NCAF_May03.ppt Slide - 1 CSE International Ltd Data Integrity: The use of data by safety-related...
-
Upload
douglas-rodgers -
Category
Documents
-
view
212 -
download
0
Transcript of NCAF_May03.ppt Slide - 1 CSE International Ltd Data Integrity: The use of data by safety-related...
NCAF_May03.pptSlide - 1
CSE International LtdCSE International LtdCSE International LtdCSE International Ltd
Data Integrity: The use of data by
safety-related systems
Alastair Faulkner CEngCSE International Ltd
Tel: +44 (0)1724 862169
email: [email protected]
NCAF_May03.pptSlide - 2
ContentsContentsContentsContents
• Brief introduction• Introduction to safety• Data integrity• Data provision• Data origination• Conclusions
NCAF_May03.pptSlide - 3
Safety-related systemsSafety-related systemsSafety-related systemsSafety-related systems
NCAF_May03.pptSlide - 4
Brief introductionBrief introductionBrief introductionBrief introduction
• Safety concepts• Hazard, opportunity, accident• Risk, Risk reduction• Generalised safety process
NCAF_May03.pptSlide - 6
Error – Fault - FailureError – Fault - FailureError – Fault - FailureError – Fault - Failure
[Engineering Safety Management: Yellow Book 3][Engineering Safety Management: Yellow Book 3]
Hazard
Causal Factors
Control System
Error: "A discrepancy betweena computed, observed ormeasured value or conditionand the true, specified ortheoretically correct value orcondition"
Fault: "An abnormal conditionthat may cause a reduction in,or loss of, the capability of afunctional unit to perform arequired function"
Failure: "The termination of theability of a functional unit toperform a required function"
hazard is "a situation in whichthere is actual or potential harmto human life or limb, or to theenvironment"
NCAF_May03.pptSlide - 7
Hazard, opportunity, accidentHazard, opportunity, accidentHazard, opportunity, accidentHazard, opportunity, accident
Hazard AAND
Causal Factors
Accident Trigger
System A
Opportunity
System Environment
Hazard B
System B
Accident
[Engineering Safety Management: Yellow Book 3][Engineering Safety Management: Yellow Book 3]
NCAF_May03.pptSlide - 8
Innovation: First powered flightInnovation: First powered flightInnovation: First powered flightInnovation: First powered flight
NCAF_May03.pptSlide - 9
Trees- A hazard to navigationTrees- A hazard to navigationTrees- A hazard to navigationTrees- A hazard to navigation
NCAF_May03.pptSlide - 10
Risk and ALARPRisk and ALARPRisk and ALARPRisk and ALARP
High risk of death orserious injury etc
Risk to be ALARPand only for benefit
Negligible risk ofdeath or serious
injury etcAcceptable
Tolerable
Intolerable
Reducingrisk
[HSE: [HSE: Reducing Risks, Protecting PeopleReducing Risks, Protecting People]]
NCAF_May03.pptSlide - 11
Risk reductionRisk reductionRisk reductionRisk reduction
Partial risk coveredby other technology
safety-relatedsystems
ResidualRisk
TolerableRisk
EUCRisk
Necessary Risk Reduction
Actual Risk Reduction
Partial risk coveredby E/E/PE safety-related systems
Partial risk coveredby external risk
reduction facilities
Risk reduction achieved by all safety-relatedsystems and exrernal risk reduction facilities
[IEC 61508-5][IEC 61508-5]
NCAF_May03.pptSlide - 12
Example risk classification matrixExample risk classification matrixExample risk classification matrixExample risk classification matrix
Catastrophic NegligibleMarginalCritical
Frequent
Incredible
Improbable
Remote
Occasional
Probable
Frequency Consequence
I
II
III
IV
I
II
II II
II
II
III III
IIIIII
III
III
IV
IV
IV
IV IV
IV
Risk = function (Severity, Likelihood)
NCAF_May03.pptSlide - 13
Generalised safety processGeneralised safety processGeneralised safety processGeneralised safety process
• List system functions (operational requirements)• Find out how they can go wrong
– Functional Hazard Analysis
• Calculate tolerable failure rates (safety requirements) – consequence analysis to assess mitigation
• Design system to meet safety requirements• Show that system will meet safety requirements
– provide safety arguments and evidence in safety case
• Maintain safe operation
NCAF_May03.pptSlide - 14
Data integrityData integrityData integrityData integrity
• Data in air navigation• Data integrity• Data provision
NCAF_May03.pptSlide - 15
Air NavigationAir NavigationAir NavigationAir Navigation
NCAF_May03.pptSlide - 16
Problem descriptionProblem descriptionProblem descriptionProblem description
• The use of data by safety-related systems is becoming more common.
