A Methodology for Safety Case Development

Bishop, Peter; Bloomfield, Robin

doi:10.1007/978-1-4471-1534-2_14

Cited by 174 publications

(117 citation statements)

References 0 publications

Supporting

Mentioning

117

Contrasting

Order By: Relevance

“…It is therefore necessary to develop them into subclaims until the final nodes of the assessment can be directly supported (or refuted) with evidence. The basic concepts of CAE are supported by an international standard [3] and industry guidance [4]. A recent comprehensive review [15,16]and analysis of assurance cases is provided by John Rushby in [14].…”

Section: Resultsmentioning

confidence: 99%

“…We have used the Claims, Argument, Evidence (CAE) framework (See summary in Table 1 and [3][4]) to analyse the impact of security on a safety justification or safety cases and we found that a 1 We use the term "safety systems" to cover all of these categories 2 significant portion of a security-informed safety case will need to change to address security explicitly [2]. In some instances this will lead to substantial changes to the design, the implementation process and the justification.…”

Section: Impact On Safety Of Cybermentioning

confidence: 99%

See 1 more Smart Citation

Security-Informed Safety

Netkachova

Bloomfield

2016

Computer

View full text Add to dashboard Cite

This is the accepted version of the paper.This version of the publication may differ from the final published version. Society relies on the safe functioning of computer based networks and systems whether it is in transportation, in energy production, banking or in medical devices. In some sectors, notably high hazard ones, achieving and assuring safety is a relatively mature undertaking -although of course we must not be complacent [20,21]. The advent of cyber issues brings enormous challenges and changes to the traditional engineering tempo and approach. This is exacerbated by the increasing sophistication of attackers, the commoditisation of low-end attacks, the increasing vulnerabilities of digital systems as well as their connectivity -both designed and inadvertent. In our research and practice we have been considering the impact of cyber issues on safety critical and safety related computer systems 1 . This article shares some of the issues and lessons learned. Permanent repository link

show abstract

Section: Resultsmentioning

confidence: 99%

Section: Impact On Safety Of Cybermentioning

confidence: 99%

Security-Informed Safety

Netkachova

Bloomfield

2016

Computer

View full text Add to dashboard Cite

show abstract

“…Another approach to certification is the development of safety cases [20], where the system developers are required to explicitly state the system's safety claims, arguments, and evidence. In contrast to the standards-based approach, the safety case approach is more flexible as it allows the developer to customize and fine-tune the methods used to support the safety claims.…”

Section: Real-time and Safety-critical Systemsmentioning

confidence: 99%

Safety‐critical Java for embedded systems

Schoeberl

Dalsgaard

Hansen

et al. 2016

Concurrency and Computation

View full text Add to dashboard Cite

Phone +45 4525 3351 compute@compute.dtu.dk www.compute.dtu.dk IMM-PhD-2014-340 Summary (English) Safety-critical systems are real-time systems whose failure can have severe or catastrophic consequences, possibly endangering human life. Many safety-critical systems incorporate embedded computers used to control different tasks. Software running on safety-critical systems needs to be certified before its deployment and the most time-consuming step of this process is the testing and verification phase. Due to the increasing complexity in safety-critical systems there is a need for new technologies that can facilitate testing and verification activities.The safety-critical specification for Java aims at providing a reduced set of the Java programming language that can be used for systems that need to be certified at the highest levels of criticality. Safety-critical Java (SCJ) restricts how a developer can structure an application by providing a specific programming model and by restricting the set of methods and libraries that can be used. Furthermore, its memory model do not use a garbage-collected heap but scoped memories.In this thesis we examine the use of the SCJ specification through an implementation in a time-predictable, FPGA-based Java processor. The specification is now in a mature state and with our implementation we have proved its feasibility in an embedded platform. Moreover, we have explored how simple hardware extensions can reduce the execution time of time-critical operations required by the SCJ specification.The scoped memory model used in SCJ is perhaps one of its most difficult features to use correctly. Therefore, in this work we have also studied practical aspects of its usage by developing scoped memory use patterns and reusable libraries aiming at facilitating the development of complex software systems.ii Summary (Danish)Sikkerhedskritiske systemer er realtidssystemer. Hvis sådanne systemer fejler, kan det have alvorlige eller katastrofale konsekvenser, muligvis livsfarlige konsekvenser. Mange sikkerhedskritiske systemer inkorporerer embeddede computere, som bruges til at kontrollere forskellige opgaver. Software, som kører på sikkerhedskritiske systemer, skal certificeres, før softwaren udrulles, og det mest tidskraevende skridt i denne proces er test-og verifikationsfasen. På grund af den stigende kompleksitet i sikkerhedskritiske systemer er der behov for nye teknologier til at facilitere test-og verifikationsaktiviteter.Den sikkerhedskritiske specifikation for Java har til formål at levere en reduceret udgave af Java-programmeringssproget, som kan bruges til systemer, der skal kunne certificeres på de højeste kritikalitetsniveauer. Safety Critical Java (SCJ) begraenser, hvordan en udvikler kan strukturere en applikation, ved at levere en specifik programmeringsmodel og ved at begraense de metoder og biblioteker, som kan anvendes. Derudover benytter hukommelsesmodellen i SCJ ikke en heap, der er garbage-collected, men afgraensede hukommelser.I denne afhandling undersøger vi brugen a...

