfactory may have more subjective interpretation. 

Critical Consequence—Class 1. Safety Critical instruments whose failure would either cause, or fail to inform of, situations resulting in accidental fire, explosion, uncontrolled release of dangerous materials, reportable environmental releases, or major property or production losses. The safety critical instruments assigned a Class 1 include those that have been mandated as such by regulating agencies an in-house technical safety review committee reliability studies and specific shutdown systems and specific alarms deemed critical by operations supervisors. 

Occasionally, there may be business pressures or maintenance scheduling problems that would encourage the delay of prooftesting of safety critical alarms and shutdown systems. Such situations can also delay of vessel inspections and safety relief valve testing. Some type of variance procedure or review policy should be defined to handle this occasional need. Such a policy ought to require the review of all of the inspection and test records on the specific equipment involved as well as an approval of the superintendent of the area. 

Have Safety Critical process alarms and shutdown systems been modified to include the new situation ... 

The human factors literature is rich in task analysis techniques for situations and jobs requiring rule-based behavior (e.g., Kirwan and Ainsworth 1992). Some of these techniques can also be used for the analysis of cognitive tasks where weU-practiced work methods must be adapted to task variations and new circumstances. This can be achieved provided that task analysis goes beyond the recommended work methods and explores task variations that can cause failures of human performance. Hierarchical task analysis (Shepherd 1989), for instance, can be used to describe how operators set goals and plan their activities in terms of work methods, antecedent conditions, and expected feedback. When the analysis is expanded to cover not only normal situations but also task variations or changes in circumstances, it would be possible to record possible ways in which humans may fail and how they could recover from errors. Table 2 shows an analysis of a process control task where operators start up an oil refinery furnace. This is a safety-critical task because many safety systems are on manual mode, radio communications between control room and on-site personnel are intensive, side effects are not visible (e.g., accumulation of fuel in the fire box), and errors can lead to furnace explosions. 

A critical situation occurs when the supply system is out of balance, i.e. if X 0. Either the material is surplus X < 0) and has to be stored or it is in deficit X > 0) and has to be provided from stock. Hence, stock capacities and safety stocks are required to cover such critical situations. 

This situation is all in stark contrast to other safety critical industries. For example in aerospace there is a more open and transparent culture of learning which crosses organisational and otherwise commercially competitive boundaries. lu aerospace stakeholders are aware that improvements in safety are for the greata good of the industty and that in the long term a safe product drives revenues for aU players. HIT suppliers have some way to catch up and it is largely the responsibility of their customers to call for the transparency that is required to enable a rigorous and practical assurance process. 

Decentralized decision making is, of course, required in some time-critical situations. But like all safety-critical decision making, the decentralized decisions must be made in the context of system-level information and from a total systems perspective in order to be effective in reducing accidents. One way to make distributed decision making safe is to decouple the system components in the overall system design, if possible, so that decisions do not have systemwide repercussions. Another common way to deal with the problem is to specify and train standard emergency responses. Operators may be told to sound the evacuation alarm any time an indicator reaches a certain level. In this way, safe procedures are determined at the system level and operators are socialized and trained to provide uniform and appropriate responses to crisis situations. 

The problem of feedback in emergencies is complicated by the fact that disturbances may lead to failure of sensors. The information available to the controllers (or to an automated system) becomes increasingly unreliable as the disturbance progresses. Alternative means should be provided to check safety-critical information as well as ways for human controllers to get additional information the designer did not foresee would be needed in a particular situation. 

One way to prepare for failures is to provide alternative sources of information and alternative means to check safety-critical information. It is also useful for the operators to get additional information the designers did not foresee would be needed in a particular situation. The emergency may have occurred because the designers made incorrect assumptions about the operation of the controlled system, the environment in which it would operate, or the information needs of the controller. 

The pressurized thermal shock (PTS) problem has been for a long time under scrutiny by the safety specialists. In practice, in case of accident (e.g. a LOCA), a quick refrigeration of the primary water (and therefore of the vessel wall) takes place, either because of the depressurization following the accident or because of the emergency cold water injection. Under these conditions, the presence of cracks in some areas of the vessel (e.g. near the inlet nozzles of the vessel itself), combined with inadequate ductility of the material, might create critical situations from the structural point of view (unstable crack propagation). 

The retained solutions to reach this required safety level are accurate, reliable and redundant mid loop level measurements, automatic level control and automatic make up with the Medium Head Safety Injection in case of level drop. The investment effort is limited due to the already existing I C and sensors, the safety is improved because radiological releases in normal operation are reduced and staggered countermeasures are implemented in case of problems in this critical situation. 

---