https://www.mdu.se/

Product lines in industry are often based on an engineer’s focus on fast and feasible product instantiation rather than a precise product line development method and process as described in literature. When considering functional safety, we need a precise model that includes evidence for the safety of each variant of the product.Functional safety standards provide guidance to develop safety critical products and require that evidence is collected to prove the safety of the product. But today’s functional safety standards do not provide guidance on how to achieve functional safety in product lines. At the same time arguments need to be collected during development so that each product configuration is safe and is fulfilling the requirements of the standards. Providing these arguments requires tracing safety-related requirements and dependencies through the development process taking the impact of variability in different development artifacts into consideration.

In this thesis, we study the challenges of developing safety critical products in product lines. We explore industrial practices to achieve functional safety standard compliance in product lines by interviewing practitioners from different companies and by collecting the reported challenges and practices. This information helps us to identify improvement areas and we derive requirements that a product line engineering method needs to fulfill. Based on these findings we analyze variability management methods from the software product line engineering research domain to identify potential candidate solutions that can be adapted to support safety critical products. We provide an approach for capturing functional safety related characteristics in a model-based product line engineering method. We apply our method in an industrial case demonstrating the applicability.

Safety-critical systems may fail dangerously with severe consequences to the health of the involved humans, costly equipment, the environment, or other valuable assets of a stakeholder. For these classes of systems, the developers are obliged to analyze each potentially hazardous situation thoroughly. In addition, any identified hazardous situation needs to be considered for risk reduction measures, including adjustments of the system's design, additional safeguards if the hazards cannot entirely be removed by design, or warning information to users.  

An essential activity in the development process is the safety analysis, where hazards related to the system under development are identified, and the risks are evaluated and classified. This classification stipulates the rigor of complying with safety standard requirements and directing the development and verification activities. Several techniques for safety analysis have been identified in the literature and are applied in industrial development processes.

The technical evolution enables moving from developing single systems with specific features towards attaching several independent systems to a system-of-systems.On top of the trend towards connectedness, there is also a trend towards more and more automation. In the vehicle domain, autonomous vehicles can collaborate to achieve specific goals, like transporting goods in warehouses, transporting containers in automated ports, or transporting material in off-road environments.

Autonomy brings in new challenges when ensuring product safety and functional safety for single systems due to the lack of a human operator as a fallback solution.Further, when autonomous vehicles collaborate in a fleet, the safety analysis becomes more complex since their interaction and interoperability bring forth new hazards not identifiable with a safety analysis of a single system. Our research aims to bridge this gap and provide solutions for specifying a system-of-systems and finding and developing suitable safety analysis methods.

To understand the challenges and current practices, we have studied industrial projects where systems-of-systems are developed. We have applied safety analysis methods to our industrial cases and found limitations of finding hazards related to a system-of-systems. As part of our research, we have developed extensions to the safety analysis methods to support the analysis of a system-of-systems. We have developed the Safe System-of-Systems (SafeSoS) method which is a structured and hierarchical process to discover and document a system-of-systems characteristics on three primary abstraction levels. Additionally, we utilize model-based formalism to describe the System-of-Systems’ characteristics on each level. Our research results support engineers in the industry when designing a safety-critical system-of-systems.

Software product line engineering is a widely used approach to plan and manage reuse of software. When safety critical products are developed, achieving functional safety standard compliance must be shown. The requirements stated in the functional safety standards also apply when safety critical products are developed in product lines. Managing functional safety in industrial product lines is challenging and work around solutions are applied in practice. The objective of this research is to collect and review reported research publications focusing on achieving safety in product lines and to identify gaps in todays research. We conduct a systematic mapping study of research publications reported until January 2016.We identify 39 research articles to be included in a list of primary studies and analyze how product lines are documented, which safety-related topics are covered and which evaluation method the studies apply. Generally, we find that the area of how to achieve functional safety in product lines needs more attention. Our study provides an overview on which topics have been discussed until now and which safety-related topics need more attention.

