Safety critical systems

An inherently safer system should have inspection and reliability testing of safety critical systems and practices (CCPS, 1993c). 

Inspect to confirm that people and equipment are really there for safety critical systems and procedures. 

Introduction The chemical processing industry relies on many types of instrumented systems, e.g., the basic process control systems (BPCSs) and safety instrumented system (SIS). The BPCS controls the process on a continuous basis to maintain it within prescribed control limits. Operators supervise the process and, when necessary, take action on the process through the BPCS or other independent operator interface. The SIS detects the existence of unacceptable process conditions and takes action on the process to bring it to a safe state. In the past, these systems have also been called emergency shutdown systems, safety interlock systems, and safety critical systems. 

Safety-critical systems place much more stringent demands on precise definitions. 

There is a deeper issue concerning framing. In a fully formal spec such as for safety-critical systems, you would be more explicit about which objects are left untouched. 

In safety-critical systems, it is possible to document refinements precisely enough to perform automatic consistency checks on them. However, achieving this level of precision is rarely cost-effective, and we do not deal with that topic in this book. 

Human expertise in complex systems is constantly changing and a New Paradigm for software safety assurance is considered. As the development of Safety Critical Systems is guided by standards, the standards are to be updated3. In what follows we present a general view of how the development of safe software systems is currently practiced and show two specific solutions aimed at efficient support of the efforts. Responsibility of organizations, processes and culture, not just efforts of specific members of the organizations, is emphasized. 

BishopP. G. and R.E. Bloomfield, A Methodology for Safety Case Development, Safety-critical Systems Symposium, Birmingham, UK, 1998. 

Cichocki, T. and J. Gorski, Failure Mode and Effect Analysis for Safety-Critical Systems with Software Components, in Floor Koomneef, Meine van der Meulen (eds.) Computer Safety, Reliability and Security, Proceedings of 19th International Conference SAFECOMP 2000, Rotterdam (The Netherlands), October 24—27, 2000, Springer Lecture Notes in Computer Science 1943, p. 382-394. 

J. van Katwijk, Bo Sanden, and J. Zalewski, An Approach to Evaluate Real-Time Software Architectures for Safety-Critical Systems, 2003, Proc. Workshop on Critical Systems Development with UML, San Francisco, Calif., October 21, 2003, 121-128 (http //www.eg3.com/real/safety.htm). 

McDermid, J. A., A.J. Vickers, and S.P. Wilson, Managing Analytical Complexity of Safety Critical Systems using Viewpoints, Department of Computer Science, University of York, UK. 

This definition is widely accepted within the safety critical systems community. Safety case can be considered as a special case of the trust case where focus is on a specific trust objective, i.e., safety, and highly demanding requirements are needed to be met by the base supporting the case. 

A strong assurance component is typical for safety cases of safety critical systems. 

Keywords safety security dependability safety-critical systems ... 

The conclusion was to add separate clauses into IEC 61508 everywhere where security could have an impact on safety giving advice on how to integrate the security aspect as an additional hazard (risk) for the safety-critical system, i.e., to look at the safety impact of security breaches and then... 

Unfortunately, the gap has not been spanned by these approaches. As far as I know, only JRC Ispra has once financed a project of EWICS TC7 (European Workshop on Industrial Computer Systems, TC7, Safety, Reliability and Security, an expert group in this area), on Study of the Applicability of ISO/IEC 17799 and the German Baseline Protection Manual to the needs of safety critical systems (March 2003)(www.ewics.org) (3), where the gaps between the security standards and the safety-related system evaluation requirements have been analyzed for several sectors (medical, railways, nuclear, electric power networks) and in general. 

Is this a safety view only The following chapter will provide some insight in the proposed unified approach to dependability of safety - critical systems, taking security into account. 

Z. Zurakowski, A Study of the Applicability of ISO/IEC 17799 and the German Baseline Protection Manual to the Needs of Safety Critical Systems, Final Report, March 2003, on work carried out for JRC ISPRA under contract N° 20215-2002-12 F1EI ISP GB., 268 pages, (www.ewics.org)... 

Involve the plant inspection group to witness and recommend procedures in all repairs such as major piping replacements in safety critical containment systems. Their safety critical systems included high temperature, high pressure, and highly corrosive applications. 

First, safety critical systems must be reliable. These systems control releases in the event of accidents. It s necessary to have a critical analyzer, instrument and electrical system test program. This should consist of preventive maintenance and alarm and trip device testing for panel alarms, emergency isolation valves and other critical components. [7]... 

Also, procedures must be in place to control defeating safety critical systems. Before taking these systems out of service for any length of time, there must be proper authority, communication and detailed contingency planning. 

Safety critical systems are classified into three classes. [8] (These classes have been defined in Chapter 10, but are repeated here.)... 

A Safe Operating Procedure developed to create a uniform method to ensure that appropriate steps are taken prior to bypassing or removing an alarm, instrument, or shutdown system IWim service is described in the section that follows. This procedure can provide an effective way of communicating the status of an impaired instrument. The procedure has been in use for over five years. It assumes that all instrumentation has been classified into three safety critical systems. [7] (These classes have been defined in Chapter 9, but are repeated here.)... 

Three levels of risk are suggested here (low, medium, and high) although some pharmaceutical and healthcare companies may like to consider five levels of risk to match the system integrity levels defined by lEC/ISO 61508 for safety critical systems. Each system should be rated against a number of weighted risk factors to determine an overall level of risk. Seven example risk factors are considered in Table 14.4 ... 

The committee s analyses of past chemical events at Johnston Atoll Chemical Agent Disposal System (JACADS) and Tooele Chemical Disposal Facility (TOCDF) indicate that the cansal factors are similar to those associated with breakdowns of other safety-critical systems. Release of chemical agent may be triggered by equipment design flaws and failures, by procedural deficiencies, and by human actions—i.e., by both latent and active failures (see Chapter 2). 

Bibb B. The medical device risk management stemdaid - an update. Safety-Critical Systems Club - Newsletter. 2005 14(3). 

Penny 1, Eaton A, Bishop P, Bloomfield R. The practicalities of goal-based safety. Proceedings of the Ninth Safety-Critical Systems Symposium Bristol, UK, 6-8 Feb 2001. Springer, 2001 ISBN 1-85233-411-8 2001. p. 35-48. 

Menon C, Hawkins R, McDermid J. Defence Standard 00-56 Issue 4 towards evidence-based safety standards. Safety-critical systems problems, process and practice. York, UK 2009. p. 223-43. 

I wrote this book to fill a gap. There is much in the literature about patient safety, medical informatics and the engineering of safety critical systems, but outside of medical device regulation little is said about how we manufacture and implement Health IT safely. In this book I have attempted to consolidate what the industry has learnt over a 10-15-year period. As technologies and techniques evolve it is clear that this is just the start of an exciting journey, the birth of an academic discipline which brings together learnings from many disparate sources. 

In summary, process models play an important role (1) in understanding why accidents occur and why humans provide inadequate control over safety-critical systems and (2) in designing safer systems. 

For safety-critical systems, constraints should be further separated into safety-related and not safety-related. One nonsafety constraint identified for TCAS, for example, was that requirements for new hardware and equipment on the aircraft be minimized or the airlines would not be able to afford this new collision avoidance system. Examples of nonsafety constraints for TCAS II are ... 

---