6.1 Introduction

Today's safety system standards are performance based, not prescriptive. They do not mandate a technology, level of redundancy, test interval, or system logic. Essentially they state "the greater the level of risk, the better the safety systems needed to control it." There are a variety of methods of evaluating risk. There are also a variety of methods of equating risk to the performance required from a safety system. One term used to describe safety system performance is safety integrity level (SIL).

Many industries have the need to evaluate and rank risk. Management decisions may then be made regarding various design options. For example, how remote, if at all, should a nuclear facility be to a large population zone? What level of redundancy is appropriate for a military aircraft weapons control system? What strength should jet engine turbine blades be for protection against flying birds? How long should a warranty period be based on known failure rate data? Ideally, decisions such as these would be made based upon mathematical analysis. Realistically, quantification of all factors is extremely difficult, if not impossible, and subjective judgment and experience may still be considered.

Military organizations were some of the first groups to face such problems. For example, when someone has to press the button that might start or stop World War III, one would like to think that the probability of the electronic circuitry...