Safety and risk¶

The question this discipline answers

What could cause harm, and what keeps the risk acceptable?

Safety and risk follows ISO 14971. A hazard is a potential source of harm. A sequence of events turns it into a hazardous situation, which can lead to harm. Each risk is estimated and evaluated, reduced by risk controls, and what remains is the residual risk, judged once more against the device's benefit.

MEMO models that chain as elements and relationships rather than as rows in a spreadsheet. The payoff is that a risk control is tied to the design element that implements it. When that element changes, the control's evidence is visibly at stake.

Namespace: memo::assurance::safety_risk · Source: src/assurance/safety_risk/

Key elements¶

The ISO 14971 chain. Hazard, HazardCause, SequenceOfEvents, HazardousSituation and Harm are the chain's risk items. A ReasonablyForeseeableMisuse records misuse the manufacturer must consider. A SafetyRelatedCharacteristic records a characteristic of the device that can affect safety.

Risk and its evaluation. A Risk is estimated for a risk item and assessed against a RiskMatrix. A ResidualRisk is what remains after control. An OverallResidualRiskEvaluation weighs all residual risk, together with the device's Benefit.

Controls. A RiskControlMeasure reduces a risk. Its controlKind says what kind of control it is: inherent safe design, a protective measure, information for safety, an alarm, an interlock, monitoring, or a plausibility check. Its implementationKind says how it is built: in hardware design, in software design, in labelling, in training, or as a procedural control.

Analysis techniques.

FMEA: FMEAWorksheet, FailureMode, FailureEffect, FailureCause, DetectionMethod and FMEAAction.
Fault tree analysis: FaultTree, FaultTreeNode and MinimalCutSet.
HAZOP: HAZOPStudy, HAZOPNode and HAZOPDeviation.

After release. PostMarketSurveillance feeds field information back into the design.

How it connects¶

The chain itself. Risk items trace to each other along the sequence of events (TracesRisk). A hazardous situation leads to a harm (LeadsToHarm), carrying the conditional probability that it does. A risk is estimated for a risk item (EstimatedFor) and assessed against a matrix (AssessedAgainst). A residual risk is reduced by controls (ReducedBy) and evaluated in the overall evaluation (EvaluatedIn).

Causes and controls:

Causes links a cause to its effect. Its causeKind says what kind of causation it is, for example a failure that causes an effect, or a use error that leads to a hazard.
Mitigates links a control to the risk item it reduces. Its mitigationKind is hazard or vulnerability.
ControlImplementedBy links a control to the design element that implements it, in any architecture layer.

Analysis. An element has failure modes (HasFailureMode). A failure mode is detected by a detection method (DetectedBy). Fault-tree nodes feed gates and produce events (InputToGate, ProducesEvent), and a minimal cut set contains events (ContainsEvent). A HAZOP deviation identifies a hazard (IdentifiesHazard).

To other layers and disciplines:

Operational: a risk item is related to the operative scenario it occurs in (HazardRelatedScenario). See Operational.
Human factors: a use error causes a hazard (Causes). See Human factors.
Cybersecurity: a security element can impact safety (ImpactsSafety), and a cyber risk is a Risk. See Cybersecurity.
Requirements: a risk is a requirement driver, so a safety requirement can derive from it (DerivesFrom). See Requirements.
Post-market: surveillance feeds back to a design element (FeedsBackTo).

In the running example¶

A nurse who silences the alarm without assessing it commits a use error. That use error leads to the hazard of an undetected deviation. Re-announcing the alarm after silence is the control, and the alarm banner implements it.

item hzUndetectedDeviation : Hazard {
    @MemoIdentity { :>> providedId = "TA-HZ-001"; :>> label = "UndetectedTemperatureDeviation"; }
    attribute :>> hazardType = HazardTypeKind::informationError;
    attribute :>> severity = SeverityKind::serious;
    attribute :>> foreseeable = true;
}
part rcReAnnunciate : RiskControlMeasure {
    @MemoIdentity { :>> providedId = "TA-RC-001"; :>> label = "AutoReAnnunciationAfterSilence"; }
    attribute :>> controlKind = RiskControlKind::alarm;
    attribute :>> implementationKind = RiskControlImplementationKind::softwareDesign;
}
connection : CommitsUseError connect task ::> actAcknowledgeAlarm.taskAckAlarm to useError ::> ueSilenceAndForget;
connection : Causes connect cause ::> ueSilenceAndForget to effect ::> hzUndetectedDeviation { attribute :>> causeKind = CauseKind::useErrorLeadsToHazard; }
connection : Mitigates connect control ::> rcReAnnunciate to mitigatedElement ::> hzUndetectedDeviation { attribute :>> mitigationKind = MitigationKind::hazard; }
connection : ControlImplementedBy connect riskControl ::> rcReAnnunciate to implementingElement ::> elAlarmBanner;

The full inventory¶

Generated from src/assurance/safety_risk/.

