Safety Arguments Research Articles

Introducing Goal Structuring Notation to Explain Decisions in Clinical Practice

Clinical reasoning is a key contributor to the quality of healthcare. Clinical decisions at the policy level are made within a stochastic domain; decisions for individuals are usually more qualitative. In both cases, poor reasoning could result in an undesirable outcome. Clinical decisions are most typically communicated in a document through free text. Text has significant limitations (particularly ambiguity and poor structuring) whether used for analysis, or to explain the decisionmaking process. In safety engineering, similar problems are faced in conveying safety arguments to support certification. As a result, approaches have been developed to conveying arguments in ways which improve communication and which are more amenable to analysis. Goal Structuring Notation (GSN) [12] -a graphical argumentation notation for safety -was developed for those reasons. It has evolved to be one of the most widely used techniques for representing safety arguments. The purpose of this paper is to investigate the feasibility of representing and communication clinical reasoning with GSN. Based on an example, we discuss the benefits and problems of adopting GSN and similar safety-inspired argumentation approaches in clinical decision-making.

2020 Foresight—a Systems-Engineering Approach to Assessing the Safety of the SESAR Operational Concept

This article explains why a new approach is needed for the safety assessment of the major operational and technology changes that are planned for introduction into European ATM up to 2020 and beyond. This approach has to satisfy two conditions: first, it has to be much broader than that traditionally followed in ATM in that it must address the positive contribution that a fully functioning ATM service makes to aviation safety and not just consider the negative effects that failures within the ATM system might have on the risk of an accident. Secondly, rather than rely simply on current, process-based safety-assessments, it must be based on a framework which, in accordance with European safety regulatory requirements, requires that “correct and complete arguments be established to demonstrate that the overall ATM System, as well it constituent parts, are (and will remain) tolerably safe”. The article presents the theoretical basis for satisfying these two conditions – it explains from first principles how current techniques such as Fault Tree Analysis can be adapted to model ATM’s positive, as well as negative, contribution to aviation safety, and describes how a rigorous safety argument can be derived from sound systems-engineering principles and be used to drive the whole safety assessment / assurance process. The article also gives an overview of how these principles were developed for application to the safety assessment of ATM development projects within the scope of SESAR – the Single European Skies ATM Research programme, equivalent to the US NextGen programme. This approach has already been applied by EUROCONTROL to a number of safety assessments including enabling projects for SESAR.

Argument Schemes in Computer System Safety Engineering

Safe Safety arguments are key components in a safety case. Too often, safety arguments are constructed without proper reasoning. To address this, we argue that informal logic argument schemes have important roles to play in safety argument construction and reviewing process. Ten commonly used reasoning schemes in computer system safety domain are proposed. The role of informal logic dialogue games in computer system safety arguments reviewing is also discussed and the intended work in this area is proposed. It is anticipated that this work will contribute toward the development of computer system safety arguments, and help to move forward the interplay between research in informal logic and research in computer system safety engineering.

Experimental versus theoretical robustness of rotating solutions in a parametrically excited pendulum: A dynamical integrity perspective

The objective of this paper is showing how global safety arguments can be fruitfully used to interpret experimental results of a pendulum parametrically excited by wave motion. In fact, the results of an experimental campaign developed with the aim of simulating sea-waves energy production by a parametric pendulum show that rotations exist in a region which is smaller than the theoretical one. This discrepancy can be partially attributed to the experimental approximations and constraints, but it has a deeper theoretical motivation. By comparing the experimental results with the dynamical integrity profiles we have found that experimental rotations exist only where a measure of dynamical integrity accounting for both attractor robustness and basin compactness is large enough, so that they can support experimental imperfections leading to changes in initial conditions.

Do safety cases have a role in aircraft certification?

Safety cases, as a means of demonstrating system safety, have been increasingly used as the basis for system assurance, especially in safety or mission-critical systems in fields such as offshore installation, railway operations, nuclear plants, and air traffic control. Despite the increased adoption of safety cases in the aforementioned areas, the usage of safety arguments is still limited in the certification of a civil aircraft design. This paper provides 1) a brief overview of the key regulations and guidelines in support of aero-system certification especially at the development stage; 2) a review of the history, the essence, and the practice of safety cases; 3) an analysis of the role of processes and safety arguments in aircraft certification; and 4) recommendations on the future work in terms of further application of safety cases in aircraft certification.

