The use of safety cases in certification and regulation

13 March 2014

Nancy G. Leveson, Professor of Aeronautics and Astronautics/Engineering Systems at MIT, takes a sceptical look at the use of safety cases in the certification and regulation of complex systems, and proposes an alternative approach.

Photo: Stephen Meese /
Photo: Stephen Meese /

Although I had heard of safety cases some time ago, I never gave the topic much attention until I got involved with the Presidential Oil Spill Commission (on Deepwater Horizon) and started serving on an advisory committee to the new agency set up to regulate offshore oil drilling in the United States. Industry has exerted some pressure to adopt safety cases for this industry so the advisory committee has been carefully studying the ramifications of adopting such an approach.

For the last couple of years I have been investigating this topic in the engineering and law literature and have become concerned by the push to use safety cases in the certification and regulation of systems in all industries, particularly for software-intensive systems. This paper describes what I have learned and my conclusions about the usefulness (and dangers) of this approach.

Certification of safety-critical systems is usually based on evaluation of whether a system or product reduces risk of specific losses to an acceptable level. There are major differences, however, in how that decision is made and on what evidence is required. The term Safety Case has become popular recently as a solution to the problem of regulating safety-critical systems.

The term arises from the Health and Safety Executive (HSE) in the UK, but different definitions seem to be rife. To avoid confusion, this paper uses the term “safety case” to denote the use of a structured argument for why the system is safe and examines the use of safety cases and some dangers associated with their use.

First, it should be noted that safety is a system property, not a property of the individual components. It makes no sense to talk about software or even a hardware component by itself being safe or unsafe except in a particular system. Many serious losses have occurred when software that was safe in one system was reused in another one [Leveson, 1995 and 2012].

Certification must consider all the aspects of the system, including the hardware, software, operators, and environment in which it will be used. Potential component failure is only one aspect that must be considered; certification must also consider system design flaws, unsafe interactions among components, human factors arising from the operator or user interacting with the system, and so on.

A final general principle is that certification is not a one-time effort. Systems must continue to operate safely throughout their life even when the system itself changes, the users and operators change their behaviour over time, and the environment (and the assumptions about that environment used during design and the original hazard analysis) changes over time.

Any evaluation of certification approaches must consider these principles as well as other aspects, such as those in the legal, political, and moral realm. The first important distinction to consider is between types of regulation.

Types of regulation

Certification methods differ greatly among industries and countries. Approaches commonly used can be broken into two general types, which determine the type of evidence used in the certification process:

1.  Prescriptive: Standards or guidelines for product features or development processes are provided that are used to determine whether a system should be certified.

a.  Product: Specific design features are required, which may be (a) specific

designs or (b) more general features such as fail-safe design or the use of

protection systems.

i).  Specific designs and features provide a way to encode and pass on

knowledge about past experience and lessons learned from past accidents.

In some industries, practitioners are licensed based on their knowledge of

the standards or codes of practice. An example is the existence of electrical

codes based on past experience with various designs. For software, some

completeness criteria for requirements have been identified [Leveson, 1995]

as well as specific design features [Leveson, 2012] based on common flaws

leading to many accidents in the past. Certification then becomes the

responsibility of the licensed practitioner, who can lose their license if they

fail to follow the standards. Organisations may also be established that

produce standards and provide certification, such as the UL rating. It is

difficult to fathom any argument that such encoded knowledge should not be

included in any certification effort. Requiring reinvention of this past

experience for every project would be prohibitively costly and potentially

incomplete and error prone without any clear advantage.

The safety case came out of the report into the Piper Alpha disaster

ii).  Different industries face different safety problems and therefore the general

approach to safe design may differ among them. For example, commercial

aviation has created various types of fail-safe techniques used to protect

against component failures [Follensbee]. Nuclear power, because of differences in the problem, has traditionally used defence in depth and protection systems. For software, such features might include the use of exception handling, checking for out-of-range variables, and designing to reduce the potential for human error when interacting with the software. Certification is usually provided by inspection that the design features

provided are effective and implemented properly.

b.  Process: Here the standards specify the process to be used in producing the product or system or in operating it (e.g., maintenance or change procedures) rather than specific design features of the product or system itself. Assurance is based on whether the process was followed and, sometimes, on the quality of the process or its artifacts. The process requirements may specify

i).  General product or system development processes and their artifacts,such as requirements specifications, test plans, reviews, analyses to be performed and documentation produced (e.g., DO-178B) or

ii).  The process to be used in the safety engineering of the system and not the general development process used for the product (e.g., Mil-Std-882). Only the safety engineering process is specified, not the general development process, which is up to the system developers.

2.  Performance-based or goal-setting approaches focus on desired, measurable outcomes, rather than required product features or prescriptive processes, techniques, or procedures.

The certification authority specifies a threshold of acceptable performance and often but not always a means for assuring that the threshold has been met. Basically, the standards set a goal, which may be a risk target, and usually it is up to the assurer to decide how to accomplish that goal. Performance-based regulation specifies defined results without specific direction regarding how those results are to be obtained. An example is a requirement that an aircraft navigation system must be able to estimate its position to within a circle with a radius of 10 nautical miles with some specified probability or that for new aircraft in-trail procedure (ITP) equipment “The likelihood that the ITP equipment provides undetected erroneous information about accuracy and integrity levels of own data shall be less than 1E-3 per flight hour” [RTCA, 2008].

Common certification approaches in the US

While in the past most certification was based on prescriptive methods (either product or process), there has been interest in performance-based regulation and assurance by government agencies, starting in the US during the Reagan administration, often spearheaded by pressure from those being certified. A similar movement, but much more successful, was started in Great Britain around the same time, some of it stemming from the Cullen report on the Piper Alpha accident [Cullen, 1990].

Certification in the US primarily uses prescriptive methods, but mixes the two types (product and process). Commercial aircraft, for example, are certified based on airworthiness standards requiring specific features (such as oxygen systems and life preservers), and more general features such as fail-safe design. Certification also requires the use of various types of safety analysis techniques, such as Fault Hazard Analysis, and general engineering development standards.

While the Nuclear Regulatory Commission requires prescriptive assurance for nuclear power plants, the American Nuclear Society in 2004 called for the use of risk-informed and performance-based regulations for the nuclear industry, arguing that: “Risk-informed regulations use results and insights from probabilistic risk assessments to focus safety resources on the most risk-significant issues, thereby achieving an increase in safety while simultaneously reducing unnecessary regulatory burden produced by deterministic regulations” [American Nuclear Society, 2004]

Similar arguments have been made about Federal Aviation Authority (FAA) regulations and procedural handbooks being  inflexible and inefficient and rule-making taking too long. Recommendations have been made to redesign the rulemaking process by moving to performance-based regulations where appropriate, but this type of certification is controversial, particularly with respect to how the performance goals are set and assured.

Sometimes certification is a one-time activity that follows the development process and occurs before the product or system is allowed to be marketed or used. More commonly and especially for complex systems, such as aircraft, nuclear power plants, and offshore oil exploration, certification may involve both initial approval and oversight of the operational use of the system. Changes to the original system design and certification basis may require recertification activities. All certification is based on evidence that the certification approach has been followed.

Inspection and test may be used if the certification is based on following a product standard. If the certification is based on the process used, engineering artifacts or analyses may be required and reviewed. Performance-based regulation may require a particular type of analysis (such as the use of specific types of probabilistic risk assessment) or may allow any type of reasoning that supports having achieved a particular performance goal.

As an example, the US Department of Defense (DoD) in Mil-Std-882 uses a prescriptive process that details the steps that must be taken in the development of safety-critical systems to ensure they are safe.  The purpose of the safety assessment report (SAR), which is used as the basis for certification, is to describe the results of the prescribed steps in the standard. The SAR contains the artifacts of the prescribed process, such as a Safety Plan (which must be approved by the DoD at the beginning of the development of the system), a Preliminary Hazard Analysis, a System Hazard Analysis, a Subsystem Hazard Analysis, an Operating System Hazard Analysis, etc. The DoD evaluates the quality of the process artifacts provided in the SAR as the basis for approving use of the system.

While NASA has recently been influenced by the nuclear power community emphasis on probabilistic risk analysis, traditionally it has taken (and continues to emphasise) an approach similar to the US DoD.

The US FAA approach for civil aviation has also been overwhelmingly prescriptive and the initial certification based on the quality of the prescribed process used to develop the aircraft and the implementation of various airworthiness  standards in the aircraft’s design. Operational oversight is based on inspection as well as feedback about the safety of the operations process. Recently, the FAA has moved to create a requirement for a safety management system by those developing or operating aviation systems in order to shift more of the responsibility for safety to the airframe manufacturers and airlines.  The type of evidence required is straightforward with prescriptive regulation, but performance-based regulation requires a more complex argument and evaluation strategy. While the term “safety case” may be used in prescriptive regulation, it is more commonly used in a performance or goal-based regulatory regime and that usage is followed here.