Autonomous vehicles grow importance in many domains and depending on the domain and user needs, autonomous vehicles can be designed as stand-alone solutions as in the automotive domain or as part of a fleet with a specific purpose as in the earth moving machinery domain. Contemporary hazard analysis methods primarily focus on analyzing hazards for single systems. Such an analysis requires knowledge about typical usage of a product, and it is evaluated among others if an operator is able to handle a critical situation. Each hazard analysis method requires specific information as input in order to conduct the method. However, for system-of-systems it is not yet clear how to analyze hazards and provide the required information. In this paper we describe a use case from the earth moving machinery domain where autonomous machines collaborate as a system-of-systems to achieve the mission. We propose a hierarchical process to document a system-of-systems and propose the use of model-based development methods. In this work we discuss how to utilize the provided details in a hazard analysis. Our approach helps to design a complex system-of-systems and supports hazard analysis in a more effective and efficient manner.

Automation of earth moving machinery enables improving existing production workflows in various applications like surface mines, material handling operations or material transporting. Such connected and collaborating autonomous machines can be seen as a system-of-systems. It is not yet clear how to consider safety during the development of such systemof- systems (SoS). One potentially useful approach to analyze the safety for complex systems is the System Theoretic Process Analysis (STPA). However, STPA is essentially suitable to static monolithic systems and lacks the ability to deal with emergent and dysfunctional behaviors in the case of SoS. These behaviors if not identified could potentially lead to hazards and it is important to provide mechanisms for SoS developers/integrators to capture such critical situations. In this paper, we present an approach for enriching STPA to provide the ability to check whether the distributed constituent systems of a SoS have a consistent perspective of the global state which is necessary to ensure safety. In other words, these checks must be capable at least to identify and highlight inconsistencies that can lead to critical situations. We describe the above approach by taking a specific case of state change related issues that could potentially be missed by STPA by looking at an industrial case. By applying Petri nets, we show that possible critical situations related to state changes are not identified by STPA. In this context we also propose a modelbased extension to STPA and show how our new process could function in tandem with STPA.

Automation is gaining importance in many domains, such as vehicle platoons, smart manufacturing, smart cities, and defense applications. However, the automated system must guarantee safe operation in any critical situation without humans in the loop as a fall-back solution. Additionally, autonomy can cause new types of hazards that need to be identified and analyzed.This paper studies cases from the transportation domain where autonomous vehicles are integrated into workflows in an open-surface mine for efficient material  transportation. In this application many individual systems collaborate to form a system-of-system (SoS) to achieve the mission goals. The complexity of such an SoSand the dependencies between the constituent systems complicate the safety analysis. In an SoS there exist several causes leading to new emergent hazards, failure of identification of which could lead to catastrophes.

In this paper, we describe an SoS-centric process called 'SafeSoS', capable of identifying emergent hazards, through  structuring the complex characteristics of an SoS  on three hierarchical levels to enable better comprehension and analysis. We describe the process in detail and apply the process to an industrial transportation system from the earth-moving machinery domain.As part of the SafeSoS process, we utilize model-based formalisms to describe the characteristics of the application and the constituent systems, which form the input for analyzing the safety of the resulting SoS.We apply the safety analysis methods HiSoS, SMM, FTA, FMEA and Hazop to the industrial SoS with the purpose to identify emergent hazards. As a result of our work, we show how to identify and analyze emergent hazards by the help of our SafeSoS approach. 

Automation is becoming prevalent in more and more industrial domains due to the potential benefits in cost reduction as well as the new approaches/solutions they enable. When machines are automated and utilized in system-of-systems, a thorough analysis of potential critical scenarios is necessary to derive appropriate design solutions that are safe as well. Hazard analysis methods like PHA, FTA or FMEA help to identify and follow up potential risks for the machine operators or bystanders and are well-established in the development process for safety critical machinery. However, safety certified individual machines can no way guarantee safety in the context of system-of-systems since their integration and interactions could bring forth newer hazards. Hence it is paramount to understand the application sce- narios of the system-of-systems and to apply a structured method to identify all potential hazards. In this paper, we 1) provide an overview of proposed hazard analysis methods for system-of- systems, 2) describe a case from construction equipment domain, and 3) apply the well-known System-Theoretic Process Analysis (STPA)f to our case. Our experiences during the case study and the analysis of results clearly point out certain inadequacies of STPA in the context of system-of-systems and underlines the need for the development of improved techniques for safety analysis of system-of-systems.