A certified framework for compiling and executing garbage-collected languages

We describe the design, implementation, and use of a machine-certified framework for correct compilation and execution of programs in garbage-collected languages. Our framework extends Leroy's Coq-certified Compcert compiler and Cminor intermediate language. We add: (i) a new intermediate language, GCminor, that includes primitives for allocating memory in a garbage-collected heap and for specifying GC roots; (ii) a precise, low-level specification for a Cminor library for garbage collection; and (iii) a proven semantics-preserving translation from GCminor to Cminor plus the GC library. GCminor neatly encapsulates the interface between mutator and collector code, while remaining simple and flexible enough to be used with a wide variety of source languages and collector styles. Front ends targeting GCminor can be implemented using any compiler technology and any desired degree of verification, including full semantics preservation, type preservation, or informal trust. As an example application of our framework, we describe a compiler for Haskell that translates the Glasgow Haskell Compiler's Core intermediate language to GCminor. To support a simple but useful memory safety argument for this compiler, the front end uses a novel combination of type preservation and runtime checks, which is of independent interest.

Impact assessment in the UK nuclear power industry: An overview of the R3 impact assessment procedure

The R3 Impact Assessment Procedure was developed by Magnox Electric Ltd and its predecessors with the prime intent of providing a compendium of methodologies for assessing the effect of dropping nuclear fuel flasks on steel and concrete surfaces. However, since then the intent of the procedure has broadened and as eventually released encompasses three volumes, namely: Volume 1 – missile production primarily arising from pressure boundary failure or rotating plant failure, jet and blast loading, global pressurisation. Volume 2 – whipping pipe motion following pipe failure. Volume 3 – target response – the response of concrete and steel structures to impact and the effect of pipe impact on pipes and beams. The procedure is firmly based on correlations derived from appropriate tests and does not, in general, rely on Finite Element analysis. The advantage of this approach is that it provides bounding results which frequently indicate that further, more advanced, analysis is not required. The procedure may be used as a filter to identify potential problems quickly. Where necessary, analysis methods can be refined in these areas to provide support to safety arguments. The paper presents an overview of the procedure with examples of applications.

Time to Reconsider Evidence for Anaemia Treatment (TREAT) = Essential Safety Arguments (ESA)

TREAT: A trial of darbepoietin alfa in type 2 diabetes and chronic kidney disease (ClinicalTrials.gov number NCT00093015), published recently by Marc Pfeffer and colleagues, may rank as one of the most important clinical trials in nephrology [1]. As well as being important, it was one of the largest, best conceived, designed, executed and expensive (a conservative estimate would be $300 000 000) trials in patients with chronic kidney disease. In this commentary, we will set out what we believe has now changed as a result of the TREAT and how we might have to adapt our thinking and our clinical practice in the future as a result. We believe that clinical nephrologists, anaemia coordinators, clinical practice and guideline setters, and patient registries, will need to re-address anaemia treatment paradigms and, in so doing, reappraise our clinical use of those expensive and powerful medications— erythropoiesis-stimulating agents (ESAs).

Exploring Medical Device Reliability and Its Relationship to Safety and Effectiveness

<para xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> It may seem intuitive that reliability is essential for modern products that need to be safe and effective, particularly healthcare and medical devices. One would expect to find reliability cited in regulations, engineering articles, and consensus standards. Yet typical industrial processes in which high reliability is needed often do not explicitly provide evidence to support a safety and effectiveness (S&amp;E) argument. The lack of a consistent and standardized framework for achieving reliability that is tied explicitly to safety and effectiveness undermines S&amp;E evaluation. Regulators and manufacturers who are unable to take full advantage of the information generated by the reliability engineering processes fail to maximize product S&amp;E. This paper explores a reliability engineering framework to provide the arguments, claims, and evidence important to product S&amp;E, and the artifacts suitable for integrating reliability into S&amp;E assessments. </para>

Public support for river restoration. A mixed-method study into local residents' support for and framing of river management and ecological restoration in the Dutch floodplains