The US Navy's SUBSAFE is one of the most successful safety programmes ever

Performance-based regulation and safety cases

Government oversight of safety in England started after the Flixborough explosion in 1974, but the term safety case seems to have emerged from a report by Lord Cullen on the Piper Alpha disaster in the offshore oil and gas industry in 1988 where 167 people died. The Cullen report on the Piper Alpha loss, published in 1990, was scathing in its assessment of the state of safety in the industry [Cullen, 1990]. The Cullen report concluded that safety assurance activities in the offshore oil industry were:

• Too superficial;

• Too generic;

• Too restrictive or poorly scoped;

• Overly mechanistic;

• Demonstrated insufficient appreciation of human factors;

• Were carried out by managers who lacked key competences;

• Were applied by managers who lacked understanding;

• Failed to consider interactions between people, components and systems.

The report suggested that regulation should be based around “goal setting” which would require that stated objectives be met, rather than prescribing the detailed measures to be taken [Whyte, 1997], i.e., performance-based rather than prescriptive. In such a regime, responsibility for controlling risks shifted from government to those who create and manage hazardous systems in the form of self-regulation. This approach has been adopted by the British Health and Safety Executive and applied widely to industries in that country.

The British safety case philosophy is based on three principles [Inge, 2007; Sutton]:

•  Those who create the risks are responsible for controlling those risks.

•  Safe operations are achieved by setting and achieving goals rather than by following prescriptive rules. While the government sets goals, the operators develop what they consider to be appropriate methods to achieve those goals. It is up to the managers, technical experts, and the operations/maintenance personnel to determine how accidents should be avoided.

•  All risks must be reduced such that they are below a specified threshold of acceptability.

When performance-based or goal-based certification is used, there are differences in how the performance or goals are specified and how the evaluation will be performed. In 1974, the creation of the Health and Safety Executive (HSE) was based on the principle that safety management is a matter of balancing the benefits from undertaking an activity and protecting those that might be affected by it, essentially cost-benefit analysis (CBA). The HSE also instituted the related concept of ALARP or “as low as reasonably practical” and widely used probabilistic risk analysis as the basis for the goals. Each of these is controversial [HSE, 2005].

The nuclear power industry was probably the first to use probabilistic risk analysis as a basis for certification. In the United Kingdom, the Nuclear Installations Act of 1965 required covered facilities to create and maintain a safety case in order to obtain a license to operate. The nuclear industry has placed particular emphasis on the use of Probabilistic Risk Assessment (PRA) with the use of techniques such as Fault Tree and Event Tree Analysis. Because of the use of standard designs in the nuclear power community and very slow introduction of new technology and innovation in designs, historical failure rates are often determinable.

Other potentially high-risk industries, such as the US nuclear submarine community, take the opposite approach. For example, SUBSAFE does not allow the use of PRA [Leveson, 2012]. Instead, they require OQE (Objective Quality Evidence), which may be qualitative or quantitative, but must be based on observations, measurements, or tests that can be verified. Probabilistic risk assessments, for most systems, particularly complex systems, cannot be verified.

A second unique aspect of the British approach to safety assurance and required by the HSE is argumentation and approval based on whether risks have been reduced as low as is reasonably practicable (ALARP). Evaluating ALARP involves an assessment of the risk to be avoided, an assessment of the sacrifice (in money, time and trouble) involved in taking measures to avoid that risk, and a comparison of the two. The assumed level of risk in any activity or system determines how rigorous, exhaustive and transparent the risk analysis effort has been. “The greater the initial level of risk under consideration, the greater the degree of rigour required to demonstrate that risks have been reduced so far as is reasonably practicable” [Heiler, 2005].

The application of ALARP to new systems, where “reasonably practical” has not yet been defined, is questionable. Not increasing the accident rate in civil aviation above what it is today does seem like a reasonable goal given the current low rate, for example, but it is not clear how such an evaluation could be performed for the new technologies (such as satellite navigation and intensive use of computers) and the new and very different procedures that are planned. In addition, safety cases are strictly confidential in the UK; only company officials, regulators, and, in limited circumstances, worker representatives are allowed to see the entire plan. This type of confidentiality would be unlikely to be acceptable in the US [Steinzor, 2010].

While none of these more controversial aspects of assurance and certification need to be present when using a “safety case” approach, they are part and parcel of the history and foundation of safety cases and performance-based regulation.

Potential Limitations of Safety Cases

A “safety case” may be and has been defined in many ways. In this paper, the term is used to denote an argument that the system will be acceptably safe in a given operating context. The problem is that it is always possible to find or produce evidence that something is safe. Unlike proving a theorem using mathematics (where the system is essentially “complete” and “closed,” i.e., it is based on definitions, theorems and axioms and nothing else), a safety analysis is performed on an engineered and often social system where there is no complete mathematical theory to base arguments and guarantee completeness. (But even with such a mathematical basis, published and widely accepted mathematical proofs are frequently found later to be incorrect.)

In fact, it can be argued that no system is completely safe so the goal of the argument is untrue before starting. If instead the goal is to show the system is “acceptably” safe, the problem simply devolves to defining what is “acceptable” and to whom: to the producer of the system who is paying the cost of making it safe or to the potential victim? The concept of ALARP is the British attempt to answer that question, but, as discussed above, that concept is unlikely to be acceptable in the US legal system and the results of Pinto and other cases have demonstrated the fallacies in using cost/benefit analyses where the costs of fixing the gas tank design problem were clear but the number of victims and amount to be paid in liability claims was underestimated.

NASA continues to follow a prescriptive approach similar to the US DoD
NASA continues to follow a prescriptive approach similar to the US DoD

The main problem with the use of arguments for safety or acceptable safety in the safety case approach to certification lies in psychology and the notion of a mindset or frame of reference.

“In decision theory and general systems theory, a mindset is a set of assumptions, methods or notations held by one or more people or groups of people which is so established that it creates a powerful incentive within these people or groups to continue to adopt or accept prior behaviors, choices, or tools. This phenomenon of cognitive bias is also sometimes described as mental inertia, groupthink, or a paradigm, and it is often difficult to counteract its effects upon analysis and decision-making processes” [Wikipedia].

An important component of mindset is the concept of confirmation bias. Confirmation bias is a tendency for people to favour information that confirms their preconceptions or hypotheses regardless of whether the information is true. People will focus on and interpret evidence in a way that confirms the goal they have set for themselves. If the goal is to prove the system is safe, they will focus on the evidence that shows it is safe and create an argument for safety. If the goal is to show the system is unsafe, the evidence used and the interpretation of available evidence will be quite different. People also tend to interpret ambiguous evidence as supporting their existing position [Dekker, 2006].

Experiments have repeatedly found that people tend to test hypotheses in a one-sided way, by searching for evidence consistent with the hypothesis they hold at a given time [Kunda, 1999; Nickerson, 1998]. Rather than searching through all the relevant evidence, they ask questions that are phrased so that an affirmative answer supports their hypothesis. A related aspect is the tendency for people to focus on one possibility and ignore alternatives. In combination with other effects, this one-sided strategy can obviously bias the conclusions that are reached.

Confirmation biases are not limited to the collection of evidence. The specification and interpretation of the information is also critical. Fischoff, Slavin, and Lichtenstein conducted an experiment in which information was left out of fault trees. Both novices and experts failed to use the omitted information in their arguments, even though the experts could be expected to be aware of this information. Fischoff et al [1978] attributed the results to an “out of sight, out of mind” phenomenon. In related experiments, an incomplete problem representation impaired performance because the subjects tended to rely on it as a comprehensive and truthful representation—they failed to consider important factors omitted from the specification [Vicente and Rasmussen, 1992]. It is very likely that this same non-recognition of omissions in the argument will occur when certifiers evaluate the evidence provided in safety cases.

Does this type of confirmation bias in safety cases occur or is it just a theoretical phenomenon? Every safety case published in papers promoting safety cases for software has seemed terribly flawed to me but obviously not to the authors or reviewers. For example, one argument was advanced to support the case that “the software was fault free.”(A reference is purposely not provided here for obvious reasons.)

It’s not clear what “fault free” means in software or that this goal has ever been achieved in real software—errors  have been found in nearly every piece of non-trivial software when used in operational settings.

Part of the argument for this goal in the safety case is that the fault tree did not find any contribution of the software to an accident. While this argument has nothing to do with being fault free, it could potentially apply to the goal “the software will be safe.” The problem is that most fault trees are incomplete and not including software in them is common. In addition, design errors and interaction problems are rarely identified in fault trees. A second argument in support of the goal showing the software is fault free involves the evidence that “hazard-directed test results did not find any software faults leading to a hazard. It’s not clear what “hazard-directed testing” might be as it is not possible to test for safety.(Accidents often occur when the requirements are incomplete or wrong or assumptions about the usage environment are incorrect. Testing necessarily is based on the requirements and assumptions about the design and usage of the system.)

More important, Dijkstra’s aphorism about testing being able only to show the presence of errors and not their absence is clearly true. Just because the testing did not find a fault in the software leading to a hazard is not proof that such faults to do exist. The same is true for hazard analysis: System safety engineers who perform hazard analyses are well aware that their analysis can, like testing, only identify some paths to some hazards (the ones analysed) and does not in any way “prove” that the system will be safe or hazard free.

