I’ll give you a hint it’s not pretty
Current Australian rail and workplace safety legislation requires that safety risks be either eliminated, or if that’s not possible be reduced, ‘so far as is reasonably practicable’. The intent is to ensure that all reasonable practicable precautions are in place, not to achieve some target level of risk.
There are two elements to what is ‘reasonably practicable’. A duty-holder must first consider what can be done – that is, what is possible in the circumstances for ensuring health and safety. They must then consider whether it is reasonable, in the circumstances to do all that is possible. This means that what can be done should be done unless it is reasonable in the circumstances for the duty-holder to do something less.
This is a real and intractable problem for standards that determine the degree of effort applied to treat a hazard using an initial assessment of risk (1). Nor can the legislation be put aside through appeals to such formalisms as the ALARP principle, or the invocation of a standard such as AS 61508 (2). In essence if you can do something, regardless of the degree of risk, then something should be done.
An illustrative scenario. We are an Australian supplier of a control system for a laser cutting machine, and our scope of supply includes a guarding function. We elect to provide this function using software, because of its flexibility. We are a reputable company, we’ve done this before, and know our customers risk appetite, so we do the risk analysis using the risk approach of AS 61508, assess the safety integrity level (SIL 2 for arguments sake) we carry out the work to the required assurance level, are duly independently assessed as having done so and deliver our product, yay us… A year later after several hundred hours of operation a worker is severely injured by a failure of the guarding function. In the subsequent Workcover NSW investigation it turns out that a software error was the cause. Worse yet for the software team Workcover NSW also finds that there is prima facie a breach of the act, as the safety process applied by the company failed to meet the acts standard for due diligence.
Why this determination? Because the company had deliberately excluded, consideration of SIL 3 and 4 techniques that might have eliminated the error, and which (given that they are part of the standard) would also be considered as reasonably practical to implement.
Question. You are the EGM in charge of product development, as the designated officer under the terms of the act what is your legal defence?
Discussion. Now you might think that the issue here is that we did not apply a specific technique. But in fact the breach does not turn on whether the error could, or could not have been eliminated by technique X, but upon the failure to consider all reasonable and practicable steps. To put it another way, there is an absolute duty of care under the act and the only defence is one of due diligence which requires the application of the SFAIRP principle. Applying risk criteria as an upfront decision, does not comply with the act and therefore fails the test of due diligence.
Engineers should remember that in the eyes of the courts, in the absence of any legislative or contractual requirement, an Australian Standard amounts only to an expert opinion about usual or recommended practice. Also, that in the performance of any design, reliance on an Australian Standard does not relieve an engineer from the duty to exercise his or her own skill and expertise
Paul Wentworth, Minter Ellison
As a final though while I situated the above scenario in the aftermath of an industrial accident under the current WHS and Rail safety acts there need be no accident for a breach to occur, as both impose a duty of care regardless of whether an accident has or has not occurred. So my advice? Don’t get too comfy with those AS 61508 SIL levels, you may find yourself standing out on the windy corner one day because of them.
1. In contrast a traditional system safety approach focuses on acting to eliminate or reduce hazards first, followed by an evaluation of residual risk.
2. Bluntly put, in publishing AS 61508 Australian Standards is touting advice that is contrary to the law. Weasel word disclaimers not withstanding. 🙂