In many European countries, accommodating water has become the dominant paradigm in river management. In the Netherlands, extensive river restoration projects are being implemented, many of which draw serious opposition from the public. To investigate the causes of such opposition, a comprehensive study of public attitudes towards river restoration was conducted in three floodplains, both before and after river restoration. The study combined quantitative questionnaires (N = 562) with open interviews (N = 29). This paper describes how local residents perceive the effects of river restoration on landscape quality and how residents and protest groups use landscape quality in combination with other arguments to strategically frame river management policies. Results show that measurement of the perceived outcomes of nature restoration needs to be complemented by a more dynamic type of research, focusing on the social processes of the framing of restoration plans. Theoretically, the paper aims to contribute to the development of a rigorous research strategy to study framing processes in environmental management, using a mixed-methods approach. In general, local residents are supportive of river restoration projects. Although restoration may diminish feelings of attachment to an area, for most people this negative effect is compensated by the positive effects on scenic beauty and perceived protection from flooding. However, these positive effects may become contested because of the active framing of river restoration by protest groups. Residents use three distinct frames to give meaning to river restoration projects: (i) an attachment frame, focusing on cultural heritage and place attachment (ii) an attractive nature frame, focusing on nature as attractive living space and the intrinsic value of nature (iii) a rurality frame, focusing on rural values, agriculture and cultural heritage. Resistance to river restoration plans stems from the attachment and rurality frames. People using these frames challenge safety arguments for river restoration and highlight potential threats to sense of place and to agriculture. In the areas surveyed, the project initiator's focus on biodiversity and safety did not resonate very well among the local community, because of their diverging views on nature. Practical implications of the study include the need to incorporate public perception into river restoration projects and the potential for project initiators to form strategic alliances with local residents to promote ecological restoration in combination with river restoration.

Vehicle Size and Driver Perceptions of Safety

ABSTRACT A sample of 496 car and sport utility vehicle (SUV) drivers responded to questionnaires that examined attitudes toward vehicle size and safety. The aim of this research is to determine whether drivers perceive larger vehicles to be safer and whether this concern for safety motivates drivers to purchase SUVs. Alternatively, non–safety influences are also examined, including environmental concern, vehicle power, prestige, and vehicle utility. Perceptions that large vehicle are safer, off-road use, and prestige all relate strongly to SUV use. The safety arguments raised by SUV drivers appear to be based on an egocentric concern for “bigger is safer” rather than a broader understanding of vehicle fleet safety. To encourage sustainable transport, it is suggested that road safety policy should shift drivers' concerns from personal collision protection to overall road user protection.

Recent developments in environmental aspects of D– 3He fuelled fusion devices

The stress on fusion safety has stimulated worldwide research in the late 1980s for fuel cycles other than D–T. With advanced cycles, such as D–D, D– 3He, p- 11B, and 3He– 3He, it is not necessary to breed and fuel large amounts of tritium. The D– 3He fuel cycle in particular is not completely aneutronic due to the side D–D reactions. Neutron wall loadings, however, can be kept low (by orders of magnitude) compared to D–T fuelled plants with the same output power, eliminating the need for replacing the first wall and shielding components during the entire plant lifetime. Other attractive safety characteristics include low activity and decay heat levels, low-level waste, and low releasable radioactive inventory from credible accidents. There is a growing international effort to alleviate the environmental impact of fusion and to support the most recent trend in radwaste management that suggests replacing the geological disposal option with more environmentally attractive scenarios, such as recycling and clearance. We took the initiative to apply these approaches to existing D– 3He conceptual designs: the ARIES-III power plant and the Candor experiment. Furthermore, a comparison between the radiological aspect of the D– 3He and D–T fuel cycles was assessed and showed notable differences. This report documents the comparative assessment and supports the safety argument in favour of the D– 3He fuel cycle.

Legislating Self-Risking Behaviors

Helmet laws are suggestive of a societal trend toward the increased formal control of risky behaviors. Applying Tittle's integrated model, this case study sees the intersection of federal cost recovery interests, social solidarity concerns, and views of motorcyclists as “social dynamite” as setting the stage for motorcycle safety issues to become constructed as social problems. A governmental bureaucracy has led numerous helmet law campaigns. Financial burden and public safety arguments are used to justify helmet restrictions. A countermovement argues that helmet laws could lead to a slippery slope of declining freedoms. Implications of the debates between opposing positions are raised.

Management of evacuation in case of fire accidents in chemical industrial areas

Trade-offs between economic and safety arguments exist in the operation of chemical installations, should knock-on calamities induced by fire accidents occur: a sudden installation shutdown might result in substantial economic losses, but may be needed to ensure safety. Due to the very rare nature of domino effect risks induced decision problems an adequate evacuation decision aid model to be used by plant safety management does, to the best of the authors’ knowledge, not exist. This paper develops a tentative approach to calculate the economic gains and/or losses linked to the decision problem whether or not, and when, to evacuate chemical installation(s) threatened by possible domino effect risks. The proposed model is illustrated by a case-study based on empirical data.

