https://www.mdu.se/

The standard IEC 61508 provides a methodology to calculate β, a factor used to estimate the probability of common cause failures (CCF), i.e., failures that result from a single cause. This methodology consists of answering 37 checklist questions, each one providing a scored value that is accumulated in the final β-factor. Those questions cover 8 different defense measures, i.e., practices done to mitigate the CCF against system dependencies. Since the inception of the standard in 2010, there has been evolution regarding both new technologies with an impact on the system dependency factors, as well as new knowledge on how to address them. Hence, it is important to capture these aspects and update the methodology that can be used to reason about CCF’s causes. In this paper, we present an enhanced methodology for estimating the β-factor, which builds upon the core methodology provided by IEC 61508. In particular, we add 33 new questions and provide an estimation method for scoring the β-factor. We also illustrate our methodology by applying it to a realistic system and discuss the findings. Our proposed methodology permits the consideration of aspects not included in the core methodology, such as the level of defense support and safety culture. It also allows practitioners to consider more dependencies, leading to CCF reduction. The rationale is that the more defenses are addressed, the more protection can be achieved against CCF. 

Assemblies of machinery commonly require control systems whose functionality is based on application software. In Europe, such software requires high safety integrity levels in accordance with the Machinery Directive (MD). However, identifying the essential regulatory requirements for the safety approval is not an easy task. To facilitate this job, this paper presents a process for Safety Argumentation for Machinery Assembly Control Software (SAMACS). We are inspired by patterns provided in the Goal Structuring Notation (GSN) and the use of contracts in safety argumentation. SAMACS contribution is aligning those methods with the MD by adopting EN ISO 13849. In particular, we define safety goals based on expected software contribution to control system safety and the standard guidance. Software safety goals are detailed into software safety requirements and expressed further as contracts, which shall be verified with prescribed techniques. We apply SAMACS to a case study from a European mining company and discuss the findings. This work aims at helping practitioners compose the safety case argumentation necessary to support machinery integration approval in Europe. 

In the modern world, connectivity and shared intelligence enable independent constituent systems (CS) to form systems of systems (SoS) capable of performing sophisticated missions. However, the sheer scale of an SoS can make it challenging to manage all components comprehensively, hiding potential security and safety concerns. These factors underscore the need for advancing conceptual models that permit a better understanding of the SoS intricacies. This paper presents a conceptual model for an integrated safety-security ontology for SoS, called SSO-SoS. Such a model is based on international standards, existing literature, and relevant conceptual models, where we pay special attention to safety, security, and mitigation for SoS. We also illustrate the SSO-SoS with a case study from the construction sector. Our conceptual model provides a hierarchical organization that permits stakeholders to navigate through different layers of information, enhancing their ability to identify, address, and understand the required SoS knowledge.

Safety systems, i.e., systems whose malfunction can result in catastrophic consequences, are usually designed with redundancy in mind to reach high levels of reliability. However, Common Cause Failures (CCF), i.e., single failure events affecting multiple components or functions in a system, can threaten the desired reliability. To solve this problem, practitioners must use proven methods, such as those recommended by standards, to support CCF quantification. In particular, the β-factor model has become the de-facto model since the safety standard IEC 61508 considers it. As such standard applies to all industries, practitioners must figure out the industrial-specific implementation procedures. In this paper, we conducted a systematic literature review to understand how the β-factor model has been used in practice. As a result, we found 20 different models, which are industry/project-specific extensions of the first β-factor model proposed for the nuclear sector. We further classified those models by considering how the β-factor is estimated, and the level of redundancy support. Tool support for the models and their industrial use are also outlined. Finally, we present a discussion that covers the implication of our findings. Our study targets practitioners and researchers interested in using current β-factor models or evolving new ones for specific project needs.