Confirmation bias problems are not easy to eliminate. But they can be reduced by changing the goal. A company in which the author is a co-owner was recently hired to conduct a non-advocate safety assessment of the new US Missile Defense system for the hazard “inadvertent launch,” which was the major concern at the time [Pereira, Lee, Howard, 2006]. The system safety engineers conducting the independent safety assessment did not try to demonstrate that the system was safe, everyone was already convinced of that and they were going to deploy the system on that belief. The developers thought they had done everything they could to make it safe. They had basically already constructed a “safety case” argument during development that would justify their belief in its safety. By law, however, the government was required to perform an independent risk analysis before deployment and field testing would be allowed. The goal of our independent assessment was to show that there were scenarios where inadvertent launch could occur, not to show the system was safe. The analysis found numerous such scenarios that had to be fixed before the system could be deployed, resulting in a six month delay for the Missile Defense Agency and expenditure of a large amount of money to fix the design flaws. The difference in results was partly due to the use of a new, more powerful analysis method but it also involved the different mindset and the different goal, which was to identify unrecognized hazards (ways inadvertent launch could occur) rather than to argue that the system was safe (that inadvertent launch could not occur).

Engineers always try to build safe systems and to verify to themselves that the system will be safe. The value that is added by system safety engineering is that it takes the opposite goal: to show that the system is unsafe. Otherwise, safety assurance becomes simply a paper exercise that repeats what the engineers are most likely to have already considered. It is for exactly this reason that Haddon-Cave recommended in the Nimrod accident report that safety cases should be relabelled “risk cases” and the goal should be “to demonstrate that the major hazards of the installation and the risks to personnel therein have been identified and appropriate controls provided” [Haddon-Cave, 2009], not to argue the system is safe.

A final potential problem with safety cases, which has been criticized in the off-shore oil industry approach to safety cases and with respect to the Deepwater Horizon accident (and was also involved in the Fukushima Daichi nuclear power plant events), is not using worst-case analysis [Houck, 2010]. The analysis is often limited to what is likely or expected, not what could be catastrophic. Simply arguing that the most likely case will be safe is not adequate: Most ]accidents involve unlikely events, often because of wrong assumptions about what is likely to happen and about how the system will operate or be operated in practice. Effective safety analysis requires considering worst cases.

But while theoretical arguments against safety cases are interesting, the proof is really “in thepudding.” How well have they worked in practice?

Experience with safety cases

Investigators said the RAF Nimrod safety case was “virtually worthless as a safety tool”

Unfortunately, careful evaluation and comparison between certification approaches has not been done. Most papers about safety cases express personal opinions or deal with how to prepare a safety case, but do not provide data on whether it is effective. As a result, there is no real evidence that one type of regulation or certification is better than another.

One way to compare approaches is to use past experience. The use of performance-based regulation has not necessarily proven to be better than the other approaches in actual use. One of the most effective safety programs ever established, SUBSAFE [Leveson, 2012], which has had no losses in the past 48 years despite operating under very dangerous conditions, is the almost total opposite of the goal-based orientation of the British form of the safety case. The spectacular SUBSAFE record is in contrast to the US experience prior to the initiation of SUBSAFE, when a submarine loss occurred on average every two to three years. SUBSAFE uses a very prescriptive approach, as does the civil aviation community, which has also been able to reduce accident rates down to extremely low levels and keep them there despite the tendency to become complacent after years of having very few accidents.

Despite claims of successful use of safety cases in offshore oil exploration in the UK, accidents have occurred. In addition, a British study of conditions in the North Sea suggests alarming neglect of the physical infrastructure that ensures safety, further undermining, according to Steinzor [2010], claims that use of safety cases is as effective as its advocates claim.

The use or at least poor use of safety cases has been implicated in some accident reports. The best known of these is the Nimrod aircraft crash in Afghanistan in 2006. A safety case had been prepared for the Nimrod, but the accident report concluded that the quality of that safety case was gravely inadequate [Haddon-Cave, 2009]:  “. . . the Nimrod safety case was a lamentable job from start to finish. It was riddled with errors. . . Its production is a story of incompetence, complacency, and cynicism … The Nimrod Safety Case process was fatally undermined by a general malaise: a widespread assumption by those involved that the Nimrod was ‘safe anyway’ (because it had successfully flown for 30 years) and the task of drawing up the Safety Case became essentially a paperwork and ‘tickbox’ exercise.”

The criticisms of safety cases contained in the Nimrod report include:

•  Use of safety cases has led to a culture of ‘paper safety’ at the expense of real safety. It currently does not represent value for money.

•  The current shortcomings of safety cases in the military environment include: bureaucratic length; their obscure language; a failure to see the wood for the trees; archaeological documentary exercises; routine outsourcing to industry; lack of vital operator input; disproportionality; ignoring of age issues; compliance-only exercises; audits of process only; and prior assumptions of safety and ‘shelf-ware’.

•  Safety cases were intended to be an aid to thinking about risk but they have become an end in themselves.

•  Safety cases for ‘legacy’ aircraft are drawn up on an ‘as designed’ basis, ignoring the real safety, deterioration, maintenance and other issues inherent in their age.

•  Safety cases are compliance-driven, i.e., written in a manner driven by the need to comply with the requirements of the regulations, rather than being working documents to improve safety controls. Compliance becomes the overriding objective and the argumentation tends to follow the same, repetitive, mechanical format which amounts to no more than a secretarial exercise (and, in some cases, have actually been prepared by secretaries in outside consultant firms). Such safety cases tend also to give the answer that the customer or designer wants, i.e. that the platform is safe.

•  Large amounts of money are spent on things that do not improve the safety of the system

Lord Haddon-Cave, the author of the Nimrod accident report, concluded that safety cases should be renamed “risk cases” and made the following recommendations (among others):

•  Care should be taken when utilizing techniques such as Goal Structured Notation or  ‘Claims-Arguments-Evidence’ to avoid falling into the trap of assuming the conclusion (‘the platform is safe’), or looking for supporting evidence for the conclusion instead of carrying out a proper analysis of risk. (Note the similarity to the concerns expressed in earlier about mindset and confirmation bias.)

•  Care should be taken when using quantitative probabilities, i.e. numerical probabilities such as 1 x 106 equating to “Remote”. Such figures and their associated nomenclature give the illusion and comfort of accuracy and a well-honed scientific approach. Outside the world of structures, numbers are far from exact.

•  Care should be taken when using historical or past statistical data. The fact that something has not happened in the past is no guarantee that it will not happen in the future. Piper Alpha was ostensibly “safe” on the day before the explosion on this basis. The better approach is to analyse the particular details of a hazard and make a decision on whether it represents a risk that needs to be addressed.

•  Care needs to be taken to define the process whereby new hazards can be added to the Risk Case, incorporated in the Hazard Log, and dealt with in due course, and how original assumptions about hazards or zones are to be re-examined in light of new events.

•  Once written, the safety case should be used as an on-going operational and training tool. There are all too many situations where a comprehensive safety case is written, and then it sits on a shelf, gathering dust, with no one paying attention to it. In such situations there is a danger that operations personnel may take the attitude, “We know we are safe because we have a safety case”.

In Norway, the regulatory authority has about 100 employees performing compliance and audit-related tasks for 105 offshore installations. In contrast, US regulators have about 60 inspectors for more than 3,500 offshore installations

Practical considerations in the use of safety cases

The validity of the argument in each safety case needs to be evaluated individually by a certification authority [Wassyng, 2011]. How can this be done? If every submission is different, it will be difficult to evaluate them in a systematic way, so certification of different systems may occur using different criteria. If certification only occurs within a company in an unregulated industry, will the argument really be evaluated in an independent and unbiased way?

Where will people qualified to do this evaluation be found? Such evaluation would be extremely time and resource consuming and potentially costly [Wassyng, 2011]. Companies complain already about the long waits involved in certification. In addition, regulatory agencies are notoriously understaffed and underfunded but the safety case requires a well-resourced and competent regulator.

As an example, consider again offshore oil exploration. The UK and Norway, which use the safety case approach for the North Sea, employ a large number of highly educated personnel and technical specialists to perform audits, inspections and review required documents.  In Norway, the regulatory authority has 160 employees, of which approximately 100 perform compliance and audit related tasks regulating 105 offshore installations. Each of these 100 employees has a postgraduate (Masters Degree) or equivalent level of training in one or more areas of expertise, including drilling, petroleum engineering, structural engineering, and reliability engineering.  In contrast, the US Bureau of Safety and Environmental Enforcement (BSEE) and the US Coast Guard share approximately 60 billeted offshore inspectors for over 3,500 offshore installations [Steinzor, 2010].

Another practical consideration is the role of stakeholders in the certification process. Historically, users of products and systems were expected to evaluate the safety of these products themselves and assume responsibility for using them. But systems have become so complex that this process is no longer possible. I cannot evaluate the safety of an aircraft before I decide to fly on it so I must trust in the regulatory authorities to make this determination. However, historically, stakeholders and engineers and scientists outside the company involved have participated in creating the product-based and process-based standards and sometimes even the certification process itself so blind trust in government agencies to ensure my safety is not required.

External evaluation of the certification processes by stakeholders such as airline passengers and pilots or those living in the vicinity of nuclear power plants is possible. For example, in the commercial aviation realm, Radio Technical Commission for Aeronautics (RTCA) committees that define certification procedures are open to everyone, including pilots and pilot unions and airline passenger associations. For the Traffic Collision Avoidance System (TCAS), pilots participated directly in the certification process as did anyone in the country with an interest in participating. Stakeholders cannot see proprietary company data, but they can help determine the process for evaluating that data.

With the safety case approach, each case could be presented using different evidence and the company itself determines what argument is provided. Stakeholders are effectively shut out of the certification process.

