Top level hazard

Every top-level hazardous event has been initiated by a physicochemical reaction. 

In the previous section we discussed how an inductive approach can be used to generate all the chemical reaction pathways and the associated thermodynamic states, which lead to top-level hazardous events. A potential hazard is said to exist when the thermodynamic state or sequence of thermodynamic states leading to the hazard cannot be prevented, or the... 

Hazard identification. What range of hazards must be considered in order to be able to compare safety between two different schemes What will we treat as the top-level hazards ... 

A question closely related to that of defining the system boundary is the question of what should be regarded as the top-level hazards. 

When carrying out hazard identification, choices are often encountered as to what should be regarded as the top-level hazards. For example, consider an accident where a speeding driver runs into the back of another vehicle, causing serious injuries. What do we regard as the hazard Here are some candidates that might be... 

Vehicle travels too fast for prevailing road conditions, i.e. the point at which driver behaviour deviates from the ideal. This was the level that we chose to adopt as the top-level hazard. The number of causes is generally manageable, and the possible risk reduction measures are more obvious. More importantly, it enables us to highlight the differences between hazards that apply to the baseline and those that apply to ATM. 

The method must be applicable to the broad range of top-level hazards encountered on a motorway... 

Carry out hazard identification for both the baseline and ATM versions of the motorway. Define the top-level hazards such that they cover all significant sources of risk, that there is minimal overlap between them and such that there is... 

Fault Tree Analysis (FTA) is a well known and widely used safety tool, implementing a deductive, top down approach. It starts with a top level hazard, which has to be known in advance and "works the way down" through all causal factors of this hazard, combined with Boolean Logic (mainly AND and OR gates). It can consider hardware, software and human errors and identifies both single and multiple points of failure. Both a quantitative and qualitative analysis is possible. 

The use of fault-tree analysis, fw example, formalises parts of the safety argument A fault tree is a chain of assotions that proves that the top-level hazardous event cannot occur if particular combinations of underlying hazardous evoits are known not to be credible or possible. The production of a ftxmal proof is motivated by the same needs. However, in the case of formal proof, the complexities of the events concerned, and their impact in combination, can be subject to more thorough and rigorous analysis. 

These functions are the basis for the Functional Hazard Assessment (FHA), for the identification of possible hazards. In workshops with experts - to combine technical, domain and safety know-how - various techniques are applied. This includes brainstorming, use of historical data and functional failure modes and effects analysis to identrfy possible failure modes, their operational effects and the respective severity of the worst credible outcome. Based on the safety-relevant failure modes, potential hazards are determined and respective risks are allocated according to the risk matrix. The FHA leads to derivation of top level hazards. 

When software is included in fault trees, the relationship between the top level hazards and specific software anomalous behaviours should be clearly established. It is important to explicitly identify the affected functions and to identify how the specified intended functions are affected. 

Wastes have been classified for decades for a variety of purposes. This Section discusses the historical development of classification systems for radioactive and hazardous chemical wastes and the resulting classification systems in use at the present time. The relationship between waste classification and requirements for disposal of different classes of hazardous waste is emphasized. The framework for this discussion is the top-level system for waste classification in the United States shown in Figure 4.1. Within this framework, it is first determined whether a waste is nonhazardous (e.g., municipal waste) these wastes are not addressed in this Report. If a waste is deemed hazardous, it is so classified due to the presence of radionuclides or hazardous chemicals. Mixed radioactive and hazardous chemical waste is not a separate class of waste. However, mixed waste has been an important concern as a result of differences in requirements for management and disposal of radioactive and hazardous chemical wastes. Section 4.1 addresses classification and disposal of radioactive waste, and is followed by discussions of classification and disposal of hazardous chemical waste in Section 4.2 and approaches to management of mixed radioactive and hazardous chemical waste in Section 4.3. Finally, Section 4.4 summarizes previous NCRP recommendations relevant to waste classification. 

We now establish the criterion for completeness for any hazard identification methodology. [Herein, completeness refers to the ability of a methodology to identify all possible top-level events (Nagel, 1991.)] The methodology presented establishes how we use this criterion to completely and systematically identify hazards in an efficient manner. 

As a result, we have focused on the interpretation of the pathway leading to a hazardous state and its topography, and how these relate to the inherent safety of the process design technology rather than on the elucidation of pathways leading to top-level events. In the absence of a methodology for the complete identification of all conditions enabling the occurrence of a TLE, such an approach is essential if the safety of a chemical operation is to be enhanced. 

The strategy we use for the specification of the most attractive hazards-preventive control objectives is based on closeness, i.e., hazards-preventing control objectives, which affect a variable that is at a minimum distance from the top-level event is preferred over those that affect more distant variables. However, the point on the variable-influence path, where the actual manipulation (e.g., design modification, controller or safety device) takes place, remains unspecified it depends on whether the origin, type and intensity of disturbances are known ahead of time or not. 

Injury and illness prevention programs are based on proven managerial concepts that have been widely used in industry to bring about improvements in quality, environment and safety, and health performance. Effective injury and illness prevention programs emphasize top-level ownership of the program, participation by employees, and a find and fix approach to workplace hazards. 

Shein divides culture into three levels (figure 13.2) [188]. At the top are the surface-level cultural artifacts or routine aspects of everyday practice including hazard analyses and control algorithms and procedures. The second, middle level is the stated organizational rules, values, and practices that are used to create the top-level artifacts, such as safety policy, standards, and guidelines. At the lowest level is the often invisible but pervasive underlying deep cultural operating assumptions... 

The inexperienced practitioner can easily enter into too mnch detail too soon (e.g. it is often more efficient to stop the argnment at a solntion, which contains a Compliance Matrix or an FTA, than to hy to replicate these within the GSN). Therefore, the assessor may elect to restrain GSN to a top-level argiunent only and not to repeat each finding which exist in tabular format (e.g. such as in a Fnnctional Hazard Assessment)... 

Articulates S/W contribution to selected top-level failure modes, usually a hazardous output condition of the S/W. 

Fault tree analysis is used primarily as a tool for conducting system or subsystem hazard analyses, even though qualitative or top-level (that is, limited number of tiers or detail) analyses may be used in performing preliminary hazard analyses. Generally, FTA is used to analyze failure of critical items (as determined by a failure mode and effects analysis or other hazard analysis) and other undesirable events capable of producing catastrophic (or otherwise unacceptable) losses. 

SHOLIS (Chapman, 2000) is a software-based system that advises ship s crew on the safety of helicopter operations under various scenarios. The software was developed in accordance with DEF STAN 00-55 (Issue 2). A software hazard analysis was performed and on this basis certain parts of the software were designated as safety-critical. Safety critical software was formally specified using Z, developed in Spark Ada, and a partial correctness performed of the code against the specification. Information Flow analysis was used to demonstrate functional separation of critical and non-critical software. Freedom from run-time exceptions was demonstrated for all code. Static analysis of I/O usage, memory and timing was used to show separation of non-functional properties. Finally, proof that the system s top-level safety properties were maintained by the software was carried out. 

---