show abstract

“…This mode of application contemplates code applications that resemble the classical safety analysis [5] ("Safety Analysis Report" Chapter 15) applications of RELAP-5. The limiting case of a design-basis accident is analyzed with the traditional conservatisms, and satisfaction of regulatory acceptance criteria is demonstrated based on the point value results.…”

Section: Conservative Modementioning

confidence: 99%

Integrating Safety Assessment Methods using the Risk Informed Safety Margins Characterization (RISMC) Approach

Smith

Mandelli

2013

View full text Add to dashboard Cite

INTRODUCTIONSafety is central to the design, licensing, operation, and economics of nuclear power plants (NPPs). As the current light water reactor (LWR) NPPs age beyond 60 years, there are possibilities for increased frequency of system structure and component (SSC) failures that initiate safety-significant events, reduce existing accident mitigation capabilities, or create new failure modes.Plant designers commonly "over-design" portions of NPPs and provide robustness in the form of redundant and diverse engineered safety features to ensure that, even in the case of well-beyond design basis scenarios, public health and safety will be protected with a very high degree of assurance. This form of defense-in-depth is a reasoned response to uncertainties and is often referred to generically as "safety margin." Historically, specific safety margin provisions have been formulated, primarily based on "engineering judgment".The ability to better characterize and quantify safety margin [1] holds the key to improved decision making about LWR design, operation, and plant life extension. In a sense, contemplation of LWR operation beyond 60 years does represent a kind of "extended design basis" operation. A systematic approach to characterization of safety margins represents a vital input to the licensee and regulatory analysis and decision making that will be involved. In addition, as R&D in the LWR Sustainability Program [2] and other collaborative efforts yield new data and improved scientific understanding of physical processes that govern the aging and degradation of plant SSCs (and concurrently support technological advances in nuclear reactor fuels and plant instrumentation and control systems) needs and opportunities to better optimize plant safety and performance will become known. This interaction of degradation understanding and potential impacts to plant margins is shown in Fig. 1.To successfully understand safety margins, the Risk Informed Safety Margins Characterization (RISMC) Pathway [2] will clearly define and demonstrate the safety margin approach. The determination of the degree of a safety margin requires an understanding of risk-based scenarios. Within a scenario, an integration of plant behavior (i.e., operational rules such as technical specifications, operator behavior, and SSC status) and associated uncertainty will be required to interface with a systems code. Then, to characterize safety margin for a specific performance metric of consideration (e.g., peak clad temperature), the integrated plant simulation will determine time and scenario-dependent outcomes for both the load and capacity. Specifically, the safety margin approach will use the physics-based plant results (the "load") and contrast these to the capacity (for the associated performance metric) to determine if safety margins have been exceeded (or not) for a family of accident scenarios.

show abstract

A Methodology for Safety Case Development

Cited by 174 publications

References 0 publications

Security-Informed Safety

Security-Informed Safety

Safety‐critical Java for embedded systems

Integrating Safety Assessment Methods using the Risk Informed Safety Margins Characterization (RISMC) Approach

Contact Info

Product

Resources

About