Practitioners report improved productivity as one of the main benefits of using autonomous dump trucks in underground mining. However, manned vehicles are still needed to transport materials and personnel in the tunnels, which requires practices that may diminish autonomy benefits. Thus, both fleets shall be efficiently mixed to maximize the autonomy potential. In addition, sufficient safety shall be demonstrated for operations approval. This paper proposes a strategy to populate a GSN (Goal Structuring Notation) structure to argue for the sufficient safety of mixed traffic operations in underground mining. Our strategy considers SoS (System of Systems) concepts to describe the operations baseline and the initial argumentation line, i.e., risk reduction mitigation strategies for existing SoS components. Such a strategy is further detailed with risk reduction mitigation arguments for control systems. Mitigation strategies at both levels are derived from safety analysis supported by STPA (System-Theoretic Process Analysis), a safety analysis technique that aligns well with the SoS perspective. We also incorporate regulatory frameworks addressing machinery to align the arguments with mandatory statements of the machinery directive. Our strategy combines SoS concepts with analysis techniques and regulatory frameworks to facilitate safety case argumentation for operations approval in the European mining context. 

Autonomous and Semi-autonomous Machines (ASAM) can benefit mining operations. However, demonstrating acceptable levels of safety for ASAMs through exhaustive testing is not an easy task. A promising approach is scenario-based testing, which requires the OperationalDesign Domain (ODD) definition, i.e., environmental, time-of-day, and traffic characteristics. Currently, an ODD specification exists for automated Driving Systems (ADS), but, as it is, such specification is not adequate enough for describing the mine nuances. This paper presents a context-specific ODD taxonomy called ODD-UM, which is suitable for underground mining operational conditions. For this, we consider the taxonomy provided by the British Publicly Available SpecificationPAS 1883:2020. Then, we identify attributes included in the standard ISO 17757:2019 for ASAM safety and use them to adapt the original odd to the needs of underground mining. Finally, the adapted taxonomy is presented as a checklist, and items are selected according to the data provided by the underground mining sector. Our proposed ODDUM provides a baseline that facilitates considering the actual needs for autonomy in mines by leading to focused questions.

The processes used to develop software need to comply with normative requirements (e.g., standards and regulations) to align with the market and the law. Manual compliance checking is challenging because there are numerous requirements with changing nature and different purposes. Despite the importance of automated techniques, there is not any systematic study in this field. This lack may hinder organizations from moving toward automated compliance checking practices. In this paper, we characterize the methods for automatic compliance checking of software processes, including used techniques, potential impacts, and challenges. For this, we undertake a systematic literature review (SLR) of studies reporting methods in this field. As a result, we identify solutions that use different techniques (e.g., anthologies and metamodels) to represent processes and their artifacts (e.g., tasks and roles). Various languages, which have diverse capabilities for managing competing and changing norms, and agile strategies, are also used to represent normative requirements. Most solutions require tool-support concretization and enhanced capabilities to handle processes and normative diversity. Our findings outline compelling areas for future research. In particular, there is a need to select suitable languages for consolidating a generic and normative-agnostic solution, increase automation levels, tool support, and boost the application in practice by improving usability aspects.

Autonomous and Semi-Autonomous Machines (ASAMs) provide several benefits and have already emerged in mining environments. However, for cost-efficiency reasons and for ASAMs to reach their full potential, they should be capable of operating seamlessly with manually operated machines. Establishing the requirements for sufficient safety for such integration is a non-Trivial task. This paper proposes a methodology for safely integrating ASAMs in underground mining environments. First, we describe the purpose of the integration and define the constituent components. Second, we identify the conditions that ASAMs will likely encounter using ODD-UM, an operational design domain specification for underground mining. Third, we derive high-level requirements for individual components based on ODD-UM attributes. Such requirements are allocated into the constituent components and considered as assumptions for the safety analysis. Fourth, we perform STPA (System-Theoretic Process Analysis) to analyze safety-related control requirements for the integrated system. Our methodology could help the system integrator to systematically identify integration requirements to be enforced in constituent components and safety control systems. Index Terms-Underground Autonomous Mining, Integration Requirements, ODD-UM, STPA, Safety-guided Design.

