https://www.mdu.se/

Methods for analyzing hazards related to individual systems are well studied and established in industry today. When system-of-systems are set up to achieve new emergent behavior, hazards specifically caused by malfunctioning behavior of the complex interactions between the involved systems may not be revealed by just analyzing single system hazards. A structured process is required to reduce the complexity to enable identification of hazards when designing system-of-systems. In this paper we first present how hazards are identified and analyzed using hazard and risk assessment (HARA) methodology by the industry in the context of single systems. We describe systems-of-systems and provide a quarry site automation example from the construction equipment domain. We propose a new structured process for identifying potential hazards in systems-of-systems (HISoS), exemplified in the context of the provided example. Our approach helps to streamline the hazard analysis process in an efficient manner thus helping faster certification of system-of-systems.

Automation is becoming prevalent in more and more industrial domains due to the potential benefits in cost reduction as well as the new approaches/solutions they enable. When machines are automated and utilized in system-of-systems, a thorough analysis of potential critical scenarios is necessary to derive appropriate design solutions that are safe as well. Hazard analysis methods like PHA, FTA or FMEA help to identify and follow up potential risks for the machine operators or bystanders and are well-established in the development process for safety critical machinery. However, safety certified individual machines can no way guarantee safety in the context of system-of-systems since their integration and interactions could bring forth newer hazards. Hence it is paramount to understand the application sce- narios of the system-of-systems and to apply a structured method to identify all potential hazards. In this paper, we 1) provide an overview of proposed hazard analysis methods for system-of- systems, 2) describe a case from construction equipment domain, and 3) apply the well-known System-Theoretic Process Analysis (STPA)f to our case. Our experiences during the case study and the analysis of results clearly point out certain inadequacies of STPA in the context of system-of-systems and underlines the need for the development of improved techniques for safety analysis of system-of-systems.

Automation of earth moving machinery enables improving existing production workflows in various applications like surface mines, material handling operations or material transporting. Such connected and collaborating autonomous machines can be seen as a system-of-systems. It is not yet clear how to consider safety during the development of such systemof- systems (SoS). One potentially useful approach to analyze the safety for complex systems is the System Theoretic Process Analysis (STPA). However, STPA is essentially suitable to static monolithic systems and lacks the ability to deal with emergent and dysfunctional behaviors in the case of SoS. These behaviors if not identified could potentially lead to hazards and it is important to provide mechanisms for SoS developers/integrators to capture such critical situations. In this paper, we present an approach for enriching STPA to provide the ability to check whether the distributed constituent systems of a SoS have a consistent perspective of the global state which is necessary to ensure safety. In other words, these checks must be capable at least to identify and highlight inconsistencies that can lead to critical situations. We describe the above approach by taking a specific case of state change related issues that could potentially be missed by STPA by looking at an industrial case. By applying Petri nets, we show that possible critical situations related to state changes are not identified by STPA. In this context we also propose a modelbased extension to STPA and show how our new process could function in tandem with STPA.

Autonomous vehicles grow importance in many domains and depending on the domain and user needs, autonomous vehicles can be designed as stand-alone solutions as in the automotive domain or as part of a fleet with a specific purpose as in the earth moving machinery domain. Contemporary hazard analysis methods primarily focus on analyzing hazards for single systems. Such an analysis requires knowledge about typical usage of a product, and it is evaluated among others if an operator is able to handle a critical situation. Each hazard analysis method requires specific information as input in order to conduct the method. However, for system-of-systems it is not yet clear how to analyze hazards and provide the required information. In this paper we describe a use case from the earth moving machinery domain where autonomous machines collaborate as a system-of-systems to achieve the mission. We propose a hierarchical process to document a system-of-systems and propose the use of model-based development methods. In this work we discuss how to utilize the provided details in a hazard analysis. Our approach helps to design a complex system-of-systems and supports hazard analysis in a more effective and efficient manner.

Developing safety-critical products like cars, trains, or airplanes requires rigor in following development processes, and evidence for product safety must be collected. Safety needs to be considered during each development step and traced through the development life cycle. The current standards and approaches focus on single human-operated products. The technical evolution enables integrating existing products and new autonomous products into system-of-systems to automate workflows and production streams. Developing safety-critical systems-of-systems requires similar processes and mapping to safety-related activities. However, it is unclear how to consider safety during different development steps for a safety-critical system-of-systems. The existing hazard analysis methods are not explicitly mapped to developing a system-of-systems and are vague about the required information on the intended behavior. This paper focuses on the concept phase for developing a system-of-systems, where different technical concepts for a specific product feature are evaluated. Specifically, we concentrate on the evaluation of the safety properties of each concept. We present a process to support the concept phase and apply a model-driven approach to capture the system-of-systems’ relevant information. We then show how this knowledge is used for conducting an FMEA and HAZOP analysis. Lastly, the results from the analysis are mapped back into the sequence diagrams. This information is made available during the next development stages. We apply the method during the concept phase for designing an industrial system-of-systems. Our approach helps to design complex system-of-systems and supports concept evaluation considering the criticality of the concept under consideration.

Automation is gaining importance in many domains, such as vehicle platoons, smart manufacturing, smart cities, and defense applications. However, the automated system must guarantee safe operation in any critical situation without humans in the loop as a fall-back solution. Additionally, autonomy can cause new types of hazards that need to be identified and analyzed.This paper studies cases from the transportation domain where autonomous vehicles are integrated into workflows in an open-surface mine for efficient material  transportation. In this application many individual systems collaborate to form a system-of-system (SoS) to achieve the mission goals. The complexity of such an SoSand the dependencies between the constituent systems complicate the safety analysis. In an SoS there exist several causes leading to new emergent hazards, failure of identification of which could lead to catastrophes.

In this paper, we describe an SoS-centric process called 'SafeSoS', capable of identifying emergent hazards, through  structuring the complex characteristics of an SoS  on three hierarchical levels to enable better comprehension and analysis. We describe the process in detail and apply the process to an industrial transportation system from the earth-moving machinery domain.As part of the SafeSoS process, we utilize model-based formalisms to describe the characteristics of the application and the constituent systems, which form the input for analyzing the safety of the resulting SoS.We apply the safety analysis methods HiSoS, SMM, FTA, FMEA and Hazop to the industrial SoS with the purpose to identify emergent hazards. As a result of our work, we show how to identify and analyze emergent hazards by the help of our SafeSoS approach.