Safety Assessment for Medical Test Lab Dr. David Endler Systems Engineering Consultant Freelancer & Member of oose eg
Agenda DLR :envihab test laboratory System safety process Design iterations Safety integrity levels Safety requirements and V&V Summary Source:DLR SWISSED 2017 Zürich, Dr. David Endler 2
Introduction Dr. David Endler Systems Engineering Consultant Freelancer Independent member of oose eg Deputy Technical Director of INCOSE DIN representative in ISO JTC 1 / SC 07 / WG 07 (Software and systems engineering Life cycle management) Accredited trainer for SE-Zert trainings SWISSED 2017 Zürich, Dr. David Endler 3
Environment (1/2) DLR German Aerospace Center :envihab consists of 8 separate modules Source:DLR SWISSED 2017 Zürich, Dr. David Endler 4
Environment (2/2) Source: DLR SWISSED 2017 Zürich, Dr. David Endler 5
Research of DLR Institute of Aerospace Medicine The scientific work of the DLR-Institute of Aerospace Medicine in :envihab is concerned, among others, with the following questions: What happens to the human body on a flight to Mars? How does being confined to bed after a serious illness impact the body? How does the lack of daylight affect mood? Are there any measures to counteract these adverse effects? SWISSED 2017 Zürich, Dr. David Endler 6
Scope of Research DLR Institute of Aerospace Medicine Cardiovascular, bone and muscle research Laboratories for studying the effects of oxygen reduction and pressure decrease on test subjects SWISSED 2017 Zürich, Dr. David Endler 7
Applicable Safety Standards No safety standard in place for this application State-of-the-art SWISSED 2017 Zürich, Dr. David Endler 8
Standard Safety Process Plan System Safety Establish system description Identify safety requirements Identify, analyze and categorize hazards Treat risks Verify and validate safety requirements SWISSED 2017 Zürich, Dr. David Endler 9
Systems Engineering & System Safety Control Requirements Analysis Requirements Validation Requirements Hazard Assessment Functional Analysis Functional Verification Functional Hazard Assessment Safety Assessment Synthesis Design Verification Fault Tree Analysis, Dependence Diagrams, Markov Analysis Control Derived from ISO/IEC 26702:2007, figure 4 SWISSED 2017 Zürich, Dr. David Endler 10
Critical Functions Functions identified: 1. Allow access to laboratory 2. Supply laboratory with fresh air 3. Condition laboratory atmosphere 4. Ensure safe operation 5. Determine system state (to control laboratory atmosphere 6. Indicate system state 7. Control laboratory atmosphere 8. Provide comfort 9. Take away used air 10. Allow exit of laboratory SWISSED 2017 Zürich, Dr. David Endler 11
Critical Failure Condition Loss of safe operation Target: 1x10-8 /h FC_4.1_DAY Loss of safety monitoring (day) Adjust critical air mixture MONIITOR_DAY AIR-MIXTURE Total loss of safety circuit Total loss of portable devices SAFETY -CIRCUIT PORTABLE SWISSED 2017 Zürich, Dr. David Endler 12
Function Independence Separation of control circuit and safety circuit Control Circuit Control N 2 /CO 2 enriched atmosphere Control room temperature Control air humidity Safety Circuit Examine gas mixture Shut-off N 2 /CO 2 supply SWISSED 2017 Zürich, Dr. David Endler 13
Safety Circuit Item Independence Supply Air Exhaust Air CO 2 Sonsor 1 CO 2 Sensor 2 Controller O 2 Sensor 1 O 2 Sensor 2 Solenoid Valve SWISSED 2017 Zürich, Dr. David Endler 14
Day and Night Mode During night additional surveillance required Supply Air CO2 Sonsor 1 Safety Circuit Exhaust Air CO2 Sensor 2 Patient Monitor 68 Controller 983% O2 Sensor 1 Solenoid Valve O2 Sensor 2 30 Portable Device 19,8 %O 2 1,12 %CO 2 SWISSED 2017 Zürich, Dr. David Endler 15
Function Independence Separation of control circuit and safety circuit Control Circuit Control N 2 /CO 2 enriched atmosphere Control room temperature Control air humidity Safety Circuit Examine gas mixture Shut-off N 2 /CO 2 supply Monitor vital functions of test persons Examine gas mixture Alarm in case threshold is exceeded SWISSED 2017 Zürich, Dr. David Endler 16
Critical Failure Condition (Night) Loss of safe operation Target: 1x10-8 /h FC_4.1_NIGHT Loss of safety monitoring (night) Adjust critical air mixture MONITOR_NIGHT AIR-MIXTURE Total loss of safety circuit Total loss of portable devices Total loss of vital functions monitoring SAFETY -CIRCUIT PORTABLE VITAL-FUNCTIONS SWISSED 2017 Zürich, Dr. David Endler 17
Allocation of Safety Integrity Levels Safety Circuit meets SIL 2 requirements Patient Monitor meets IEC 60601-1 Class 2 requirements Portable Device: unclear Equivalent Level of Safety SWISSED 2017 Zürich, Dr. David Endler 18
Safety Requirements Safety requirements derived from the safety assessment include Failure rates for failure conditions Threshold values for sensors in supply and exhaust air Emergency procedures level of rigor Maintenance of equipment Item independence of sensors SWISSED 2017 Zürich, Dr. David Endler 19
Integration of System Safety Control Requirements Analysis Requirements Validation Requirements Hazard Assessment Functional Analysis Functional Verification Functional Hazard Assessment Safety Assessment Synthesis Design Verification Fault Tree Analysis, Dependence Diagrams, Markov Analysis Control Derived from ISO/IEC 26702:2007, figure 4 SWISSED 2017 Zürich, Dr. David Endler 20
V&V of Safety Requirements Verification of safety requirements by Test Analysis Demonstration Inspection Continuous monitoring of assumptions SWISSED 2017 Zürich, Dr. David Endler 21
Summary DLR :envihab operated by DLR Institute of Aerospace Medicine Safety standard for this application: state-of-the-art Establish safety requirements early in the lifecycle Establish system description to facilitate safety assessment Design iterations are inevitable Establish substantiation data to pass certification Make system safety integral part of system development SWISSED 2017 Zürich, Dr. David Endler 22