Elements¶

Analysis

Element	SysML kind	What it is
`FMEAWorksheet`	`part def`	Fmeaworksheet definition specializing `AnalysisArtifact`.
`FailureMode`	`item def`	Failure mode definition specializing `RiskItem`.
`FailureEffect`	`item def`	Failure effect definition specializing `RiskItem`.
`FailureCause`	`item def`	Failure cause definition specializing `RiskItem`.
`DetectionMethod`	`part def`	Detection method definition specializing `MemoPart`.
`FMEAAction`	`part def`	Fmeaaction definition specializing `VerifiableElement`.
`FaultTree`	`part def`	Fault tree definition specializing `AnalysisArtifact`.
`FaultTreeNode`	`part def`	Fault tree node definition specializing `MemoPart`.
`MinimalCutSet`	`item def`	Minimal cut set definition specializing `RiskItem`.
`HAZOPStudy`	`part def`	Hazopstudy definition specializing `AnalysisArtifact`.
`HAZOPNode`	`part def`	Hazopnode definition specializing `MemoPart`.
`HAZOPDeviation`	`item def`	Hazopdeviation definition specializing `RiskItem`.

Core concepts

Element	SysML kind	What it is
`ReasonablyForeseeableMisuse`	`part def`	ISO 14971 / IEC 62366-1 risk-analysis input. A model element so hazards, scenarios, requirements, and DHF records can trace to the foreseeable misuse that motivated them.…
`Risk`	`part def`	Risk definition specializing `RiskDriver`.
`ResidualRisk`	`part def`	Residual risk definition specializing `Risk`.
`RiskMatrix`	`part def`	Risk matrix definition specializing `MemoPart`.
`SafetyRelatedCharacteristic`	`part def`	Safety related characteristic definition specializing `MemoPart`.
`RiskItem` (abstract)	`item def`	Risk item definition specializing `MemoItem`.
`Hazard`	`item def`	Hazard definition specializing `RiskItem`.
`SequenceOfEvents`	`item def`	Sequence of events definition specializing `RiskItem`.
`HazardCause`	`item def`	Hazard cause definition specializing `RiskItem`.
`HazardousSituation`	`item def`	Hazardous situation definition specializing `RiskItem`.
`Harm`	`item def`	Harm definition specializing `RiskItem`.
`RiskControlMeasure`	`part def`	Risk control measure definition specializing `VerifiableElement`.
`Benefit`	`part def`	Benefit definition specializing `MemoPart`.
`OverallResidualRiskEvaluation`	`part def`	Overall residual risk evaluation definition specializing `MemoPart`.

Postmarket surveillance

Element	SysML kind	What it is
`PostMarketSurveillance`	`part def`	Post market surveillance definition specializing `MemoPart`.

Connections at a glance¶

Each arrow is one relationship, from its source end to its target end. A grey box belongs to another layer.

