https://www.mdu.se/

Automation is gaining importance in many domains, such as vehicle platoons, smart manufacturing, smart cities, and defense applications. However, the automated system must guarantee safe operation in any critical situation without humans in the loop as a fall-back solution. Additionally, autonomy can cause new types of hazards that need to be identified and analyzed.This paper studies cases from the transportation domain where autonomous vehicles are integrated into workflows in an open-surface mine for efficient material  transportation. In this application many individual systems collaborate to form a system-of-system (SoS) to achieve the mission goals. The complexity of such an SoSand the dependencies between the constituent systems complicate the safety analysis. In an SoS there exist several causes leading to new emergent hazards, failure of identification of which could lead to catastrophes.

In this paper, we describe an SoS-centric process called 'SafeSoS', capable of identifying emergent hazards, through  structuring the complex characteristics of an SoS  on three hierarchical levels to enable better comprehension and analysis. We describe the process in detail and apply the process to an industrial transportation system from the earth-moving machinery domain.As part of the SafeSoS process, we utilize model-based formalisms to describe the characteristics of the application and the constituent systems, which form the input for analyzing the safety of the resulting SoS.We apply the safety analysis methods HiSoS, SMM, FTA, FMEA and Hazop to the industrial SoS with the purpose to identify emergent hazards. As a result of our work, we show how to identify and analyze emergent hazards by the help of our SafeSoS approach. 

Developing safety-critical products like cars, trains, or airplanes requires rigor in following development processes, and evidence for product safety must be collected. Safety needs to be considered during each development step and traced through the development life cycle. The current standards and approaches focus on single human-operated products. The technical evolution enables integrating existing products and new autonomous products into system-of-systems to automate workflows and production streams. Developing safety-critical systems-of-systems requires similar processes and mapping to safety-related activities. However, it is unclear how to consider safety during different development steps for a safety-critical system-of-systems. The existing hazard analysis methods are not explicitly mapped to developing a system-of-systems and are vague about the required information on the intended behavior. This paper focuses on the concept phase for developing a system-of-systems, where different technical concepts for a specific product feature are evaluated. Specifically, we concentrate on the evaluation of the safety properties of each concept. We present a process to support the concept phase and apply a model-driven approach to capture the system-of-systems’ relevant information. We then show how this knowledge is used for conducting an FMEA and HAZOP analysis. Lastly, the results from the analysis are mapped back into the sequence diagrams. This information is made available during the next development stages. We apply the method during the concept phase for designing an industrial system-of-systems. Our approach helps to design complex system-of-systems and supports concept evaluation considering the criticality of the concept under consideration.

Autonomous vehicles grow importance in many domains and depending on the domain and user needs, autonomous vehicles can be designed as stand-alone solutions as in the automotive domain or as part of a fleet with a specific purpose as in the earth moving machinery domain. Contemporary hazard analysis methods primarily focus on analyzing hazards for single systems. Such an analysis requires knowledge about typical usage of a product, and it is evaluated among others if an operator is able to handle a critical situation. Each hazard analysis method requires specific information as input in order to conduct the method. However, for system-of-systems it is not yet clear how to analyze hazards and provide the required information. In this paper we describe a use case from the earth moving machinery domain where autonomous machines collaborate as a system-of-systems to achieve the mission. We propose a hierarchical process to document a system-of-systems and propose the use of model-based development methods. In this work we discuss how to utilize the provided details in a hazard analysis. Our approach helps to design a complex system-of-systems and supports hazard analysis in a more effective and efficient manner.

Automation of earth moving machinery enables improving existing production workflows in various applications like surface mines, material handling operations or material transporting. Such connected and collaborating autonomous machines can be seen as a system-of-systems. It is not yet clear how to consider safety during the development of such systemof- systems (SoS). One potentially useful approach to analyze the safety for complex systems is the System Theoretic Process Analysis (STPA). However, STPA is essentially suitable to static monolithic systems and lacks the ability to deal with emergent and dysfunctional behaviors in the case of SoS. These behaviors if not identified could potentially lead to hazards and it is important to provide mechanisms for SoS developers/integrators to capture such critical situations. In this paper, we present an approach for enriching STPA to provide the ability to check whether the distributed constituent systems of a SoS have a consistent perspective of the global state which is necessary to ensure safety. In other words, these checks must be capable at least to identify and highlight inconsistencies that can lead to critical situations. We describe the above approach by taking a specific case of state change related issues that could potentially be missed by STPA by looking at an industrial case. By applying Petri nets, we show that possible critical situations related to state changes are not identified by STPA. In this context we also propose a modelbased extension to STPA and show how our new process could function in tandem with STPA.

