1
System Safety: An Overview

Background

The idea or concept of system safety can be traced to the missile production industry in the late 1940s. It was further defined as a separate discipline by the late 1950s (Moriarty and Roland 1983) and early 1960s, used primarily by the missile, aviation, and aerospace communities. Prior to the 1940s, system designers and engineers relied predominantly on a trial‐and‐error method of achieving safe design. This approach was somewhat successful in an era when system complexity was relatively simple compared with those of subsequent development. For example, in the early days of the aviation industry, this process was often referred to as the fly‐fix‐fly approach to design problems (Moriarty and Roland 1983; Stephenson 1991) or, more accurately, safety‐by‐accident. Simply stated, an aircraft was designed based upon the existing or known technology. It was then flown until problems developed or, in the worst case, it crashed (Figure 1.1). If design errors were determined as the cause (as opposed to human, or “pilot” error), then the design problems would be fixed and the aircraft would fly again. Obviously, this method of after‐the‐fact design safety worked well when aircraft flew low and slow and were constructed of wood, wire, and cloth. However, as systems grew more complex and aircraft capabilities such as airspeed and maneuverability increased, so did the likelihood of devastating results from a failure of the system or one of its many subtle interfaces. This is clearly demonstrated in the early days of the aerospace era (the 1950s and 1960s). As the industry began to develop jet‐powered aircraft and space and missile systems, it quickly became clear that engineers could no longer wait for problems to develop; they had to anticipate them and “fix” them before they occurred. To put it another way: the “fly‐fix‐fly” philosophy was no longer feasible. Elements such as these became the catalyst for the development of systems engineering, out of which eventually grew the concept of system safety. The need to anticipate and fix problems before they occurred led to a new approach – a consideration of the design as a “system.” This means that all aspects of the design of operation (e.g., machine, operator, and environment), must be considered in identifying potential hazards and establishing appropriate controls. Another important part of this “systems” approach to safety is the realization that resources for safety are limited and there must be some logical, reasoned way to apply resources to the most serious potential problems. Systems safety provides this capability. Figure 1.2 shows a simplification of the basic elements of the systems engineering process. It is noted that safety comprises only one part of this integrated engineering design approach (Larson and Hann 1990). Taken one step further, Figure 1.3 demonstrates how the systems approach associated with the initial element of the systems safety engineering process – the design aspect – can support the identification of hazards in the earliest phases of a project life cycle. Only after the accurate identification of hazards has been accomplished, can proper elimination or control measures be determined.

Figure 1.1 The “fly‐fix‐fly” approach, or more accurately “safety‐by‐accident,” focused on fixing design issues after an accident event rather than focusing on accident prevention through design

(Source: United States Air Force / Wikimedia Commons / Public Domain).

Figure 1.2 The system safety engineering process

(Source: Larson and Hann 1990/American Society of Safety Engineers).

Figure 1.3 The systems approach to the consideration of safety from the design phase through product disposal or project termination.

The dawn of the manned spaceflight program in the mid‐1950s also contributed to the growing necessity for safer system design. Hence, the growing missile and space systems programs became a driving force in the development of system safety engineering. Those systems under development in the 1950s and early 1960s required a new approach to controlling hazards such as those associated with weapon and space systems (e.g., explosive components and pyrotechnics, unstable propellant systems, and extremely sensitive electronics). The Minuteman Intercontinental Ballistic Missile (ICBM) was one of the first systems to have had a formal, disciplined, and defined system safety program (Moriarty and Roland 1983). In July of 1969, the U.S. Department of Defense (DOD) formalized system safety requirements by publishing MIL‐STD‐882 entitled “System Safety Program Requirements.” This Standard has since undergone a number of revisions.

The U.S. National Aeronautics and Space Administration (NASA) soon recognized the need for system safety and has since made extensive system safety programs an integral part of space program activities. The early years of our nation's space launch programs are full of catastrophic and quite dramatic examples of failures. During those developing years, it was a known and quite often stated fact that our missiles and rockets just don't work, they blow up. The many successes since those days can be credited in large part to the successful implementation and utilization of a comprehensive system safety program. However, it should be noted that the Challenger disaster in January 1986 and the loss of the orbiter Columbia upon reentry in February of 2003 stand as historic reminders to us all that, no matter how exact and comprehensive a design or operating safety program is considered to be, the proper management of that system is still one of the most important elements of success. This fundamental principle is true in any industry or discipline.

Eventually, the programs pioneered by the military and NASA were adopted by industry in such areas as nuclear power, refining, mass transportation, chemicals, healthcare, and computer programming.

Today, the system safety process is still used extensively by the various military organizations within the DOD, as well as by many other federal agencies in the United States such as NASA, the Federal Aviation Administration, and the Department of Energy. In most cases, it is a required element of primary concern in the federal agency contract acquisition process.

Although it would not be possible to fully discuss the basic elements of system safety without comment and reference to its military/federal connections, the primary focus of this text shall be placed upon the advantages of utilizing system safety concepts and techniques as they apply to the general safety arena. In fact, the industrial workplace can be viewed as a natural extension of the past growth experience of the system safety discipline. Many of the safety rules, regulations, statutes, and basic safety operating criteria practiced daily in the industry today are, for the most part, the direct result of a real or perceived need for such control doctrine. The requirement for safety controls (written or physical) developed either because a failure occurred, or someone with enough foresight anticipated a possible failure and implemented controls to avoid such an occurrence. Even though the former example is usually the case, the latter is also responsible for the development of countless safe operating requirements practiced in the industry today. Both, however, are also the basis upon which system safety engineers operate.

The first method, creating safety rules after a failure or accident, is likened to the fly‐fix‐fly approach discussed earlier. The second method, anticipating a potential failure and attempting to avoid it with control procedures, regulations, etc., is exactly what the system safety practitioner does when analyzing system design or an operating condition or method. However, when possible or practical, the system safety concept goes a step further and actually attempts to engineer the risk of hazard(s) out of the process. With the introduction of the system safety discipline, the fly‐fix‐fly approach to safe and reliable systems was transformed into the identify, analyze, and eliminate (Abendroth and Grass 1987) method of system safety assurance.

We have established the basic connection between the system safety discipline and its relationship to the general industry occupational safety practice. This conceptual relationship will be examined in more detail throughout this text.

The Difference Between Industrial Safety and System Safety (Leveson 2005)

Industrial safety, or occupational safety, has historically focused primarily on controlling injuries to employees on the job. The industrial safety engineer usually is dealing with a fixed manufacturing design and hazards that have existed for a long time, many of which are accepted as necessary for operations. Traditionally, more emphasis is often placed on training employees to work within this environment rather than on removing the hazards.

To perform their charter, industrial safety engineers collect data during the operational life of the system and attempt to eliminate or control unacceptable hazards where possible or practical. When...