• In such systems data is often a significant (if not the major) component
• Data is not commonly treated as a separate system component and hence is largely ignored.
• Safety of the system may rely on the correctness of the data
NCAF_May03.pptSlide - 17
Data-driven systemsData-driven systemsData-driven systemsData-driven systems
• The data used by a data-driven system may have extensive influence over both the normal and abnormal behaviour of the system
• Typical examples of large-scale data-driven systems are transportation control systems. These systems use several different types of data – Static configuration data– Instantaneous status information– Operational information– Command Schedule – Timetable
NCAF_May03.pptSlide - 18
Data integrity requirementsData integrity requirementsData integrity requirementsData integrity requirements
• Hazard and risk analysis process are used to establish system integrity requirements
• These requirements are then apportioned between components of the design, including people, process, hardware, software and data components of the system.
• The integrity requirements apportioned to the data component of the system are termed in this presentation ‘data integrity requirements’.
NCAF_May03.pptSlide - 19
Apportionment of ‘error budget’Apportionment of ‘error budget’Apportionment of ‘error budget’Apportionment of ‘error budget’
20 %
20 %
20 %20 %
20 %
Data ~20%
Hardware
Software
Data
Process
People
4 ³ 10-9 to < 10-8 ³ 10-5 to < 10-43 ³ 10-8 to < 10-7 ³ 10-4 to < 10-32 ³ 10-7 to < 10-6 ³ 10-3 to < 10-21 ³ 10-6 to < 10-5 ³ 10-2 to < 10-1
SILHigh demand or continuous mode
(Probability of adangerous failure per hour)Low demand mode
(Probability of failure on demand)
Table 1. Target failure rates for systems of different safety integrity levels from IEC 61508
[IEC 61508][IEC 61508]
NCAF_May03.pptSlide - 22
A question of scale?A question of scale?A question of scale?A question of scale?
“Things get bigger and bigger, pushing the boundaries,
until you’ve had a change of scale”
Peter Elliott BP, Keynote Speaker ESAS-02
NCAF_May03.pptSlide - 23
Layer modelLayer modelLayer modelLayer model
Enterprise
Plant Interface
Reflex
Supervisory
Optimising
Business Unit
Plant
NCAF_May03.pptSlide - 24
WorkstationWorkstationWorkstationWorkstation
PlantInterface
Reflex
Supervisory
Plant
PlantInterface
PlantInterface
Reflex
Plant
PlantInterface
NCAF_May03.pptSlide - 25
Vertical couplingVertical couplingVertical couplingVertical coupling
Plant Interface
Reflex
Supervisory
Plant
NCAF_May03.pptSlide - 26
Horizontal couplingHorizontal couplingHorizontal couplingHorizontal coupling
Plant Interface
Reflex
Supervisory
Plant
Plant Interface
Reflex
Supervisory
Plant
NCAF_May03.pptSlide - 27
Design – Control SystemDesign – Control SystemDesign – Control SystemDesign – Control System
Enterprise
PlantInterface
Reflex
Supervisory
Optimising
Business Unit
Plant
PlantInterface
PlantInterface
Reflex
Plant
PlantInterface
PlantInterface
Reflex
Optimising
Business Unit
Plant
PlantInterface
PlantInterface
Reflex
Supervisory
Plant
PlantInterface
1
2
3
4
5
6
1
2
3
4
5
6
NCAF_May03.pptSlide - 28
Design – Interface considerationsDesign – Interface considerationsDesign – Interface considerationsDesign – Interface considerations
DTU
DTU
DTU
DTU
DTU
DTU
DTU
DTU
DTU
DTU
Layer N+1
Layer N
Layer N-1
DAP
DAP
NCAF_May03.pptSlide - 29
Data QualityData QualityData QualityData Quality
• DO 200A identifies a number of ‘data quality’ criteria • the accuracy of the data
• the resolution of the data
• the confidence that the data is not corrupted while stored or in transit (assurance level)
• the ability to determine the origin of the data (traceability)
• the level of confidence that the data is applicable to the period of (its) intended use (timeliness)