An alternative to safety cases in the certification of complex systems

Any viable certification approach will almost certainly contain both types of prescriptive certification. Product-based certification ensures that lessons of the past are considered in new systems and that more general design approaches determined over time to be useful in that industry and for the types of systems being designed and operated are implemented in new designs. Process-based certification ensures consistency of certification decisions, stakeholder inputs and participation, and more efficient and cost-effective implementation of the certification process.

There may be many potentially useful certification approaches that have these characteristics. In addition, there may be instances where goal or performance based certification is appropriate, particularly if there is an accepted and scientifically viable means for evaluating the achievement of the goal.

Some general features of acceptable (at least to the author) certification approaches include the following:

1.  Certification should include a plan submitted early to the certifying authority outlining the way the system will be certified to be safe. Such a plan is required in MIL-STD-882. It allows flexibility in the way that the standard is applied. Tailorable standards are also important in providing flexibility. MIL-STD-882, for example, is written as a set of independent tasks, not all of which are appropriate for every project. The certification authority can approve the company’s plan or request modifications. Note that this approach is similar to that used in approval of pharmaceuticals by the FDA. The plan will also include the accidents (losses) and specific hazards to be considered. In some industries, these losses and hazards are actually defined by the government regulator and are not at the discretion of the designer or operator of the system. This plan should include how safety will be designed into the system from the beginning and not just argued in at the end. It should also include a plan for maintaining the certification throughout the life time of the product or system.

2.  The certification process should require a hazard analysis and information about how the hazards considered were eliminated or controlled. Ideally, the hazard analysis techniques used should be at the discretion of the applicant in order to allow practices to include new approaches without waiting years for them to be approved through a leaden international committee process. The agency or industry standards can specify the types of results that should be obtained and the factors to be considered (including software, human factors, and operations) but should allow discretion in the way they are obtained. The specific hazard analysis techniques to be used can be included in the certification plan and thus approved or not by the certifier at the beginning of the development process.

3.  Deliverables to the agency should include the limitations of what was done and the uncertainties, and assumptions underlying the analyses and design procedures used.

To avoid confirmation bias and compliance-only exercises, certification should focus not on showing that the system is safe but in attempting to show that it is unsafe. It is the emphasis and focus on identifying hazards and flaws in the system that provides the “value-added” of system safety engineering. The system engineers have already created arguments for why their design is safe. The effectiveness in finding safety flaws by system safety engineers has usually resulted from the application of an opposite mindset from that of the developers.

Whatever is included in the certification process, the following characteristics seem important:

•  The process should be started early. The analysis done for certification is only useful if it can influence design decisions. That means it should not be done after a design is completed or prepared in isolation from the system engineering effort. If safety cases are created only to argue that what already exists is safe, then the effort will not improve safety and becomes, as apparently has happened in the past, simply a paper exercise to get a system certified. One unfortunate result might be unjustified complacency by those operating and using the systems.

•  The assumptions underlying the certification decision should be continually monitored during operations and procedures established to accomplish this goal. The system may be working, but not the way it was designed or the assumptions may turn out to be wrong, perhaps because of poor prediction or because the environment has changed.  Changes to the system and its environment may have been made for all the right reasons, but the drift between the system as designed and the system as enacted is rarely if ever analysed or understood as a whole, rather than each particular deviation appearing sensible or even helpful to the individuals involved.

•  To make maintaining the certification feasible, the analysis needs to be integrated into system engineering and system documentation so it can be maintained and updated. Certification should not be just a one-time activity but must continue through the lifetime of the system, including checking during operations that the assumptions made in the certification decision remain true for the system components and the system environment. In the author’s experience, the major problems in updating and maintaining documentation and certification arise in relating the analysis to the detailed design decisions.  When a system design or operating environment is changed, it must be possible to determine what assumptions in the hazard analysis are involved and must be revisited. Starting a new hazard analysis from scratch is just not feasible.

•  The analysis should consider worst cases, not just the likely or expected case (the latter is called a design basis accident in nuclear power plant regulation).

•  The analysis needs to include all factors, that is, it must be comprehensive. It should include not just hardware failures and operator errors but also management structure and decision-making. It must also consider operations and the updating process for the analysis must not be limited to development and certification but must continue through the operational part of the system life cycle.

•  To be most useful, qualitative and verifiable quantitative information must be used, not just probabilistic models of the system.

•  The integrated system must be considered and not just each hazard or component in isolation.

•  The certification process must be practical to implement with the personnel available in the government certification agency (or the company if external certification is not involved) or by those licensed by them to accept responsibility for approval.

Parts of this paper appeared in the Nov/Dec 2011 issue of the Journal of System Safety.

About the author: Nancy G. Leveson is a leading American expert in system and software safety. She is Professor of Aeronautics and Astronautics at the Massachussetts Institute of Technology

*American Nuclear Society (2004), "Risk-Informed and Performance-Based Regulations for Nuclear Power Plants," Position Statement 46, June.

*The Hon. Lord Cullen (1990), The Public Inquiry into the Piper Alpha Disaster, Vols. 1 and 2 (Report to Parliament by the Secretary of State for Energy by Command of Her Majesty, November).

*Sidney Dekker (2006), The Field Guide to Understanding Human Error, Ashgate Publishers.

*B. Fischoff, P. Slovic, and S. Lichtenstein (19780, "Fault Trees: Sensitivity of Estimated Failure Probabilities to problem Representation," Journal of. Experimental Psychology: Human Perception and Performance, vol. 4.

*Charles Haddon-Cave (2009), The Nimrod Review, HC 1025, London: The Stationery Office Limited, Oct. 28.

*Health and Safety Executive (2005), "Safety Case Regulations for Offshore Oil Drilling."

*Kathryn Heiler (2005), "Is the Australian Mining Industry Ready for a Safety Case Regime, 31st International Conference of Safety in Mines Research Institute, Brisbane, Australia, Oct. 2005.

*Oliver A. Houck (2010), "Worst Case and the Deepwater Horizon Blowout: There Ought to be a Law," Environmental Law Reporter, 40 ELR 11036, Nov.

*J.R. Inge (2007), "The Safety Case: Its Development and Use in the United Kingdom," Equipment Safety Assurance Symposium 2007, Bristol U.K.

*Kunda, Ziva (1999), Social Cognition: Making Sense of People, MIT Press, ISBN 9780262611435, OCLC 40618974.

*N.G. Leveson (1995), Safeware: System Safety and Computers, Addison Wesley Publishers.

*N.G. Leveson (2012), Engineering a Safer World, MIT Press.

*Nickerson, Raymond S. (1998), "Confirmation Bias; A Ubiquitous Phenomenon in Many Guises", Review of General Psychology (Educational Publishing Foundation) 2 (2): 175–220,

*NOPSA (2005),

*Steven J. Pereira, Grady Lee, and Jeffrey Howard (2006). "A System-Theoretic Hazard Analysis Methodology for a Non-advocate Safety Assessment of the Ballistic Missile Defense System," AIAA Missile Sciences Conference, Monterey, CA, Nov.

*Rasche, T (2001), "Development of a safety case methodology for the Minerals Industry – a discussion paper," MISHC, University of Queensland.

*RTCA (2008), "Safety, Performance and Interoperability Requirements Document for the In-Trail Procedure in the Oceanic Airspace (ATSA-ITP) Application," DO-312.

*Rena Steinzor (2010), “Lessons from the North Sea: Should ‘Safety Cases’ Come to America?” Boston College Symposium on Environmental Affairs Law Review.

*Ian Sutton, "Preparing and Managing a Safety Case in the Process Industries,"

*Vectra Group, "Literature Review on the Perceived Benefits and Disadvantages of the UK Safety Case Regime”, at

*K.J. Vicente and J. Rasmussen (1992), "Ecological Interface Design: Theoretical Foundations," IEEE Trans. Systems, Man, and Cybernetics, vol. 22, no. 4, July/Aug.

*Alan Wassyng, Tom Maibaum, Mark Lawford, and Hans Bherer (2011), “Software certification: Is there a case against safety cases?,” in R. Calinescu and E. Jackson (eds.), Monterey Workshops 2010, LNCS 6662, Springer-Verlag, pp. 206-227.

*D. Whyte (1997), “Moving the goalposts: The deregulation of safety in the post Piper Alpha offshore oil industry,”

*P. Wilkinson (2002), “Safety case: success or failure?” Seminar paper 2 National Research Centre for OHS Regulation, ANU Canberra

*Wikipedia, Mindset,

Print this page | E-mail this page

CSA Sira Test


Foodgrains bank issues appeal

Due to the wonders of modern technology, Mark Maciek can speak directly to his relatives back in war-ravaged eastern Africa.

Due to an ongoing tragedy, the South Sudanese refugee hears disturbing news when he calls.

“They are hungry,” said Maciek during a fundraising event in an inner city Winnipeg church to raise money to help desperate South Sudanese refugees survive an epic famine.

“I have to support them.”

Famine is gripping millions of people in east-central Africa, as ongoing civil war in the new nation of South Sudan has caused waves of terrified refugees to flood over the Ugandan and Ethiopian borders. It exacerbates a decades-old situation of poverty and persecution that provoked earlier waves of refugees like Maciek to flee.

The South Sudanese event was organized by the Canadian Foodgrains Bank at the end of June to help raise money to take advantage of federal government dollar-for-dollar grants that were temporarily available.