Safety-critical systems, whose failure could lead to catastrophic consequences, are everywhere. Not only environments with high-risk functions, e.g., nuclear power plants, are safety-critical systems. Our vehicles, medical devices that perform different kinds of treatments, airplanes, and industrial robots, are also safety-critical systems. The more harm the system can cause, the more careful the system has to be designed, implemented, and maintained. By following practices of reasonable care, typically collected within industry standards, manufacturers demonstrate that they aim at preventing safety-critical systems from failing or causing various types of damage. Thus, compliance with standards, especially safety standards, is a must-do for manufacturers of safety-critical systems.

Industry standards often adopt a prescriptive approach, which focuses on process-related requirements. To comply with such standards, manufacturers have to carefully prepare process plans that properly address the applicable requirements. A compliant process plan should include the sequence of tasks mandated by applicable standards as well as the resources allocated to such tasks, e.g., personnel, work products, required tools, and methods, which are also framed with key properties. The planning task could be supported by checking that planned processes fulfill the properties set down by standards at given points.

Compliance checking of process plans is rarely done for just one standard. In automotive, for instance, it is recommended that manufacturers follow at least standards for functional safety, cybersecurity, and software process improvements. Manufacturers also need to perform tailoring, i.e., select and modify requirements depending on the individual project. In safety standards, tailoring is often performed by taking into account existing safety criticality levels. Moreover, new versions of the standards, which are frequently released, demand recertification. In addition, compliance checking is not only done to one process plan. Companies commonly need to plan several processes simultaneously. Consequently, it is not easy to manually check that process plans comply with the requirements of standards.

Automated compliance checking could help process engineers in such organizations to detect compliance violations and enforce compliance at planning time. Thus, the main goal of this dissertation is to facilitate automated compliance checking of the process plans used to engineer safety-critical systems against the standards mandated (or recommended) in the safety-critical context. To reach our goal, we adopt modern methods and tools, adapt them by mainly focusing on software and risk analysis process plans, and contribute to the state-of-the-art as follows:

1. We identify aspects that make compliance checking of process plans demanding and formulate requirements for a technical solution to these problems. 

2. We introduce ACCEPT (Automated Compliance Checking of Engineering Process plans against sTandards), an iterative and comprehensible framework for supporting process engineers to check and enforce process plan compliance. 

3. We propose mechanisms for facilitating the creation and reuse of the specifications required to check process plan compliance.

4. We investigate the significance of our proposed solutions by applying different validation mechanisms. As a result, our solutions show to be useful to support process engineers in the compliance checking tasks required during process planning.

This dissertation's contributions aim at planting the seeds for the future development of tools that support process engineers moving towards automated compliance checking practices. 

Safety-critical systems manufacturers have the duty of care, i.e., they should take correct steps while performing acts that could foreseeably harm others. Commonly, industry standards prescribe reasonable steps in their process requirements, which regulatory bodies trust. Manufacturers perform careful documentation of compliance with each requirement to show that they act under acceptable criteria. To facilitate this task, a safety-centered planning-time framework, called ACCEPT, has been proposed. Based on compliance-by-design, ACCEPT capabilities (i.e., processes and standards modeling, and automatic compliance checking) permit to design Compliance-aware Engineering Process Plans (CaEPP), which are able to show the planning-time allocation of standard demands, i.e., if the elements set down by the standard requirements are present at given points in the engineering process plan. In this paper, we perform a case study to understand if the ACCEPT produced models could support the planning of space software engineering processes. Space software is safety and mission-critical, and it is often the result of industrial cooperation. Such cooperation is coordinated through compliance with relevant standards. In the European context, ECSS-E-ST-40C is the de-facto standard for space software production. The planning of processes in compliance with project-specific ECSS-E-ST-40C applicable requirements is mandatory during contractual agreements. Our analysis is based on qualitative criteria targeting the effort dictated by task demands required to create a CaEPP for software development with ACCEPT. Initial observations show that the effort required to model compliance and processes artifacts is significant. However, such an effort pays off in the long term since models are, to some extend, reusable and flexible. The coverage level of the models is also analyzed based on design decisions. In our opinion, such a level is adequate since it responds to the information needs required by the ECSS-E-ST-40C framework.