theuseofsafetycasesincertificationandregulation.docVIP

The Use of Safety Cases in Certification and Regulation Prof. Nancy Leveson Aeronautics and Astronautics/Engineering Systems MIT Introduction Certification of safety-critical systems is usually based on evaluation of whether a system or product reduces risk of specific losses to an acceptable level. There are major differences, however, in how that decision is made and on what evidence is required. The term Safety Case has become popular recently as a solution to the problem of regulating safety-critical systems. The term arises from the HSE (Health and Safety Executive) in the U.K., but different definitions seem to be rife. To avoid confusion, this paper uses the term “assurance cases” for the general term and limits the use of the term “safety case” to a very specific definition as an argument for why the system is safe. This paper examines the use of safety cases and some dangers associated with their use. The first important distinction is between types of regulation. Types of Regulation Safety assurance and certification methods differ greatly among industries and countries. Safety assurance methods commonly used can be broken into two general types, which determine the type of argument used in the assurance or certification process: Prescriptive: Standards or guidelines for product features or development processes are provided that are used to determine whether a system should be certified. Product: Specific design features are required, which may be (a) specific designs as in electrical codes or (b) more general features such as fail-safe design or the use of protection systems. Assurance is usually provided by inspection that the design features provided are effective and implemented properly. In some industries, practitioners are licensed based on their knowledge of the standards or codes of practice. Assurance then becomes the responsibility of the licensed practitioner, who can lose their license if they fail to follow the standar