The foodgrains bank is known in farming and rural areas, as well as by more than a dozen churches that support the charity. This event was a chance for the charity to focus its energy on a human disaster that is getting comparatively little attention, even though it is being described as the largest humanitarian disaster since 1945.

“We can make a difference,” said retired Anglican priest Cathy Campbell.

“Canadians can make a difference, if we act.”

The foodgrains bank operates a range of overseas efforts with money it raises from farmers, churches and other Canadians. Some are attempts at improving struggling people’s farming skills. Others, like this, involve getting emergency aid and support to those in crisis.

The brutal realities of refugee life were described by South Sudanese women at the event, some of whom saw their children die during the odyssey.

“Scorpions at night; disease; cholera…; malaria,” said Rebecca Deng, a South Sudanese refugee who has helped establish a support centre in South Sudan.

“The worst, worst is when you see the young child, a baby, in a mother’s lap … and then the child passes away.”

Deng arrived in Winnipeg after fleeing from Sudan in 1983 and arriving in Ethiopia as one of 23,000 “lost girls and lost boys.”

She’s now helping organize Winnipeg-based and Canada-based aid for her homeland, but with an estimated 2,000 people fleeing per day, and 20 million people in the famine zone, the task is daunting.

The federal matching funding ended at the end of June, but the Canadian Foodgrains Bank is still raising money to help.

The lack of attention to the famine was noted by a number of speakers at the event, and there was little coverage in local media, but foodgrains bank staff and volunteers and the South Sudanese people said they would keep up their efforts.

“I cannot be quiet if I am here,” said Deng.


The Healing Company Reflexology and Reiki for Cheltenham

Havening Techniques®. HaveningLogo

What is Havening?

Release past trauma and unpleasant memories

Havening is a break-through method which alters the brain landscape to permanently remove the negative effects of traumatisation and pathologically stuck emotions. Sessions can be given in person or by Skype.

This exciting new therapy has three distinct applications:

  • Emotional disturbances and encoded psychological trauma
  • Wellness, stress management, and peak performance
  • As a self-help tool

    This psycho-sensory therapy is gentle and suitable for most clients to do themselves given the correct guidance from a certified practitioner.

  • Havening Techniques®. Haveningmovements

    What happens in a Havening session?

    We will first chat about the situation you would like to change, and see whether Havening can help.

    Once we agree to work together, the painful memory is activated, gentle touch is applied to the hands, arms and face and distraction exercises are used. This creates the necessary conditions in the brain to remove the receptors that trigger distressing emotions and physical content of a trauma based memory.

    If the client doesn't feel comfortable disclosing some the content of an event the therapist does not need to know all the details.

    Here's a great little video explaining how it works...

      “When an event or experience is perceived as traumatic or very stressful it becomes immutably encoded, often with life-altering consequences. However, recent research from the field of neuroscience has shown us how it's possible to modify this encoding.”
      Dr Ron Ruden MD PhD (Developer)

    Janie Whittemore is a certified practitioner of Havening Techniques. Havening Techniques is a registered trade mark of Ronald Ruden, 15 East 91st Street, New York.

    ©2017 The Healing Company is powered by WebHealer


The Macmillan Prize for Illustration 2017

The Macmillan 2017 illustration contest

I believe that bringing a child’s story to life with the help of illustration is one of the most difficult things in a graphic designer’s life, or an illustrator’s, for that matter.

Just because the stories are for the young mind of naïve children, it doesn’t mean that the work going into imagining the key moments is easy. On the contrary. You are responsible with shaping and molding the imagination of children. Probably stimulating it so far as to helping them become a creative adult.

I remember many of my childhood’s books and stories because of the drawings. Some of them left a strong mark on how I later saw the world, most importantly what I wished it to be. The images showed me things that the words failed to render. Or possibly conceal.

For 32 years MacMillan Children’s Books aims to reward all talented students that manage to perfectly merge words and text, providing a memorable and distinctive representation of the story’s key points. The MacMillan Prize 2017 is the perfect opportunity for illustrators in art school to jump start their professional carriers.

There will be three winners, with a grand prize of £1000, and other two of £500 and £250 respectively.

You can create an original story or include the text of traditional fairy tales. But it is important for it not to be copyrighted. Especially relevant is the composition. Most of all the illustration needs to be meaningful and powerful enough to render the atmosphere of the story.

There is a detailed outline of the requirements is available on the official page. The deadline is April 20th.

Therefore, if you qualify and have a passion for illustration and storytelling, this illustration contest is your golden ticket!

Below you can see the works of the 2015 and 2016 winners, Shu-Ti Liao with Adventure at Night and Grace Suen with Hide and Seek:

illustration contest

Adventurer’s Night

book illustration

Hide and Seek


Skip to main content

Array in C language

In this chapter, we will discuss a very important data type arrays. Let us see, “Why arrays?’’
We know that in one variable we can store the information of only one  data item. Suppose that a
Student has scored 90 marks. These marks can be stored in a variable as shown below:

int marks=90;

After executing this statement, the value 90 will be stored in the variable marks. Suppose there is
A need to store marks of 10 students. In such case, we are forced to use 10 variables like marksl,
Marks2… marks10. But, if it is required to store the marks of 100 students, definitely it is not
Feasible to use 100 variables marksl ,marks2…marks100, Now, the question is “How to store 100
different marks?” In mathematics, we use sets to group the items of similar kind, For example,
consider the set shown below :

marks = {80,90,45,99,100,36,88,96,67,92}

This is a set of marks of `10 students. Note that every item can be accessed by prefixing marks along
With the position of marks in the set. The first item 80 corresponds to the marks of first student,90
Corresponds to the marks of second student and so on i.e., marks1=80, marks2=90…marks 10=92.
In C language, this is where, the concept of arrays is used. Since all the marks are of the same type,
We can group and refer all the marks  with a common name using arrays.
Note: In general, if more number of data items of same type (kind) are to be accessed or read
or stored, then we use arrays.

The meaning of an array

Definition : An array is defined as an ordered set of similar data items. All the data items of
an array are stored in consecutive memory locations in main memory . The elements of an array
are of same data type and each item can be accessed using the same name. e.g. consider an
array of marks of 5 students as shown below:

To refer an item in the array, we specify the name of the array along with position of the item. The
Position of the item must be written within square brackets ‘ []’.  The position of the item, The item enclosed within square brackets is called ‘subscript’ or ‘index’.

For example, the above figure represents an integer array called marks where marks of 5 students
Are stored. The marks of each student can be accessed as shown below:

       marks[0] i.e. 80 – represent marks of first student
       marks[ 1] i.e. 90- represent marks of second student
       marks[2] i.e. 45- represent marks of third student
      marks [3] i.e. 99- represent marks of fourth student
       marks[4] i.e. 100 – represent marks of fifth student

Thus using marks [0] through marks[4]  we can access the  marks of 5 students.
Note: Using marks [0] through marks [n-1] We can access the marks of n students in general.
In an array it not possible to have a group of items with different data types. Types. For example,

Is invalid way of storing the elements in an array. This is because, it is a collection of int,  float, char
and string datatypes. Once we know the definition of an array. The next question is “How arrays
are classified?” The arrays can be classified based on how the data items are arranged for human
understanding. This is pictorially represented as shown below:

Popular posts from this blog

difference between structure and union in C Language

In c language article we will see the difference between union and structure. Both are the user define datatype in c language. See the table which is mentioned below: ASP.NET Video Tutorial Series Structure Union1.The keywordstruct is used to define a structure 1. The keyword union is used to define a union. 2. When a variable is associated with a structure, the compiler allocates the memory for each member. The size of structure is greater than or equal to the sum ofsizes of its members. The smaller members may end with unused slack bytes. 2. When a variable is associated with a union, thecompiler allocates thememory by considering the size of the largest memory. So, size of union is equal to the size of largest member. 3. Each member within a structure is assigned unique storage area of location. 3. Memory allocated is shared by individual members of union. 4. The address of each member will be in ascending order This indicates that memory for each member will start at different offset v…

Difference between Linear search and Binary Search in c language

SQL Video Channel : Download all SQL Video

Binary Search Linear Search Works only on sorted items. such as  1,2,3,4,5,6  etc
Works on sorted as well as unsorted items. 12,4,5,3,2,1 etc Very efficient if the items are sorted Very efficient if the items are less and present in the beginning of the list. such as Suppose your list items are : 12,3,4,5,1 and you want to search 12 number then you get beginning in the list. Works well with arrays and not on linked lists. Works with arrays and linked lists.
Number of comparisons are less More number of comparisons are required if the items are present in the later part of the array or its elements are more.

Memory representation of Linked List Data Structures in C Language

Memory representation of Linked List

             In memory the linked list is stored in scattered cells (locations).The memory for each node is allocated dynamically means as and when required. So the Linked List can increase as per the user wish and the size is not fixed, it can vary.