• all of the data needed to support the function is provided (completeness)
• the format of the data meets the users requirements
NCAF_May03.pptSlide - 30
Data developmentData developmentData developmentData development
• In data-driven systems the data is often developed separately from the software
• However, it is clearly an integral part of the system– Safety of the overall system will normally depend on the
correctness of the data– Presumably the SIL of the data will be similar to that of the
executable software– One would expect similar levels of rigour
NCAF_May03.pptSlide - 31
Data ownershipData ownershipData ownershipData ownership
• Ownership may itself be a complex issue as data may originate from within a number of organisational and political bodies and include any consolidations required to produce a higher data abstraction.
• Organisational responsibilities are not only concerned with the supply of data, but also the ownership and in some cases the liabilities associated data errors.
• Ownership may also be passed across the data supply chain.
NCAF_May03.pptSlide - 32
Data ProvisionData ProvisionData ProvisionData Provision
• Data provision is dependant upon the integrity of the data source
• Data provision has two main components– Data source (Either data production or Origination)– Data supply chain
NCAF_May03.pptSlide - 33
Integrity of the data sourceIntegrity of the data sourceIntegrity of the data sourceIntegrity of the data source
• Data may be produced by a number of means, from simple data entry to complex and diverse automated toolsets.
• The integrity of the data origin will be a significant influence upon the integrity required from the supply chain.
• Low integrity at the data source may render the source unusable.
• All data of a particular type may not be provided from a single source
NCAF_May03.pptSlide - 34
Data productionData productionData productionData production
• Small-scale systems may use data entry to create a validated dataset.
• As the scale and volume of data increases the nature of the data required changes.
• Data production may require vertical or horizontal datasets (or a combination of both)
• Data production may consider data extracted from enabling products such as middleware or data mining or data warehouses.
NCAF_May03.pptSlide - 35
Data supply chainData supply chainData supply chainData supply chain
• Properties required from a data supply chain– Origination (data of suitable integrity) - Identifies a point at
which the data originates– Data then progresses across a series of elements such as
transmission, preparation, formatting and finally consumed by the data-driven system.
– Each element will not be perfect and therefore, each element in the chain may introduce error of faults.
• Data supply chain errors must be less than the data integrity requirements for the safe operation of the system
NCAF_May03.pptSlide - 36
Buildings: A hazard to navigationBuildings: A hazard to navigationBuildings: A hazard to navigationBuildings: A hazard to navigation
NCAF_May03.pptSlide - 37
ConclusionsConclusionsConclusionsConclusions
• The safe operation of the data-driven system is likely to depend upon the correctness of the data
• However, data and its production, use and maintenance rarely are treated as the subject of integrity requirements
• All too often – data is not subject to any systematic hazard or risk analysis– data is poorly structured, making errors more likely to be
produced, and more difficult to detect– data is not subjected to any form of verification
NCAF_May03.pptSlide - 38
A final quoteA final quoteA final quoteA final quote
“You would think that before they let people use these systems,
they'd ensure they're safe”
Hiram K. Hackenbacker (Brains) International Rescue,
Thunderbirds 1966 (1972 in UK)