1. How Trustworthy are your Systems?
SAE International Aerospace Standards Summit,
2 October 2018
Andy Pickard, Rolls- Royce Corporation
How Trustworthy are your Systems?
Copyright © 2018 by Rolls-Royce. Published and used by SAE International with permission

2. How Trustworthy are your Systems?
SAE International Aerospace Standards Summit,
2 October 2018
Andy Pickard, Rolls- Royce Corporation
How Trustworthy are your Systems?
Based on a paper presented at the International Council on Systems Engineering (INCOSE) Symposium:
A C Pickard and A J Nolan: “When is Enough Enough? Tailoring Processes in Systems Engineering”, INCOSE , 21st Anniversary INCOSE International Symposium, Denver, 2011, ISBN
Copyright © 2018 by Rolls-Royce. Published and used by SAE International with permission

3. Probability Calculus
SAE International Aerospace Standards Summit,
2 October 2018
Andy Pickard, Rolls- Royce Corporation
US Federal Judge Learned Hand, 1947, defined Probability Calculus
Barge Accident in New York Harbor
United States v. Carroll Towing Co.
Three variables:
The probability (P) of the event happening
The loss (L) if the event happens
The burden (B) of taking precautions to prevent the event happening
Liability attaches when:
B < P * L
Copyright © 2018 by Rolls-Royce. Published and used by SAE International with permission
Under the Hand formula, it is unreasonable to not take precautions, or to exercise preventive care, whenever the cost of doing so is less than the expected loss.
Refs: SAE AIR 5113, "Legal Issues Associated with the use of Probabilistic Design Methods", SAE International, 2002; US Federal Court, 2nd Circ. 1947, 159 F.2d pages

4. How Many Mitigation Actions?
SAE International Aerospace Standards Summit,
2 October 2018
Andy Pickard, Rolls- Royce Corporation
Copyright © 2018 by Rolls-Royce. Published and used by SAE International with permission

5. Example: Configuration Management Systems
SAE International Aerospace Standards Summit,
2 October 2018
Andy Pickard, Rolls- Royce Corporation
Assumptions
- Execution of changes through the Full Configuration Management System costs twice as much as through the CM Lite system.
- The configuration error rate is five times higher in the CM Lite system than in the Full Configuration Management System.
- The cost impact of an error escape increases by a factor of 3 mid-program and by a factor of 10 late- program compared to early in the program
Copyright © 2018 by Rolls-Royce. Published and used by SAE International with permission

6. Value Based Management
SAE International Aerospace Standards Summit,
2 October 2018
Andy Pickard, Rolls- Royce Corporation
We are trying to add value in what we do
But do we understand what “value” is?
Everything adds value
But not always the value we want e.g. Component test adds value to the certification process but not to the early error detection process
Everything adds a different amount of value
But do we recognize this and know what adds most value, when?
If we accept a controlled level of risk, we do not need to do everything but just enough of the right things that bring the quickest rate of return on value.
But an organization will need to be mature if it is willing to take calculated risks and accept the consequences without blame.
Copyright © 2018 by Rolls-Royce. Published and used by SAE International with permission

7. Balancing Processes and Risks
SAE International Aerospace Standards Summit,
2 October 2018
Andy Pickard, Rolls- Royce Corporation
Copyright © 2018 by Rolls-Royce. Published and used by SAE International with permission

8. When not to use Probability Calculus
SAE International Aerospace Standards Summit,
2 October 2018
Andy Pickard, Rolls- Royce Corporation
Safety Critical Systems!
Processes that are used to ensure the safety of the system
Strict limits on the probability of occurrence of events that could result in a hazardous condition
All mitigations required to achieve this level of probability of occurrence have to be applied and cannot be tailored out
Reference:
Clifford, W; "The Ethics of Belief, Part 1 - The Duty of Inquiry", Contemporary Review, January
Copyright © 2018 by Rolls-Royce. Published and used by SAE International with permission

9. Contact Information
SAE International Aerospace Standards Summit,
2 October 2018
Andy Pickard, Rolls- Royce Corporation
Dr Andrew C Pickard
Rolls-Royce Corporation, Indianapolis
Phone (mobile):
Copyright © 2018 by Rolls-Royce. Published and used by SAE International with permission