6.10.3 Risk identification measures

What this heading covers

The measure covers detection, not prevention. A product may identify a risk and still fail; the property here is whether it saw it. The hazards should come from the hazard analysis, and the test should present them in the conditions where detection is hard: partial data, sensor noise, a plausible but wrong input. A detector that fires on every scenario is not discriminating, so the measure should include false positives as well as missed hazards.

Record position: family 37 of 40 in clause 6, under 6.10 Safety, which carries 5 families. It is one of the 40 families a programme has to map its measures to, and its elements are listed below. The heading is 6.10.3 in the public contents; the text behind it is not public.

How a measure for this family is built

Count the hazards from the analysis that the product identified as the numerator over the hazards tested. Report missed hazards and false identifications separately, because a product that alarms constantly is not identifying risk usefully. Record the conditions and the time to identification.

What to put in place before publication

1. Test hazards in degraded conditions, not only with clean data.
2. Report false positives with the missed hazards.

Evidence to keep

Two questions to ask

• Which hazards came from the analysis, and which conditions should trigger detection?
• How many false identifications were there in the same period?

Where teams usually fall short

• A detector tested only on the cases it was designed to catch.

What the number cannot tell you

It cannot tell you whether the product would act correctly on what it identified. Detection and response are different properties.

What happens next

Fail safe is what the product does when identification fails or the hazard is realised.