Automation is becoming prevalent in more and more industrial domains due to the potential benefits in cost reduction as well as the new approaches/solutions they enable. When machines are automated and utilized in system-of-systems, a thorough analysis of potential critical scenarios is necessary to derive appropriate design solutions that are safe as well. Hazard analysis methods like PHA, FTA or FMEA help to identify and follow up potential risks for the machine operators or bystanders and are well-established in the development process for safety critical machinery. However, safety certified individual machines can no way guarantee safety in the context of system-of-systems since their integration and interactions could bring forth newer hazards. Hence it is paramount to understand the application sce- narios of the system-of-systems and to apply a structured method to identify all potential hazards. In this paper, we 1) provide an overview of proposed hazard analysis methods for system-of- systems, 2) describe a case from construction equipment domain, and 3) apply the well-known System-Theoretic Process Analysis (STPA)f to our case. Our experiences during the case study and the analysis of results clearly point out certain inadequacies of STPA in the context of system-of-systems and underlines the need for the development of improved techniques for safety analysis of system-of-systems.

—Automating a quarry site as developed within the electric site research project at Volvo Construction Equipment is an example of a directed system-of-systems (SoS). In our case automated machines and connected smart systems are utilized to improve the work-flow at the site. We currently work on conducting hazard and safety analyses on the SoS level. Performing a hazard analysis on a SoS has been a challenge in terms of complexity and work effort. We elaborate on the suitability of methods, discuss requirements on a feasible method, and propose a tailoring of the STPA method to leverage complexity.

Methods for analyzing hazards related to individual systems are well studied and established in industry today. When system-of-systems are set up to achieve new emergent behavior, hazards specifically caused by malfunctioning behavior of the complex interactions between the involved systems may not be revealed by just analyzing single system hazards. A structured process is required to reduce the complexity to enable identification of hazards when designing system-of-systems. In this paper we first present how hazards are identified and analyzed using hazard and risk assessment (HARA) methodology by the industry in the context of single systems. We describe systems-of-systems and provide a quarry site automation example from the construction equipment domain. We propose a new structured process for identifying potential hazards in systems-of-systems (HISoS), exemplified in the context of the provided example. Our approach helps to streamline the hazard analysis process in an efficient manner thus helping faster certification of system-of-systems.

Autonomous and intelligent construction equipment is an emergent area of research, which shares many characteristics with on-road autonomous vehicles, but also have fundamental differences. Construction vehicles usually perform repetitive tasks in confined sites, such as quarries, and cooperate with other vehicles to complete common missions. A quarry can be viewed as a system-of-systems and the vehicles are individual systems within the site system. Therefore it is important to analyze the site system, i.e. included vehicles, surrounding systems, and system context, before the introduction of autonomous vehicles. It is necessary to map the needed infrastructure, and the needed input information from on-board sensors and off-board information suppliers, before designing the vehicle electronics system. This paper describes how we identified sensory and input signal needs for an autonomous articulated hauler in a scenario at a quarry site. Different architectural alternatives are evaluated and a set-up for a quarry site is suggested.

Software product line engineering is a widely used approach to plan and manage reuse of software. When safety critical products are developed, achieving functional safety standard compliance must be shown. The requirements stated in the functional safety standards also apply when safety critical products are developed in product lines. Managing functional safety in industrial product lines is challenging and work around solutions are applied in practice. The objective of this research is to collect and review reported research publications focusing on achieving safety in product lines and to identify gaps in todays research. We conduct a systematic mapping study of research publications reported until January 2016.We identify 39 research articles to be included in a list of primary studies and analyze how product lines are documented, which safety-related topics are covered and which evaluation method the studies apply. Generally, we find that the area of how to achieve functional safety in product lines needs more attention. Our study provides an overview on which topics have been discussed until now and which safety-related topics need more attention.