1
Download SafEty and Risk Evaluation using bayesian NEts
Transcript
SERENE Method Manual Version 1.0 (F) May 1999 Risk Reduction: General Concepts Actual Actual remaining remaining risk risk Risk to meet required Level of Safety Equipment Under Control risk Necessary minimum risk reduction Partial risk covered Partial risk covered by by Other Technology Electrical / Electronic / Safety-Related Programmable Electronic Systems Safety Related Systems Increasing risk Partial risk covered by External Risk Reduction Facilities Risk reduction achieved by all Safety-Related Systems and External Risk Reduction Facilities Figure 7-4: Risk Reduction Although the use of risk assessment is required in IEC 61508 and is widespread, both variations and alternatives exist. For example, a risk based approach is followed in Civil Aviation, but within more restricted parameters. For civil avionics software developed to RTCA DO-178B, frequency of failure is not considered, only severity. For civil avionics systems, risk targets are specified for aircraft-level functions. A simplified risk assessment framework is also proposed in the MISRA Guidelines (MISRA, 1994). The SERENE Method can be applied to these variations of risk assessment, since they are based on a requirement to predict system properties. 7.4 7.4.1 Safety Principles Principles to determine acceptability of risk The concepts of risk assessment and risk reduction do not determine the level of risk that is acceptable. We mention here three principles that are used to determine the acceptability of risk: ALARP GAMAB MEM Country UK France Germany Meaning As low as reasonably practicable Globalement au moins aussi bon Minimum endogenous mortality These principles are similar, but not identical. Typically, the principles are determined by regulations or legislation, not by the standards. The draft IEC 61508 contains guidance material on the ALARP principle, but it is not normative. A safety argument represented using the SERENE Method cannot determine the acceptability of risk: this is a concern of decision making. The safety argument provides input to the decision making process. However, provided that the system property predicted by the SERENE safety argument is chosen appropriately, the SERENE Method can be applied whichever safety principle is applied. 7.4.2 The ALARP Principle The requirement for the operation of safety-related systems is that the level of risk associated with their deployment must be either acceptable, or tolerable and As Low As Reasonably Practicable (ALARP). SERENE 22187 ESPRIT Framework IV Information Technology Programme Task 1.7 Page 115 of 200
