SSCL COPORATE FUNCTIONAL SAFETY MANAGEMENT Chris Goring Safety Systems Consultants Ltd.

SSCL What is Corporate Functional Safety Management (CFSM)? It is the definition and implementation of Safety policies and procedures from the Executive Board level down through all operational levels of the corporate entity. It defines responsibilities and structures for all Safety Management Functions It defines the documentation and record keeping for all Safety management decisions

SSCL Why is CSFM Important? Properly implemented it will provide a level of legal protection for Executives and Managers It will increase the safety attributes of Products and Services Badly implemented - you might as well be without it - see you in court!

SSCL Is The Health and Safety at Work Act Involved? Yes - part of CFSM is to ensure the safety of the employees and visitors All corporations require at least this level of CFSM When the Design, Production and Maintenance of Safety Related Software is involved much more is required

SSCL CFSM in a Safety Related S/W Environment - Responsibilities The Organisation must clearly show the hierarchy of responsibilities of safety management decisions through to the Executive Board level

SSCL CFSM in a Safety Related S/W Environment - Personnel At each level of the management structure for the design and support of safety software, the personnel selected must have the appropriate level of competency Managers should be ‘experts’ as defined in the competency guidelines in the area of their responsibility

SSCL CFSM in a Safety Related S/W Environment - Personnel (cont) On joining all personnel should be given safety indoctrination training For those involved in developing and supporting safety software the indoctrination training must include all relevant safety procedures Safety training must include regular refresher course

SSCL CFSM in a Safety Related S/W Environment - Policies and Procedures At the top level a Corporate Policy Statement must clearly show the importance that the corporation accords to the safety of its products and services At each operational level AUDITABLE safety procedures must be in place Auditable requires documentation and records of all safety reviews, safety test and safety management decisions

SSCL CFSM in a Safety Related S/W Environment - Auditing of Procedures The Auditing Function must be fully independent of the audited departments It is just like QA -perhaps it should be termed SA? Depth and detail of audits will be dependent on the criticality of the software involved Auditing discrepancies must have a fast track follow-up

SSCL CFSM in a Safety Related S/W Environment - Auditing of Procedures Safety Procedures must be Verifiable and verification must be documented to allow auditing Safety related software products will have a Functional Safety Specification which will have attributes that can be verified and validated Safety reviews by safety committees will confirm thoroughness of the verification and validation

SSCL CFSM in a Safety Related S/W Environment - Personnel Selection It is critical for the operation of CFSM that the appropriate qualified personnel are selected for each function The level of competence must relate to the level of responsibility See IEE/BCS Competency study and CASS

SSCL CFSM in a Safety Related S/W Environment - Personnel Training It is important to allow a training path from Supervised Practitioner to Practitioner and finally to Expert for potentially competent personnel Training records must be kept

SSCL CFSM Sample of a Corporate Policy Statement A primary goal of this corporation is to ensure that the products and services that it supplies are safe and fit for purpose and that in fulfilling the supply of these products and services it will not increase risk to its personnel, its customers or the environment

SSCL CFSM Responsibilities A member of the Executive Board should be made ultimately responsible for all safety issues - ideally this should be the CEO but in large Organisations this role may be delegated to another executive. This designated individual should chair the corporation’s ultimate safety committee

SSCL CFSM Decision Example (1) A Motor manufacturer General Daimler Ford Motors Inc. has had reported a series of accidents - 3 fatal - on a recently introduced model the ‘Fast Banana’ 150,000 Fast Bananas have been supplied over the past 12 months since launch reported accidents number 250 of which 3 had single fatalities, 20 had serious injuries and the rest sustained minor or no injuries

SSCL CFSM Decision Example (1) Time between report of problem and the proposed solution was short - 2 days Engineering have found the problem in the cruise control software :- if the cruise control is set for 64 mph or 64 kph for 8 mins an uncontrolled increase in speed occurs. Applying the break cuts out the cruise control The fix is to replace a ROM in every Fast Banana

SSCL CFSM Decision Example Safety Committee Decisions (1) Cost of solution $2 parts $98 labour Recall options – Press announcements plus letter to all owners to contact dealer to arrange fix at once –Recommend fix at next service with discreet letter to customers and pay compensation to any further accident victims Total cost of fix - $15M Compensation cost to date - $7M

SSCL CFSM Decision Example Safety Committee Decisions (2) A Small to Medium size company Safe Systems Inc - turnover $100M produces safety related software based systems for the Process Industry Typical systems supplied cost $500k but protect plant worth £20m and there is a potential for customer personnel injury or fatalities The systems supplied all contain common source software plus individual configuration

SSCL CFSM Decision Example Safety Committee Decisions (2) In a certain configuration under factory test a software bug is discovered that effects the past 40 systems supplied The bug results in a conflict in timing that could under certain circumstances prevent a safety operation being implemented As the fix is in the source software the systems must be taken off line for the fix to be implemented

SSCL CFSM Decision Example Safety Committee Decisions (2) All procedures since the discovery of the bug to the design of the solution over a period of three days have been implemented including - Additional criticality analysis Probability occurrence analysis The detailed analysis of the fix

SSCL CFSM Decision Example Safety Committee Decisions (2) The results have shown that the conflict becomes up to 256 times more likely with a certain type of configuration This type of configuration is only present in 5 systems supplied to date The probability of a safety function not being correctly implemented in these 5 systems was estimated at 5 % (1 in 20) Typical demand rate being 1/2 per year

SSCL CFSM Decision Example Safety Committee Decisions (2) The decisions to be made could be - For the majority of customers, to inform them and recommend update at the next plant shutdown providing this is to occur in less than 18 months? For the five critical systems to inform the customer and insist that the fix be implemented in the next five days All relevant calculations and analysis to be available to the customers

SSCL CFSM Decision Example Safety Committee Decisions Cost and importance of solution determines if decision must be by executive board Safety Management Structure must ensure efficient implementation Marketing will need to be involved to help reinstate reputation Lawyers may help determine appropriate action in each country

SSCL CFSM Maintenance Guidelines Be as open with the Customers as possible If you have commercial concerns explain these to the customers Provide the safest practical solution Most major industries have a defined cost of fatality and injuries Unfortunately these cost are often related to the country of operation