—Automating a quarry site as developed within the electric site research project at Volvo Construction Equipment is an example of a directed system-of-systems (SoS). In our case automated machines and connected smart systems are utilized to improve the work-flow at the site. We currently work on conducting hazard and safety analyses on the SoS level. Performing a hazard analysis on a SoS has been a challenge in terms of complexity and work effort. We elaborate on the suitability of methods, discuss requirements on a feasible method, and propose a tailoring of the STPA method to leverage complexity.

Today's industrial product lines in the automotive and construction equipment domain face the challenge to show functional safety standard compliance and argue for the absence of failures for all derived product variants. The product line approaches are not su cient to support practitioners to trace safety-related characteristics through development. We aim to provide aid in creating a safety case for a certain con guration in a product line such that overall less e ort is necessary for each con guration. In this paper we 1) discuss the impact of functional safety on product line development, 2) propose a model-based approach to capture safety-related characteristics during concept phase for product lines and 3) analyze the usefulness of our proposal.

Developing safety critical products demands a clear safety argumentation for each product in spite of whether it has been derived from a product line or not. The functional safety standards do not explain how to develop safety critical products in product lines, and the product line concept is lacking specific approaches to develop safety critical products. Nonetheless, product lines are well-established concepts even in companies developing safety critical products. In this paper we present the results of an exploratory study interviewing 15 practitioners from 6 different companies. We identify typical challenges and approaches from industry and discuss their suitability. The challenges and approaches brought out by this study help us to identify and enhance applicable methods from the product line engineering domain that can meet the challenges in the safety critical domain as well.

Electronic systems in the automotive domain implement safety critical functionality in vehicles and the safety certification process according to a functional safety standard is time consuming and a big part of the expenses of a development project. We describe the functional safety certification of electronic automotive systems by presenting a use case from the construction equipment industry. In this context, we highlight some of the major challenges we foresee, while using a product-line approach to achieve efficient functional safety certification of vehicle variants. We further elaborate on the impact of functional safety certification when applying the component-based approach on developing safety critical product variants and discuss the implications by cost modeling and analysis.

Methods for analyzing hazards related to individual systems are well studied and established in industry today. When system-of-systems are set up to achieve new emergent behavior, hazards specifically caused by malfunctioning behavior of the complex interactions between the involved systems may not be revealed by just analyzing single system hazards. A structured process is required to reduce the complexity to enable identification of hazards when designing system-of-systems. In this paper we first present how hazards are identified and analyzed using hazard and risk assessment (HARA) methodology by the industry in the context of single systems. We describe systems-of-systems and provide a quarry site automation example from the construction equipment domain. We propose a new structured process for identifying potential hazards in systems-of-systems (HISoS), exemplified in the context of the provided example. Our approach helps to streamline the hazard analysis process in an efficient manner thus helping faster certification of system-of-systems.

Reuse of already developed parts and concepts is a common approach in industry to reduce the time to market and reduce the development efforts. Industrial product lines are often grown over time and structured approaches to support decision-making and manage the complexity are lacking. When developing safety-critical products through product lines, evidence must be provided for all possible product configurations. The lack of a structured product line approach taking the functional safety dimension into consideration makes it challenging for practitioners to provide the required evidence. In this paper we (1) identify requirements that a variability management approach will need to fulfill, (2) discuss existing approaches and their limitations, (3) propose potential extension, (4) apply our approach in an industrial use case and (5) discuss its applicability and future work.

In this paper we present AdaptiveFlow as a platform for designing system of systems. A model-based development approach is proposed and tools are provided for formal verification and performance evaluation. The actor-based language, Timed Rebeca, is used for modelling, and the model checking tool Afra is used for checking the safety properties and also for performance evaluation. We investigate the efficiency of our approach and the applicability of the developed platform by conducting experiments on a case study based on the Electric Site Research Project of Volvo Construction Equipment. In this project, a fleet of autonomous haulers is utilised to transport materials in a quarry site. We used three adaptive policies as plugins to our platform and examined these policies in different scenarios.