Communication channels in safety analysis: An industrial exploratory case study

A systematic co-engineering of safety and security analysis in requirements engineering process

Brake is a safety critical system for railway vehicles and brake failures have caused many catastrophic accidents in the history. Detailed accident investigation reports are available and National Transportation Safety Board (NTSB) also makes safety recommendations to Federal Railroad Administration and the industry. However, there is limited research on how to improve the brake safety from the perspective of design, system integration and safety analysis. In this paper, a framework for braking safety design and analysis is introduced, which includes four parts: failure alarming system, safety design, safety analysis and preventative maintenance. For failure alarming, according to the severity level, the failures will be notified to the operator, to Operation Control Center (OCC) or saved for the maintainer. For safety design, redundant design for fail-safe feature, automatic braking, brake release, weight control, ergonomics design for easy operation and maintenance are discussed and several application examples are illustrated. In the safety analysis section, Preliminary Hazard Analysis (PHA) as a semi-quantitative analysis, Failure Modes, Effects, and Criticality Analysis (FMECA) as a bottom-up method and Fault Tree Analysis as a top-down method are used. The hazards details, system assurance actions and closure references are recorded in the Hazard Tracking Log (HTL) to ensure all the safety related items are well tracked and documented. Preventative Maintenance (PM) which is regularly performed on the brake components to lessen the likelihood of failing is also discussed in combination with the reliability prediction and safety analysis for a balance of safety and economy. The safety design framework and principles introduced in this paper can also be applied into other railway systems, such as Propulsion, Signaling, Doors, etc. and may provide insights to similar industries such as automotive, energy and so on.

This chapter addresses some of the issues of the integrated functional safety and cybersecurity analysis and management with regard to selected references and the functional safety standards: IEC 61508, IEC 61511, ISO 13849-1 and IEC 62061, and a cybersecurity standard IEC 62443 that concerns the industrial automation and control systems. The objective is to mitigate the vulnerability of industrial systems that include the information technology (IT) and operational technology (OT) to reduce relevant risks. An approach is proposed for verifying the performance level (PL) or the safety integrity level (SIL) of defined safety function, and then to check the level obtained taking into account the security assurance level (SAL) of particular domain, for example, a safety-related control system (SRCS), in which the given safety function is to be implemented. The SAL is determined based on a vector of fundamental requirements (FRs). The method uses defined risk graphs for the individual and/or the societal risk, and relevant risk criteria, for determining the performance level required PLr or the safety integrity level claimed SIL CL, and probabilistic models to verify PL/SIL achievable for the architecture of the SRCS considered.

Software Product Line Engineering (SPLE) has been proven to reduce development and maintenance costs, improving the time-to-market, and increasing the quality of product variants developed from a product family via systematic reuse of its core assets. SPLE has been successfully used in the development of safety-critical systems, especially in automotive and aerospace domains. Safety-critical systems have to be developed according to safety standards, which demands safety analysis, Fault Tree Analysis (FTA), and assurance cases safety engineering artefacts. However, performing safety analysis, FTA, and assurance case construction activities from scratch and manually for each product variant is time-consuming and error-prone, whereas variability in safety engineering artefacts can be automatically managed with the support of variant management techniques. As safety is context-dependent, context and design variation directly impact in the safety properties changing hazards, their causes, the risks posed by these hazards to system safety, risk mitigation measures, and FTA results. Therefore, managing variability in safety artefacts from different levels of abstraction increases the complexity of the variability model, even with the support of variant management techniques. To achieve an effective balance between benefits and complexity in adopting an SPLE approach for safety-critical systems it is necessary to distinguish between reusable safety artefacts, whose variability should be managed, and those that should be generated from the reused safety artefacts. On the other hand, both industry and safety standards have recognized the use of model-based techniques to support safety analysis and assurance cases. Compositional safety analysis, design optimization, and model-based assurance cases are examples of techniques that have been used to support the generation of safety artefacts required to achieve safety certification. This thesis aims to propose a model-based approach that integrates modelbased development, compositional safety analysis, and variant management techniques to support the systematic reuse and generation of safety artefacts in safety-critical software product line engineering. The approach contributes to reduce the effort and costs of performing safety analysis and assessment for a particular product variant, since such analysis is performed from the reused safety artefacts. Thus, variant-specific fault trees, Failure Modes and Effects Analysis (FMEA), and assurance case artefacts required to achieve safety certification can be automatically generated with the support the model-based safety analysis and assurance case construction techniques.