               Suppose first node of linked list is allocated with an address 1008. Its graphical representation looks like the figure shown below:

      Suppose next node is allocated at an address 506, so the list becomes,

  Suppose next node is allocated with an address with an address 10,s the list become,

The other way to represent the linked list is as shown below:

 In the above representation the data stored in the linked list is “INDIA”, the information part of each node contains one character. The external pointer root points to first node’s address 1005. The link part of the node containing information I contains 1007, the address of next node. The last node …


References in periodicals archive ?
It is not enough to understand the literal meaning of speech.
The standard model of figurative language processing--sometimes referred to as the "indirect" or "sequential" view--maintains that the brain initially analyzes passages for literal meaning and, if the literal interpretation makes no sense, then reprocesses the words for access to an appropriate figurative meaning.
In August of 2004 Alexander Rapp's team of German scientists published a report in Cognitive Brain Research titled "Neural Correlates of Metaphor Processing)' They used event-related fMRI technology to detect brain activity in sixteen healthy subjects as they read short, simple sentences with either a literal or a metaphorical meaning.


Micro Hi-Fi System

Micro Hi-Fi System

CD playback, wall-mountable MC235B/79

How to view my favourite tracks on my Philips system?

To see which tracks are programmed in your list of favorite tracks, please follow the steps below: 1. If you?re playing a CD, press STOP. 2. Press and hold PROGRAM or PROG for 2 seconds. The programmed track numbers will be displayed in sequence.

The information on this page applies to the following models: MC235B/79 , MC235/79 , FWD39/30 , MC230/30 , PSS010/01 , AZ5130/10 , AZ1004/10 , AZ1003/10 . more less

Not what you are looking for?

Did we answer your question?

If not, contact us.


Thomasville market price summary for the 2016 Kia Optima Hybrid

Live in or near Thomasville, NC and need to know what other people are paying for new vehicles? TrueCar provides you with actual prices paid by people around Thomasville for all new 2016 models.


The offering comes over a year after Apple issued its first green bond of $1.5 billion - the largest issued by a U.S. corporation - as a response to the 2015 Paris agreement.

“Leadership from the business community is essential to address the threat of climate change and protect our shared planet,” said Lisa Jackson, Apple's vice president of environment, policy and social initiatives.

Apple Chief Executive Tim Cook was one of several CEOs who directly appealed to Trump to keep the United States in the pact before he made his decision.

The tech giant said proceeds from the green bond sales will be used to finance renewable energy, energy efficiency at Apple facilities and in its supply chain and procuring safer materials for its products.

The offering also includes a specific focus on helping Apple meet a goal of greening its supply chain and using only renewable resources or recycled material, reducing its need to mine rare earth materials.

Last year, Apple allocated $442 million to 16 different projects from renewable energy to recycling from its first bond offer.

One of the projects it funded was a robotic system called Liam to take apart junked iPhones and recover valuable materials that can be recycled, such as silver and tungsten - an attempt to address criticism that Apple's products, while sleek and seamless in design, are so tightly constructed that their components can be difficult to take apart.

Although green bonds comprise a small fraction of the overall bond market, demand has grown significantly as investors seek lower-carbon investments.

In 2016, $81 billion of green bonds were issued, double the number from 2015, according to the Climate Bonds Initiative, an organization that promotes the use of green bonds.

Governments are also embracing the use of green bonds as a way to meet a 2015 pledge by world leaders to limit global warming this century to below 2 degrees Celsius.


Severe dehydration symptoms in elderly

Diabetic Ketoacidosis Clinical Presentation. it may occur when the condition is neglected or if dehydration or acidosis is severe. Among the symptoms.Criteria for Urinary Tract Infection in the. at present, polymicrobic bacteriuria has not been determined to be a risk factor for the elderly. Absence of Symptoms.Syncope in the elderly is a challenging. for investigation of other symptoms in elderly. nonpaced patients with severe carotid sinus.. including the difference between acute and chronic bronchitis, plus the symptoms,. You only need to see your GP if your symptoms are severe or. elderly.

Syncope - Cardiovascular Disorders - Merck Manuals

. and severe sepsis. through procalcitonin testing improves outcomes of congestive heart failure patients presenting with acute respiratory symptoms:.

Nursing Interventions for Patients with Respiratory Needs

CASE STUDY Mrs. Ballenger,. Demonstrate no signs or symptoms of dehydration during her admission. Assess LOC by evaluating neurological responses and patient.Urinary Tract Infections in the Elderly. The population most likely to experience UTIs is the elderly. Older individuals are more vulnerable for many reasons, not the.Dehydration can be mild, moderate or severe, depending on how much of your body weight is lost through fluids. Symptoms of dehydration. Dehydration can be mild,.Severe symptoms include confusion,. and the elderly. Hypernatremia is associated with an increased risk of death but it is unclear if it is the cause.

See What Severe Psoriasis Looks Like;. Dehydration, or not getting. Symptoms of intoxication include euphoria, slowed reaction time,.Dehydration vs. Hypervolemia. Signs and Symptoms Dehydration (Water Deficit). [Untitled image of elderly drinking tea].List of causes of Dehydration and Headache and Hyperkalemia and Weak urination,. Hypernatremia (In A Page: Pediatric Signs and Symptoms) HYPERNATREMIA.

Signs and symptoms of hypoxia include: Signs of Hypoxia. Poor coordination; Rapid breathing; Poor judgment;. This is also known as severe hypoxia.Dehydration Overhydration. (dark. serum protein and BUN • Severe Isotonic Dehydration can. LOC and VS • Check Skin turgor on forehead or sternum on elderly.Dehydration & Overhydration Waseem Jerjes. • Severe Isotonic Dehydration can lead to SHOCK. on elderly • Monitor Lab.

Types of Shock - Cardiogenic Shock , Septic Shock & More

The following signs and symptoms may. Christian. "Syncope (Fainting): Causes, Diagnosis and Treatment. (Fainting): Causes, Diagnosis and Treatment." Medical.Find out why Mayo Clinic is the right place for. The signs and symptoms of dehydration also may. The most likely group to experience severe diarrhea and.. Hypovolemic shock. the more severe the symptoms of. shock tend to do better than those with more severe shock. Severe hypovolemic shock may lead to.Vomiting caused by the blood's acidity also contributes to fluid losses and dehydration. or severe physical stress. Symptoms of diabetic ketoacidosis can.

Hypoxia and Hypoxemia : Symptoms, Treatment, Causes

Are terminal patients given IV hydration in. Dehydration causes endorphins to be released in the. where the elderly are just viewed as pieces of property.The state of mind is affected and in more severe cases,. dehydration, diabetes insipidus. The individual with psychological shock symptoms may be affected in.About 10% of all falls in the elderly will. elderly patients will sustain more severe injuries with lower. explanation for dehydration,.Acute kidney failure occurs when your kidneys suddenly lose the ability to. severe or sudden dehydration;. What Are the Symptoms of Acute Kidney Failure?.Dehydration takes place when your body loses more. Its symptoms usually last for two to. Burns are characterized by severe skin damage that causes the.

CBT450-EMT12- Endocrine Emergencies - EMS Online

Dehydration information including symptoms, diagnosis,. which is elevated with moderate to severe dehydration. especially as the elderly,.Confusion and Decreased LOC and Dehydration. Contents. Confusion AND Decreased LOC AND Dehydration: Causes of All Symptoms;. of severe headache in the elderly.

Symptom of Confusion and Electrolyte Imbalance

Early Signs and Symptoms of Hypoxia - Medical Health Tests

. symptoms, diagnosis. (LOC) with loss of. patients with severe cervical arthritis or spondylosis develop vertebrobasilar insufficiency with syncope when the.

Symptom of Confusion and Electrolyte Imbalance. by DR. hospital stays is approximately 60 percent in elderly. and symptoms include.Early detection is more difficult in the elderly because the typical signs and symptoms,. severe, life-threatening infections in. infections in elderly.Severe dehydration. Degrees of Dehydration. Severe. 8%, ( 5-10 liters. Symptoms: flushed skin; SBP 60 or (;. Fluids Lecture.

Urinary tract infection (UTI) | McMaster Pathophysiology

Drug-related diarrhoea: pre-empt risks. associated symptoms,. But sometimes they result in severe disorders, such as dehydration,.


Routine chicks vaccination boots survival

CHICKS, Mary Poultry farm, nakuru, by Laban Robert.JPG

With the growing population and consumption of chickens globally, these birds have become a major agribusiness venture with investments ranging from a few shillings into trillions of US dollars.
Besides free range, where farmers only cater for the night security, successful formal rearing of chickens starts from the first day after a chick has been hatched by the hen or the incubator. Vaccination is an accompaniment that ensures more than 90 per cent survival of the chicks and later hens.
On the first day a chick must be vaccinated against mareks disease. This is a highly contagious viral disease that can kill 100 per cent chickens.
The virus causes inflation of the brain and backbone cells leading to paralysis of the legs, wings and the neck. The eye iris turns grey, therefore, impairing sight. The feathers become rough and emaciation sets in before death.
On the sixth day, farmers must vaccinate the chicks against new castle disease. The vaccine is applied as an eye drop.
It is also another viral disease that had varied mortality rate that can hit 100 per cent. It attacks chickens and most poultry of all ages.
It impairs the nervous, the reproductive and the respiratory systems. Major signs include coughing, diarrhoea, depression twisted neck, paralysis and sudden death.
On the 14th day, the chicks have to be vaccinated against gumboro. This is another viral disease that suppresses the immunity system of chickens older than three weeks. The feathers around the neck are stained with faeces.
Diarrhoea, anorexia, depression, rough feathers are other signs.
The first vaccination is administered by eye drops while the second one, which is done after 21 days is through drinking water.
Another new castle vaccine is administered after 28 days in drinking water. The vaccine is repeated after every two months.
Fowl typhoid vaccine is administered after six weeks. Birds suffering from this disease look pale diarrhea more frequently and as a result, they are dehydrated. Other signs include bile-stained liver and enlarged spleen.
On the same sixth week, thigh muscle fowl typhoid is administered.
The chickens are left to grow until deworming is done on the 18th week.

