System Safety Assessment process

A-2 Derived high-level requirements are defined and provided to the system processes, including the system safety assessment process. O o o o SAV Requirements Data 11.9 ... 

System Safety Assessment process to mitigate crew errors... 

Any software or hardware providing partitioning should be assessed by the system safety assessment process to ensure that it does not adversely affect safety. 

DO-178B requires that derived requirements be provided to the system safety assessment process. Some committee members were concerned that some requirements that should have been provided to the system safety assessment process were not, because they had been traced to higher-level requirements, however... 

The entire safety assessment process that supports new product research and development is a multistage effort in which none of the individual steps is overwhelmingly complex, but for which the integration of the whole process involves fitting together a large and complex pattern of pieces. This paper proposes an approach in which integration of in vitro test systems calls for a modification of... 

A scientific approach to safety assessment, such as the one presented in this chapter, does have proponents and adherents. Such an approach requires those involved in both the management and conduct of the safety assessment process to continually question (and test) both the efficacy and the validity of their evaluation systems and processes. More to the point, it requires recognition of the fact that we have always done it this way is not a reason for continuing to do so. This approach asks first what is the objective behind the testing, and then it asks how well our testing is meeting this objective. 

The notion that demonstrating that a system has undergone a safety assessment process is as important as actually achieving safety. 

ARP4761 - Guidelines and methods for conducting the safety assessment process on civil airborne systems and equipment - 1996 - 4.2 and annex G... 

The FHA is undertaken at the beginning of the aircraft/system development life cycle, it is the first step in a safety assessment process that is performed on both new and modified aircraft programs. 

SAE ARP4761, 1996. Guidelines and Methods for Conducting the Safety Assessment Process on Civil Airborne Systems and Equipment. 

At this point the author of the PRA must ensure visibility of these recommendations to all relevant stakeholders. Consideration needs to be given to issuing the first draft of the PRA as early as possible, especially if the output influences the requirements management process (see Fig. 1.3). This may take the form of a stand-alone report or may be contained within any interim updates of the System Safety Assessment (i.e. PSSA is the first issue, SSA is the final issue, with as many ISSAs as required to keep track with the evolving design and maturing System Safety Assessment). 

Safety Assessment process, which drives the DAL allocation and the required derived system behaviours. 

Again, we have a clear equivalence in the Safety Case. It would not be sufficient to claim that because we have carried out a safety assessment of system A in accordance with procedure XYZ then system A must be safe. Rather, we must present arguments and evidence that the products (results) of the safety assessment actually show that system A is safe and use evidence about the safety assessment process to give increased confidence in the main evidence. 

The FHA and PSSA stages of the EUROCONTROL Air Navigation System Safety Assessment Methodology (EUROCONTROL 2004a) provides an appropriate and sound process for the determination of ATM Safety Requirements - demonstration of adherence to the FHA and PSSA processes could therefore be used as Backing Evidence as in the first bullet point above. 

Safety standards acknowledge the economic need to employ previously developed systems, functions and components [12] [13] [14] [15]. In civil aerospace for example, systems may be reused across different aircraft types, without the need for additional assessment, provided that evidence of similar design, installation, application and operation can be produced [15]. Otherwise, the safety assessment process should be performed to examine the impact of the reusable systems on the aircraft functions. Also in civil aerospace, particularly for airborne software, the American Federal Aviation Administration (FAA) created an Advisory Circular (AC), offering means to satisfy the requirements of the aerospace software guidance DO-178B regarding the use of reusable software components [16]. 

At least one functional safety assessment should be performed on each system, typically at the design stage before the system is commissioned. The functional safety assessment process should be performed by an assessment team which includes at least one competent person independent of the project design team. A functional safety assessment should be performed and revalidated after any modifications, mal-operation or failure to deliver the required safety function (a spurious trip which caused the safety system to action its functions successtully would not... 

Based on a number of identified similarities of the safety standards in the transportation sector, [7] already outlines a generic safety assessment process integrated into a concrete system development process. However, only safety standards from the transportation domain are analyzed and recent developments... 

On this basis, the further course of the project on the site can be divided into steps according to the progress of work. In these steps, the construction and erection of individual technical items (buildings, systems, components, etc.) are licensed after respective safety assessment processes, and the "preliminary positive overall appraisal" is developed further until the last licensing step, namely operation, by which time the appraisal is finalised. 

Apart from implementing existing guidance as part of the system safety management process framework, the author identified that further research was not required at this time to support the other areas assessed in this book. 

This publication establishes design requirements for stractures, systems and components important to safety that must be met for safe operation of a nnclear power plant, and for preventing or mitigating the consequences of events that could jeopardize safety. It also establishes requirements for a comprehensive safety assessment, which is carried out in order to identify the potential hazards that may arise from the operation of the plant, under the various plant states (operational states and accident conditions). The safety assessment process includes the complementary techniqnes of deterministic safety analysis and probabilistic safety analysis. These analyses necessitate consideration of postulated initiating events (PIEs), which include mat r factors that, singly or in combination, may affect safety and which may ... 

The term DAL comes from Radio Technical Commission for Aeronautics (RTCA)/DO-254, Design Assurance Guidance for Airborne Electronic Hardware, 2000. In this document hardware is classified into five levels based on a set of criteria for each level. The derived software level (SL) is based on the contribution of the software to potential failure conditions as determined by the system safety assessment (SSA) process. 

The DAL is an index number ranking the safety-criticality of the system functions. This ranking implies that in order to make the system safe, greater development rigor must be applied to each successively critical level. Table 2.3 correlates the hardware DALs to the five classes of failure conditions and provides definitions of hardware failure conditions and their respective DALs. Initially, the hardware DAL for each hardware function is determined by the SSA process using a functional hazard analysis (FHA) to identify potential hazards and then the preliminary system safety assessment (PSSA) process allocates the safety requirements and associated failure conditions to the function implemented in the hardware. 

SAE/ARP-4761, Guidehnes and Methods for Conducting the Safety Assessment Process on Civil Airborne Systems and Equipment, Appendix A—Functional Flazard Assessment, 1996, is a useful reference on FHA that is recommended by the FAA for use on civil aircraft systems. 

Having identified the appropriate risks with respect to the design under consideration, each risk should be the subject of a specific study to examine and document the simultaneous or cascading effect(s) of each risk. The objective is to ensure that any SR effects are either eliminated or the risk is shown to be acceptable. A particular risk assessment is required for aircraft airworthiness certification by the FAA the process is documented in SAE/ARP-4761, Guidelines and Methods for Conducting the Safety Assessment Process on Civil Airborne Systems and Equipment, 1996. 

---