18.1.1 A
Risk Assessment (RA) supported using a technique selected from IEC/
ISO 31010 Risk Management – Risk Assessment techniques is
to be performed. The technique selected is to be carried out in accordance
with the relevant International Standard or applicable National Standard
and with Vol 2, Pt 1, Ch 3, 18.1 General 18.1.2 for
systems (a), (b) and (c) as specified in Vol 2, Pt 1, Ch 3, 3.3 Calculations and specifications 3.3.7. A justification is to be provided which demonstrates
the suitability of the Standard and analysis technique chosen.
18.1.2 The
RA is to demonstrate that suitable risk mitigation has been achieved
for all normal and reasonably foreseeable abnormal conditions. The
scope of analysis required for each system is defined in Vol 2, Pt 1, Ch 3, 18.1 General 18.1.3 and in the respective
parts of the Rules.
Note A reasonably foreseeable abnormal condition is an event,
incident or failure that:
- has happened and could happen again;
- has not happened but is considered possible. Where the likelihood is considered
extremely unlikely or the consequences are trivial, and no further prevention or
mitigation action is to be taken, then this is to be justified;
- is planned for (e.g. emergency actions cover such a situation,
maintenance is undertaken to prevent it, etc.).
Note These conditions should be identified by:
- using analysis processes that are capable of revealing abnormal
conditions;
- employing a mix of personnel including: designers, operators,
persons who carry out maintenance, those with relevant domain knowledge and
understanding, and competent safety/risk professionals to apply the
processes;
- referencing relevant events and historic data; and
- documenting the results of the analysis.
18.1.3 The
RA is to be organised in terms of items of equipment and function.
The effects of item failures or damage at stated level and at higher
levels are to be analysed to determine the effects on the system as
a whole. Actions for mitigation are to be determined.
18.1.4 The
RA is to:
-
Identify the
equipment or sub-system and their modes of operation and the equipment;
-
Identify potential
failure modes and damage situations and their causes;
-
Evaluate the
effects on the system of each failure mode and damage situation;
-
Identify measures
for reducing the risks associated with each failure mode;
-
Identify measures
for failure mitigation; and
-
Identify trials
and testing necessary to prove conclusions.
18.1.5 At
sub-system level it is acceptable, for the purpose of these Rules,
to consider failure of equipment items and their functions, e.g. failure
of a pump to produce flow or pressure head. It is not required that
the failure of components within that pump be analysed. In addition,
failure need only be dealt with as a cause of failure of the pump.
18.1.6 Where
RA is used for consideration of systems that depend on software based
functions for control or co-ordination, the analysis is to investigate
failure of the function rather than a specific analysis of the software
code.