1. NCAF_May03.ppt Slide - 1 CSE International Ltd Data Integrity: The use of data by safety-related systems Alastair Faulkner CEng CSE International Ltd Tel: +44 (0)1724 862169 email: agf@cse-euro.com

2. NCAF_May03.ppt Slide - 2 ContentsContents Brief introduction Introduction to safety Data integrity Data provision Data origination Conclusions

3. NCAF_May03.ppt Slide - 3 Safety-related systems

4. NCAF_May03.ppt Slide - 4 Brief introduction Safety concepts Hazard, opportunity, accident Risk, Risk reduction Generalised safety process

5. NCAF_May03.ppt Slide - 5 Safety Concepts Harm:death, physical injury or damage etc Hazard:source of potential harm Risk:likelihood of harm from specified hazard(s) Safety related systems are intended to reduce risk Safety Requirements comprise: –safety functions –safety function integrity requirements Failures may give rise to hazards Failures may be random or systematic in nature

6. NCAF_May03.ppt Slide - 6 Error – Fault - Failure [Engineering Safety Management: Yellow Book 3]

7. NCAF_May03.ppt Slide - 7 Hazard, opportunity, accident [Engineering Safety Management: Yellow Book 3]

8. NCAF_May03.ppt Slide - 8 Innovation: First powered flight

9. NCAF_May03.ppt Slide - 9 Trees- A hazard to navigation

10. NCAF_May03.ppt Slide - 10 Risk and ALARP [HSE: Reducing Risks, Protecting People]

11. NCAF_May03.ppt Slide - 11 Risk reduction [IEC 61508-5]

12. NCAF_May03.ppt Slide - 12 Example risk classification matrix

13. NCAF_May03.ppt Slide - 13 Generalised safety process List system functions (operational requirements) Find out how they can go wrong –Functional Hazard Analysis Calculate tolerable failure rates (safety requirements) – consequence analysis to assess mitigation Design system to meet safety requirements Show that system will meet safety requirements –provide safety arguments and evidence in safety case Maintain safe operation

14. NCAF_May03.ppt Slide - 14 Data integrity Data in air navigation Data integrity Data provision

15. NCAF_May03.ppt Slide - 15 Air Navigation

16. NCAF_May03.ppt Slide - 16 Problem description The use of data by safety-related systems is becoming more common. In such systems data is often a significant (if not the major) component Data is not commonly treated as a separate system component and hence is largely ignored. Safety of the system may rely on the correctness of the data

17. NCAF_May03.ppt Slide - 17 Data-driven systems The data used by a data-driven system may have extensive influence over both the normal and abnormal behaviour of the system Typical examples of large-scale data-driven systems are transportation control systems. These systems use several different types of data –Static configuration data –Instantaneous status information –Operational information –Command Schedule – Timetable

18. NCAF_May03.ppt Slide - 18 Data integrity requirements Hazard and risk analysis process are used to establish system integrity requirements These requirements are then apportioned between components of the design, including people, process, hardware, software and data components of the system. The integrity requirements apportioned to the data component of the system are termed in this presentation ‘data integrity requirements’.

19. NCAF_May03.ppt Slide - 19 Apportionment of ‘error budget’ [IEC 61508]

20. NCAF_May03.ppt Slide - 20 Control System Model

21. NCAF_May03.ppt Slide - 21 Systems hierarchy Safety-related systems may co-exist in a hierarchy of systems –Supervisory systems –Peer systems –Subordinate systems Data is shared amongst this systems hierarchy, through interfaces Each level in the systems hierarchy may use the same data for different purposes e.g. Train planning or route setting

22. NCAF_May03.ppt Slide - 22 A question of scale? “Things get bigger and bigger, pushing the boundaries, until you’ve had a change of scale ” Peter Elliott BP, Keynote Speaker ESAS-02

23. NCAF_May03.ppt Slide - 23 Layer model

24. NCAF_May03.ppt Slide - 24 WorkstationWorkstation

25. NCAF_May03.ppt Slide - 25 Vertical coupling

26. NCAF_May03.ppt Slide - 26 Horizontal coupling

27. NCAF_May03.ppt Slide - 27 Design – Control System

28. NCAF_May03.ppt Slide - 28 Design – Interface considerations

29. NCAF_May03.ppt Slide - 29 Data Quality DO 200A identifies a number of ‘data quality’ criteria the accuracy of the data the resolution of the data the confidence that the data is not corrupted while stored or in transit (assurance level) the ability to determine the origin of the data (traceability) the level of confidence that the data is applicable to the period of (its) intended use (timeliness) all of the data needed to support the function is provided (completeness) the format of the data meets the users requirements

30. NCAF_May03.ppt Slide - 30 Data development In data-driven systems the data is often developed separately from the software However, it is clearly an integral part of the system –Safety of the overall system will normally depend on the correctness of the data –Presumably the SIL of the data will be similar to that of the executable software –One would expect similar levels of rigour

31. NCAF_May03.ppt Slide - 31 Data ownership Ownership may itself be a complex issue as data may originate from within a number of organisational and political bodies and include any consolidations required to produce a higher data abstraction. Organisational responsibilities are not only concerned with the supply of data, but also the ownership and in some cases the liabilities associated data errors. Ownership may also be passed across the data supply chain.

32. NCAF_May03.ppt Slide - 32 Data Provision Data provision is dependant upon the integrity of the data source Data provision has two main components –Data source (Either data production or Origination) –Data supply chain

33. NCAF_May03.ppt Slide - 33 Integrity of the data source Data may be produced by a number of means, from simple data entry to complex and diverse automated toolsets. The integrity of the data origin will be a significant influence upon the integrity required from the supply chain. Low integrity at the data source may render the source unusable. All data of a particular type may not be provided from a single source

34. NCAF_May03.ppt Slide - 34 Data production Small-scale systems may use data entry to create a validated dataset. As the scale and volume of data increases the nature of the data required changes. Data production may require vertical or horizontal datasets (or a combination of both) Data production may consider data extracted from enabling products such as middleware or data mining or data warehouses.

35. NCAF_May03.ppt Slide - 35 Data supply chain Properties required from a data supply chain –Origination (data of suitable integrity) - Identifies a point at which the data originates –Data then progresses across a series of elements such as transmission, preparation, formatting and finally consumed by the data-driven system. –Each element will not be perfect and therefore, each element in the chain may introduce error of faults. Data supply chain errors must be less than the data integrity requirements for the safe operation of the system

36. NCAF_May03.ppt Slide - 36 Buildings: A hazard to navigation

37. NCAF_May03.ppt Slide - 37 ConclusionsConclusions The safe operation of the data-driven system is likely to depend upon the correctness of the data However, data and its production, use and maintenance rarely are treated as the subject of integrity requirements All too often –data is not subject to any systematic hazard or risk analysis –data is poorly structured, making errors more likely to be produced, and more difficult to detect –data is not subjected to any form of verification

38. NCAF_May03.ppt Slide - 38 A final quote “You would think that before they let people use these systems, they'd ensure they're safe ” Hiram K. Hackenbacker (Brains) International Rescue, Thunderbirds 1966 (1972 in UK)