flowchart LR
  anyElement["any element"]:::other
  FailureMode["FailureMode"]
  DetectionMethod["DetectionMethod"]
  FaultTreeNode["FaultTreeNode"]
  MinimalCutSet["MinimalCutSet"]
  HAZOPDeviation["HAZOPDeviation"]
  Hazard["Hazard"]
  MemoPart["MemoPart"]:::other
  RiskItem["RiskItem"]
  HazardousSituation["HazardousSituation"]
  Harm["Harm"]
  OperativeScenario["OperativeScenario"]:::other
  Risk["Risk"]
  RiskMatrix["RiskMatrix"]
  ResidualRisk["ResidualRisk"]
  RiskControlMeasure["RiskControlMeasure"]
  OverallResidualRiskEvaluation["OverallResidualRiskEvaluation"]
  Benefit["Benefit"]
  PostMarketSurveillance["PostMarketSurveillance"]
  anyElement -->|Causes| anyElement
  FailureMode -->|DetectedBy| DetectionMethod
  FaultTreeNode -->|InputToGate| FaultTreeNode
  FaultTreeNode -->|ProducesEvent| FaultTreeNode
  MinimalCutSet -->|ContainsEvent| FaultTreeNode
  HAZOPDeviation -->|IdentifiesHazard| Hazard
  MemoPart -->|HasFailureMode| FailureMode
  RiskItem -->|TracesRisk| RiskItem
  HazardousSituation -->|LeadsToHarm| Harm
  RiskItem -->|HazardRelatedScenario| OperativeScenario
  Risk -->|AssessedAgainst| RiskMatrix
  Risk -->|EstimatedFor| RiskItem
  ResidualRisk -->|ReducedBy| RiskControlMeasure
  ResidualRisk -->|EvaluatedIn| OverallResidualRiskEvaluation
  anyElement -->|Mitigates| RiskItem
  Benefit -->|WeighedAgainst| Risk
  PostMarketSurveillance -->|FeedsBackTo| MemoPart
  RiskControlMeasure -->|ControlImplementedBy| anyElement
  MemoPart -->|ImpactsSafety| RiskItem
  classDef other fill:#eef1f4,stroke:#9aa7b2,color:#4a5a66

Relationships declared here¶

Relationship	From	To	What it says
`Causes`	any element	any element	Typed relationship from `any element` to `any element`.
`DetectedBy`	`FailureMode`	`DetectionMethod`	Typed relationship from `FailureMode` to `DetectionMethod`.
`InputToGate`	`FaultTreeNode`	`FaultTreeNode`	Typed relationship from `FaultTreeNode` to `FaultTreeNode`.
`ProducesEvent`	`FaultTreeNode`	`FaultTreeNode`	Typed relationship from `FaultTreeNode` to `FaultTreeNode`.
`ContainsEvent`	`MinimalCutSet`	`FaultTreeNode`	Typed relationship from `MinimalCutSet` to `FaultTreeNode`.
`IdentifiesHazard`	`HAZOPDeviation`	`Hazard`	Typed relationship from `HAZOPDeviation` to `Hazard`.
`HasFailureMode`	`MemoPart`	`FailureMode`	Typed relationship from `MemoPart` to `FailureMode`.
`TracesRisk`	`RiskItem`	`RiskItem`	Typed relationship from `RiskItem` to `RiskItem`.
`LeadsToHarm`	`HazardousSituation`	`Harm`	The final ISO 14971 chain edge. P2 is the conditional probability that the hazardous situation results in the harm.
`HazardRelatedScenario`	`RiskItem`	`OperativeScenario`	Typed relationship from `RiskItem` to `OperativeScenario`.
`AssessedAgainst`	`Risk`	`RiskMatrix`	Typed relationship from `Risk` to `RiskMatrix`.
`EstimatedFor`	`Risk`	`RiskItem`	Typed relationship from `Risk` to `RiskItem`.
`ReducedBy`	`ResidualRisk`	`RiskControlMeasure`	Typed relationship from `ResidualRisk` to `RiskControlMeasure`.
`EvaluatedIn`	`ResidualRisk`	`OverallResidualRiskEvaluation`	Typed relationship from `ResidualRisk` to `OverallResidualRiskEvaluation`.
`Mitigates`	any element	`RiskItem`	Typed relationship from `any element` to `RiskItem`.
`WeighedAgainst`	`Benefit`	`Risk`	Typed relationship from `Benefit` to `Risk`.
`FeedsBackTo`	`PostMarketSurveillance`	`MemoPart`	Typed relationship from `PostMarketSurveillance` to `MemoPart`.

Relationships from elsewhere that reach this layer¶

Relationship	Declared in	From	To	What it says
`ControlImplementedBy`	implementation	`RiskControlMeasure`	any element	A risk control implemented by a UI element or by task design (confirmation dialog, lockout, guarded control).
`ImpactsSafety`	cybersecurity	`MemoPart`	`RiskItem`	Typed relationship from `MemoPart` to `RiskItem`.

Enumerations¶

Enumeration	Values
`CauseKind`	`failureCausesEffect`, `failureCausedBy`, `contributesToHazard`, `leadsToHazard`, `originatesFrom`, `useErrorLeadsToHazard`
`MitigationKind`	`hazard`, `vulnerability`, `failureMode`, `cutSet`, `fmeaAction`

Go deeper¶

The GPCA infusion pump: risk, cybersecurity, and assurance.
The safety and risk API.