READ ALSO: New KALRO poultry vaccines don’t need fridges to store

READ ALSO: What to consider while buying one day old chicks

READ ALSO:  Newcastle resistant chicken breed, which also produces more eggs now in the market
The chicks are fed on starter diet, which is rich in proteins for the first eight weeks. Growers mash for body building is offered from the ninth to the 19th week. Layers diet is introduces after the 19th week.
The feeds are introduced gradually to by mixing the old to the new feed for a few days to avoid stressing the chickens.
This is the timetable of Mary Njeri, the co-owner of Mary Poultry Farm, in Nakuru. She runs the agribusiness with her husband, Dennis Chege.


White Bolaina  with HOMA THERAPY

-Vegetative cycle shortened to 2 years.
-Seedlings grow 60 cm in one month.
-In 4 months of Homa Therapy application, the 1 1/2 year old plants had to be trimmed 3 times, due to growth of lots of foliage.
-Through this process the  plants gained more height and thickness  than what is considered to be normal.
With conventional agriculture the vegetative cycle is 4 years.
These wood trees do not need trimming, because they do not develop much foliage.

Observation: Eng. Paco Rivera Gonzales, Regional Government of Ucayali, Peru


Syllabus: Metaphysics

This course will survey some major topics in metaphysics: free will and determinism, causation and laws, possibility and possible worlds, natural kinds, and personal identity over time.

Metaphysics is the study of the ultimate nature of reality. Unfortunately, this cryptic formulation is nearly useless. One can simply delve into metaphysics to learn what it is; but perhaps a bit more can be said beforehand.

Think of metaphysics as involving theory and location. Metaphysics aspires to give a comprehensive theory of reality. Such a theory will include an ontology, a theory of what exists, as well as an ideology, a specification of the sorts of things we can say about the objects in the ontology. As for location, since the theory is supposed to be comprehensive, we investigate where (and whether) the things in which we ordinarily believe can be located in the theory.

The search for a comprehensive theory often leads to the following dilemma. For one reason or another, metaphysicians often propose a fairly meager metaphysics, a theory with a slender ontology or ideology. It can then be difficult to fit all of the elements of our everyday conceptual scheme into this meager metaphysics. Perhaps we have left no room for persons, or thought, or ordinary physical objects! Faced with this dilemma, a particularly severe metaphysician might become an eliminativist; she might choose to follow her theory and claim that there simply are no persons, thoughts, or ordinary physical objects. Alternatively, she might be a reductionist, and claim that there is room after all for persons, thoughts and ordinary physical objects in her metaphysical theory, provided one accepts an appropriate understanding of what persons, thoughts and ordinary physical objects are. A final option is antireductionist: one can give up the theory responsible for the dilemma in favor of a richer theory in which the elements of our ordinary conceptual scheme may be located.

The problem of free will and determinism is that of integrating a belief most of us have, that people sometimes act freely and are morally responsible for what they do, with a scientific picture of the world that most of us also accept, according to which any person's actions have causes that lie beyond his or her control. This is an instance of the sort of dilemma mentioned in the previous paragraph; accordingly the literature on free will contains instances of the eliminativist, reductionist and antireductionist responses. Eliminativists about free will are known as "hard determinists"; they say that free will does not exist. Reductionists are called "compatibilists"; they recommend reinterpreting free will so that it does not conflict with the scientific picture. The antireductionists are the "libertarians", who advocate giving up part of the scientific picture in order to make room for free will.

The problem of laws and causation is finding room for causal notions in our overall theory of the world. Causal notions involve a certain kind of necessity -- an object dropped does not merely happen to fall; it must fall; its falling is causally necessary, given that it was dropped. Philosophers typically distinguish two causal notions: laws of nature and causation. Laws of nature are general patterns scientists seek to formulate, whereas statements of causation concern particular events: we say that this striking of a match caused this event of the match lighting. The core question here is what the necessity of laws and causation amounts to.

The topic of possibility and necessity concerns necessity of a different, broader sort. Though it is a law of nature that dropped objects fall, we can imagine a world in which this does not happen; the laws of nature could have been different. In a broader sense, then, it is not necessary that dropped objects fall. What is necessary in this broader sense? Alleged examples of necessary truths include 'all bachelors are unmarried', 'No one is taller than himself' and 'Ted is human'. We will investigate what it is for a proposition to be necessary, and whether necessity attaches only to propositions (de dicto necessity) or to things as well (de re necessity).

Humans group some objects together as similar, and consider others dissimilar. Do these groupings reflect genuine similarities in nature, or merely human interests? What are the ramifications elsewhere of giving either answer? This is the problem of natural kinds.

Our final topic, personal identity, concerns the continued existence of persons over time. We ordinarily assume that persons continue to exist over time -- that the very same person that existed in the past is present before us now. Otherwise it would make no sense to blame persons for their past acts or to plan for the future. And yet, persons change over time, both psychologically (we accumulate memories and our characters change) and physically (the body periodically recycles its matter). Moreover, we think of some changes as resulting in the destruction of the person: imagine the "change" that occurs in a person when her body is vaporized by a bomb. So: in what does continuing over time consist, and what is the difference between changes a person survives and changes that destroy?

Metaphysics includes many other topics we will not have time to investigate, for example the philosophy of time and space (ontology of the past and future; tense; direction of time; substantivalism); persistence over time (artifact identity, material constitution); other topics concerning causation and laws of nature (events, states of affairs, the nature of chance); other topics involving possibility and possible worlds (counterfactuals, supervenience, two-dimensionalism, essentialism); realism/antirealism; truth; Sellars manifest image/Jackson's placement problem (color); ontology (abstract entities, mereology, meta-ontology).

Freedom and Determinism

Libertarianism Chisholm, "Human Freedom and the Self" (W); Clarke, "Toward a credible agent-causal account of free will"

Soft determinism/compatibilism Ayer, "Freedom and Necessity" (W); Frankfurt, "Freedom of the Will and the Concept of a Person" (W)

Incompatibilism Peter van Inwagen, "The Incompatibility of Free Will and Determinism" (W); Lewis, "Are We Free to Break the Laws?"

Possibility and necessity

Quine "Two Dogmas of Empiricism", "Reference and Modality", both in From a Logical Point of View

Kripke Naming and Necessity

Lewis On the Plurality of Worlds 1.1-1.2, 1.6-1.9; chapter 2; 4.1, 4.4-4.5.

Laws of nature and causation

Regularity theory of laws Armstrong, What is a Law of Nature?, chapters 1-5; Lewis, Counterfactuals pp. 73-74; Lewis, Philosophical Papers, vol 2, pp. 121-124; Lewis, "Humean Supervenience Debugged"

DTA theory of laws Armstrong, What is a Law of Nature?, chapters 6-8; Lewis, introduction to Philosophical Papers, vol 2., p. xii; van Fraassen, Laws and Symmetry, pp. 94-103.

Laws are necessary Shoemaker, "Causal and Metaphysical Necessity"

Skepticism about laws Van Fraassen, Laws and Symmetry, part II.

Covering law analysis of causation Mackie, "Causes and Conditions" (S&T)

Counterfactual theory of causation Lewis, "Causation (S&T) (plus postscripts from Philosophical Papers, vol 2.

Primitivism about causation Anscombe, "Causality and Determination" (S&T)

Causation and probability Christopher Hitchcock, ???

Natural kinds

Eliminativism Quine, "Natural Kinds"

Anti-reductionism Putnam, "On Properties", Lewis, On the Plurality of Worlds pp. 59-69; Lewis, "New Work for a Theory of Universals"

Personal identity

Body theory Introduction to Perry, Personal Identity; Shoemaker & Swinburne, Personal Identity, pp. 1-8.

Memory theory S&S, pp. 8-13; Thomson, "People and their bodies"

Duplication problem S&S, pp. 13-21; Lewis, "Survival and Identity"

Dualism S&S, pp. 22-34; 49-66.

Selected further reading

Freedom and Determinism

Possibility and necessity

Laws of nature and causation

Natural kinds

Personal identity


Travel Ban Update: New Presidential Proclamation Signed September 24

On Sunday, September 24, the President issued a Proclamation restricting entry for certain individuals from eight countries: Iran, Libya, Yemen, Chad, Somalia, Syria, North Korea and Venezuela.  This replaces the previous 90-day ban on travel for citizens from six countries.