The rapid increase in computer-related technologies puts greater demands on the software-controlled systems. These demands place the software in total control over safety-critical systems. A fault in such a Safety-Critical Computer Systems (SCCS) can result in catastrophic concerns such as loss of life, harm, or equipment damage. In order to detect and prevent such faults, some safety standards, safety analysis and fault-tolerant techniques have been developed. Still, it requires adequate methodologies and frameworks to complete verification of these SCCS. In this work, the software safety is considered into 3 parts: Safety Modeling, Safety Measurement and Safety Management, with assurance lying down to develop high quality software for SCCS. The proposed methodology is SM-Cube (Safety Modeling, Safety Measurement and Safety Management) which is the Safety-Critical Computer Systems concerned. SM-Cube provides a clarified differentiation for assessing and evaluating the safety embedded into the software. SM-Cube consists of required processes and operations for developing SCCS free of faults. This proposed SM-cube has been applied to safety-critical software based Railroad Crossing Control System (RCCS) which is a laboratory prototype. The outcomes of the prototype confirmed that all critical operations have been safe and risk free. The development of the software based on the proposed SM-cube for RCCS have shown a simplified and improved safety-critical operations of the overall system performance

Agile techniques recently have received attention in developing safety-critical systems. However, a lack of empirical knowledge of performing safety assurance techniques in practice, especially safety analysis into agile development processes prevents further steps. In this article, we aim at investigating the feasibility and the effects of our S-Scrum development process, and stepwise improving and proposing an Optimized S-Scrum development process for safety-critical systems in a real environment. We conducted an exploratory case study in a one-year student project "Smart Home" at the University of Stuttgart, Germany. We participated in the project and collected quantitative and qualitative data from questionnaire, interviews, participant observation, physical artifacts, and documentation review. Furthermore, we evaluated the Optimized S-Scrum in industry by conducting interviews. The first-stage results showed that by integrating STPA (System-Theoretic Process Analysis) can ensure the safety during each sprint and enhance the safety of delivered products, while the agility of S-Scrum is slightly worse than the original Scrum. Six challenges have been explored: Management changes the team's priorities during an iteration; Disturbed safety-related communication; Non-functional requirements are determined too late; Insufficient upfront planning; Insufficient well-defined completion criteria; Excessive time to perform upfront planning. We investigated further the causalities and optimizations. The second-stage results revealed that the safety and agility have been improved after the optimizations. We have gained a positive assessment and suggestions from industry. The optimized S-Scrum is feasible for developing safety-critical systems concerning the capability to ensure safety and the acceptable agility in a student project. Further attempt is still needed in industrial projects.

Topology-based Safety Analysis for Safety Critical CPS

Safety critical systems are becoming more complex, both in the type of functionality they provide and in the way they are demanded to interact with their environment. Such growing complexity requires an adequate increase in the capability of safety engineers to assess system safety, including analyzing the bahaviour of a system in degraded situations. Formal verification techniques, like symbolic model checking, have the potential of dealing with such a complexity and are more often being used during system design. In this paper we present the FSAP/NuSMV-SA platform, based on the NuSMV2 model checker, that implements known and novel techniques to help safety engineers perform safety analysis. The main functionalities of FSAP/NuSMV-SA include: failure mode definition based on a library of failure modes, fault injection, automatic fault tree construction for monotonic and non-monotonic systems, failure ordering analysis. The goal is to provide an environment that can be used both by design engineers to formally verify a system and by safety engineers to automate certain phases of safety assessment. The platform is being developed within the ESACS project (Enhanced Safety Analysis for Complex Systems), an European-Union-sponsored project in the avionics sector, whose goal is to define a methodology to improve the safety analysis practice for complex systems development.