The deconstruction of safety arguments through adversarial counter-argument

The project Deconstructive Evaluation of Risk In Dependability Arguments and Safety Cases (DERIDASC) has recently experimented with techniques borrowed from literary theory as safety case analysis techniques [Armstrong. Danger: Derrida at work. Interdiscipl Sci Rev 2003;28(2):83–94. [9]; Armstrong J, Paynter S. Safe systems: construction, destruction, and deconstruction. In: Redmill F, Anderson T, editors. Proceedings of the 11th safety critical systems symposium, Bristol, UK. Berlin: Springer; 2003. p. 62–76. ISBN:1-85233-696-X. [10]]. This paper introduces our high-level framework for “deconstructing” safety arguments. Our approach is quite general and should be applicable to different types of safety argumentation framework. As one example, we outline how the approach would work in the context of the Goal Structure Notation (GSN).

Process and product certification arguments

Many current safety certification standards are process-based, i.e. they prescribe a set of development techniques and methods. This is perhaps best exemplified by the use of Safety Integrity Levels (SILs), e.g. as defined by IEC 61508 and UK Defence Standard 00-55. SILs are defined according to the level of the risk posed by a system, and hence prescribe the tools, techniques and methods that should be adopted by the development and assessment lifecycle. Product-based certification relies on the generation and assurance of product-specific evidence that meets safety requirements derived from hazard analysis. This evidence can be used as the argument basis in a safety case. However, uncertainty about the provenance of evidence in such a safety case can undermine confidence. To address this problem, we argue that process arguments remain an essential element of any safety case. However, unlike the sweeping process-based integrity arguments of the past, we suggest instead that highly directed process arguments should be linked to the items of evidence used in the product case. Such arguments can address issues of tool integrity, competency of personnel, and configuration management. Much as deductive software safety arguments are desirable, there will always be inductive elements. Process-based arguments of the type we suggest address partly this problem by tackling the otherwise implicit assumptions underlying certification evidence.

Germ-Line Enhancement of Humans and Nonhumans

The current difference in attitude toward germ-line enhancement in humans and nonhumans is unjustified. Society should be more cautious in modifying the genes of nonhumans and more bold in thinking about modifying our own genome. I identify four classes of arguments pertaining to germ-line enhancement: safety arguments, justice arguments, trust arguments, and naturalness arguments. The first three types are compelling, but do not distinguish between human and nonhuman cases. The final class of argument would justify a distinction between human and nonhuman germ-line enhancement; however, this type of argument fails and, therefore, the discrepancy in attitude toward human and nonhuman germ-line enhancement is unjustified.

Engineering, Urbanism and the Struggle for Street Design

The making and upkeep of streets is a central task of urban design. In a critical review of the relation between urban design and highway engineering, the paper distinguishes two paradigms: on one side, the hierarchical model, pervasive and institutionally entrenched through design standards and traffic management; on the other, an alternative non-hierarchical paradigm which has developed piecemeal and experimentally on the back of policies for social exclusion, city centre regeneration, liveable neighbourhoods and neo-traditional urbanism. The paper discusses the tension between the two frameworks and highlights the health, safety and environmental arguments for reinventing the mixed-use urban street.

Measuring reuse in hazard analysis

Hazard analysis for safety-critical systems require sufficient coverage and rigour to instill confidence that the majority of hazardous consequences have been identified. These requirements are commonly met through the use of exhaustive hazard analysis techniques. However, such techniques are time consuming and error-prone. As an attempt at exhaustive coverage, hazard analysts typically employ reuse mechanisms such as copy-and-paste. Unfortunately, if reuse is applied inappropriately there is a risk that the reuse is at the cost of rigour in the analysis. This potential risk to the validity of the analysis is dependent on the nature and amount of reuse applied. This paper investigates hazard analysis reuse over two case studies. Initially reuse in an existing safety argument is described. Argument structures within the hazard analysis are identified and the amount of verbatim reuse examined. A second study is concerned with how reuse changes as a result of tool support. In contrast to the first case, the defined arguments are more diverse—reuse has occurred but is less verbatim in nature. Although tool support has aided the customisation of the reused arguments, many are only trivially customised. An edit distance algorithm is utilised to identify and enumerate verbatim and trivial reuse in the arguments.

Human Error Analysis in Railway Safety Cases; Panacea or Poison?

This paper outlines the techniques applied and lessons learnt when applying formal human error and reliability techniques to support the production of a railway safety case in the UK. This paper argues that the optimum techniques for addressing human error may need to be adapted from those advocated by human factors professionals in order to achieve a pragmatic, valid and justifiable safety argument within the often limited timescales and costs. In particular, during this work it was found that formal classification of errors did not assist in identifying human error events or specifying mitigations against these events. In addition the application of formal human reliability techniques did not adequately address the potential for human violation (Williams, 1997). It is concluded that formal methods can only be used as supporting techniques to a qualitative approach and that quantified human reliability techniques should not be used definitively due to their inherent weaknesses.