While it will take some time to see how this new Presidential action is implemented, the Proclamation includes some similarities to the previous Executive Order, along with some key differences.  Here are a few of the most important details

  1. The list of countries has changed to include the eight listed above.
  2. The restrictions now vary by country, so it is essential to read through the specific text for each country to understand the new restrictions in place.
  3. International students (F visas) and exchange visitor students and scholars (J visas) are not subject to the restrictions described in the document. However, there is language referring to “enhanced screening and vetting requirements” for such individuals.  This indicates F and J visa applicants should anticipate potentially longer wait times for visa applications, and possibly extra questioning at U.S. ports of entry upon arrival to the U.S.
  4. In the case of most of the listed countries, visas and entry for other immigrant and non-immigrant categories are restricted or limited. This restriction includes commonly used business (B-1) and tourist (B-2) visas.
  5. The Proclamation makes exceptions for several categories of individuals, including lawful permanent residents of the U.S., and dual nationals of one of the listed countries when the individual is traveling on a passport issued by a non-designated country. Persons already granted asylum by the U.S. or who has been admitted as a refugee are also exempt from the travel restrictions.
  6. Existing visas, already approved by September 24, will not be revoked as a result of this Proclamation.

The above highlights are not a complete description of the new visa/travel restrictions.  For further information about the new Proclamation, the following official White House resources may be helpful.

Official full text of September 24 Proclamation

FAQ on the September 24 Proclamation

Fact Sheet on the September 24 Proclamation

What happens next?  After the previous Executive Orders, several legal challenges impacted the implementation of the visa and travel restrictions.  While it is possible there will again be court actions that could alter the Proclamation’s implementation, it is impossible to predict the outcome of such efforts in advance.  Also, the Proclamation outlines a process by which the visa and travel restrictions could be reduced or expanded in the future, including the possible removal or addition of countries from the designated list.

Along with USC’s leadership, OIS continues to support the ability for ALL of our international students and scholars to make the most of your experience at USC and in the United States.  We recognize that continued uncertainty about immigration matters is an added burden for many in our international community, and we strongly advocate for policies that support the ideals and many benefits of international education.

For assistance with questions related to this new set of travel restrictions, F and J students and scholars may contact the Office of International Services.  Call 213-740-2666 or email to set up an advising appointment.


The move will be announced on Thursday and suggests that Obama is determined to push forward with what he considers as another legacy achievement prior to leaving the White House in one year.

Since the huge thaw in ties between the two nations was announced November of 2014, Obama has made progress breaking down the different diplomatic barriers with a former enemy of the Cold War.

The two have restored diplomatic relations, the U.S. has taken Cuba off its lists of state sponsor of terrorism and Obama and Raul Castro the Cuban President have talked on a regular basis and met on two occasions.

Obama had been hard at work making sure the rapprochement is more than just symbolism. Using executive authority, he persistently chipped away at the restrictions placed by the U.S. on investment, travel and business in Cuba.

Last week was his most recent step when the two nations reached a new arrangement to restore commercial flights after more than 50 years.

There however is a limit to what the President is able to achieve alone. The economic embargo the U.S. placed on Cubs, which has been in force for decades, will only be removed if Congress votes to do so.

Although overall support for this embargo is waning, it maintains widespread backing amongst lawmakers from both parties who have said lifting it would reward what is one of the most politically repressive countries in all of Latin America.

Obama has argued that the embargo is just broken policy that it not just hurt Cuba greatly economically but failed to spur democratic reforms which is something he said would come only when Cuba is open to the whole world.

However, thus far little evidence is present that thawing of relations has led to improvements in human rights. Despite the freeing of some political prisoners in Cuba and working to improve its access to Internet, censorship remains very widespread and the dissidents are jailed as often times as in the past.


Solution - Write the Underlying Principle of a Moving Coil Galvanometer. - Moving Coil Galvanometer

      Forgot password?

View all notifications
Books Shortlist
Your shortlist is empty

Write the underlying principle of a moving coil galvanometer.

State the principle of working of a galvanometer

You need to to view the solution
Is there an error in this question or solution?

Similar questions VIEW ALL

A circular coil of 250 turns and diameter 18 cm carries a current of 12A. What is the magnitude of magnetic moment associated with the coil?

view solution

Show that the current flowing through a moving coil galvanometer is directly proportional to the angle of deflection of coil.

view solution

Draw a neat and labelled diagram of suspended coil type moving coil galvanometer.

view solution

The combined resistance of a galvanometer of resistance 500Ω and its shunt is 21Ω. Calculate the value of shunt.

view solution

Why does a galvanometer show a momentary deflection at the time of charging or discharging a capacitor? Write the necessary expression to explain this observation.

view solution
Solution for question: Write the Underlying Principle of a Moving Coil Galvanometer. concept: Moving Coil Galvanometer. For the courses 12th CBSE (Arts), 12th CBSE (Commerce), 12th CBSE (Science)


Ferromagnetism in rare earth doped cerium oxide bulk samples

Magnetic properties of rare earth (RE) doped ceria (RE = Nd, Sm, Gd, Tb, Er and Dy) samples have been investigated and reported in this paper. Room temperature ferromagnetism (FM) was observed in calcined powders as well as in sintered samples of Nd and Sm doped CeO2, whereas other RE dopants (Gd, Tb, Er and Dy) in CeO2 exhibit paramagnetic behaviour. The origin of magnetism in these samples can be related to oxygen vacancies and formation of fluorite crystal structure. Though the magnetization was found to be lower as compared to transition metal (TM) doped ceria, the segregation of metallic and secondary phases can be avoided in RE doped CeO2. CeO2 doped with Sm ions in different concentration (1, 5 and 15%) were also studied to see the dopant effects on magnetic properties. The origin of magnetism in these samples may be related to the oxygen vacancies created due to RE dopants, which was confirmed from the peak around 555 cm−1 in Raman spectra.


What you need to know about uterine cancer

The uterus or womb is a very important organ in a woman’s body. Aside from its vital role in reproduction, which is to nurture the fertilized egg as it develops into a baby, it also supports the neighboring organs. It is a delicate organ, and once the cells in this part get damaged, cancer may develop. In fact, this is one of the major health problems of women these days.

Cancer of the uterus

What causes it?

hdhjd4There are many risk factors related to uterine cancer which include being overweight, as well as having diabetes and hypertension. Although such conditions do not necessarily mean that you already have cancer cells in your womb, they can still lead to this serious problem.

Other factors that can increase the development of cancer cells in the uterus is age, exposure to estrogen (the hormone which is responsible for regulating a woman’s reproductive system), thickening of the womb’s lining, and many others. In fact, this type of cancer may also occur if you are exposed to hydroquinone particularly when you are trying to lighten the skin in this region. So, if you want to achieve fairer skin surrounding your anus and vagina, learn more about the best products on http://analbleachingguide.com/best-creams-and-kits-reviews/.

You can also check out http://analbleachingguide.com/amaira-review/ for you to see one of the best brands of anal bleaching cream.

The signs & symptoms

So, how would you know if you have uterine cancer? First of all, you will notice abnormal vaginal bleeding which is the main indicator that there is something wrong with your uterus. If you are bleeding even when you are not really on your period or if you are already menopause, then it is highly recommended that you see a doctor right away.

Another sign of uterine cancer is pain, just like any other health problems. But in this condition, you will feel the pain in the pelvic region, especially when having sexual intercourse or even when urinating. You may also feel like going to the bathroom more than usual.

How can it be treated?

hdhjd84Cancer of the uterus can be treated through surgery. It could be hysterectomy or lymph node dissection. Patients may also opt for chemotherapy, radiation therapy, or hormone therapy.

Like what they always say, prevention is better than cure. So, to avoid uterus cancer, women are usually advised to utilize birth control pills and maintain a healthy weight. It is essential that you maintain normal blood pressure too.

Foods That Improve Vaginal Health

Foods that will improve your vaginal health

Cranberry juicecnberryrightasdfghjkoiuytrew

Greek yogurt

Indoor Plants That Are Poisonous And Dangerous

Even though some plants are encouraged as a form of decoration, not all are safe especially when one has inquisitive children or pets around. Children and pets may accidentally chew or crush the plants and thus end up being affected by their poison. Not all indoor plants are toxic; some contain a higher level of poison or toxic materials than others.

Some of the dangers include stomach ailments when swallowed and skin irritation. Such plants should be placed far from children and pet as be avoided as much as possible.

Poisonous and dangerous plants

The plant is enticing especially to children and pets due to its onion-like bulbs and also white and yellow attractive flowers. Eating the bulbs can result in stomach ailments, increased heartbeat, and sometimes death.

Dumb cane

The plant is mostly preferred in most homes since it can thrive in low light environments, but it is dangerous when handled in a bad way. The name “dumb cane” comes from its symptoms when ingested which include burning and swelling of the tongue which can lead to suffocation.

Eastern Lily

The plant is mostly dangerous to pets such as cats and puppies but can only affect children when consumed in large quantities. Eastern Lily affects pets through kidney failure when not treated and can also affect children when they choke on its pieces.

Oleander is another popular indoor plant which attracts people due to its beautiful flowers and economic intake of water. What you may not know is that the plant is one of the most dangerous indoors plants and ingesting any part of it can be fatal. Ingesting can lead to symptoms such as stomach ache, vomiting, and diarrhoea.

Philodendron is also another popular indoor plant which of the arum family that is poisonous and dangerous to both human beings and pets. Eating or philodendronleftdasfgfhjklnmbgvcvxczingesting any part of the plant results vomiting, swellings on lips, throat, and tongue as its poison reacts with the body.

As mentioned above, some plants may have more dangerous poison than others and thus one should know how to handle them. Placing such indoor plants away from the reach of children and pets would be a good way of protecting them from the dangerous of such plants. However, the best way to handle the matter is to ensure that all indoor plants in your home and not poisonous by avoiding the plants as mentioned above.