Increasing digitalization and autonomous solutions in physical systems promise to enhance their performance, cost-efficiency and reliability. However, the integration of novel information technologies with safety-related systems also brings new vulnerabilities and risks that challenge the traditional field of safety analysis. Particularly, cyber security threats are becoming key factors in complex accident scenarios in cyber-physical systems (CPSs), where unintentional errors and design flaws overlap with cyber security vulnerabilities that could lead to harm to humans and assets. This overlap between safety and security analysis is still a loosely defined domain without established theories and methods, leading to complications during the risk analysis of CPSs. In this paper, we first describe how the domain of safety science increasingly overlaps with security analysis. Subsequently, based on this overlapping, we illustrate and complement an integrated method for the identification of harm scenarios in CPSs. This method, coined Uncontrolled Flows of Information and Energy (UFoI-E), offers a distinct theoretical foundation rooted in accident causation models and a framework to design diagrammatic representations of CPSs during the analysis. After summarizing these features of the UFoI-E method, we present our original contribution to the method, which is a new practical toolkit for risk identification composed of an ontology of harm scenarios and a database of checklists built from lessons learned analysis and expert knowledge. Finally, we demonstrate an application of the method in an illustrative case and show representative fields for future work.

The purpose of this guide (Volumes I and II) is to provide guidance for the US Department of Energy Savannah River Operations Office (DOE-SR) Radiation Safety staff's review of Safety Analysis Reports (SARs) and Safety Analysis Documents (SADs) and to assign responsibilities for the conduct of such reviews. 57 refs.

Safety-critical Cyber-physical Systems (CPS) in vehicles are becoming more and more complex and interconnected. There is a pressing need for holistic approaches for safety and security analysis to address the challenges. System-Theoretic Process Analysis (STPA) is a top-down safety hazard analysis method, based on systems theory especially aimed at such systems. In contrast to established approaches, hazards are treated as a control problem rather than a reliability problem. STPA-Sec extends this approach to also include security analysis. However, when we applied STPA-Sec to real world use cases for joint safety and security analysis, a Battery Management System for a hybrid vehicle, we observed several limitations of the security extension. We propose improvements to address these limitations for a combined safety and security analysis. Our improvements lead to a better identification of high level security scenarios. We evaluate the feasibility of the improved co-analysis method in a self-optimizing battery management system. We also discuss the general applicability of STPA-Sec to high level safety and security analysis and the relation to automotive cybersecurity standards.

The article is devoted to the study of features and perspectives of the implementation of omnichannel approach to the management of wine brand communications. The main objective of this work is to consider the concept of omnichannel communications in relation to the wine industry enterprises, as well as to analyse the possibilities of using the omnichannel approach in the modern Russian wine industry. Monitoring of scientific literature has shown a complete absence of both Russian-language and international studies focused on the study of omni-channel approach to wine brand communications, which only adds to the relevance of this study. To fill this gap, based on a detailed analysis of the scientific literature on omni-channel marketing, a theoretical framework for the use of omni-channel communications in relation to the wine industry enterprises was compiled. Based on the already available classification of communication channels in the omnichannel approach, the study presents its author’s interpretation describing the most frequently used communication channels of wine brands. The study then analyses practical cases of omnichannel communications used by Russian wineries to identify the most effective traditional and innovative communication channels that fulfil the principles of omnichannelisation. The author concludes that omnichannel communications in the Russian wine industry are in their infancy and have great prospects for further development, but they are significantly limited by both Russian legislation regulating wine brand communications and the capabilities of wineries themselves. In conclusion, the author has developed a set of practical recommendations for the implementation of omnichannel marketing elements in the communication strategy of Russian wine brands, as well as outlined the advantages and disadvantages of this approach to the management of communications of wineries.

With the ever-growing presence of IoT devices in everyday applications, the sheer volume of data exchanged is increasing rapidly. Communication channels' bandwidth used in these applications often presents a bottleneck and limits the frequency at which data can be exchanged, making application of compression beforehand a viable approach. In this paper, we analyze some of the well known lossless compression algorithms capable of seamless integration as software modules on embedded devices used in (near) real-time applications. Low processing and memory resources available on them as well as unsteadiness of aforementioned communication channels were taken into consideration in algorithm selection. Attained compression ratio is evaluated on data harvested from smart meters, whilst time and energy consumed during processing were analyzed within a measurement framework purposefully built for this research. We show that considerable gains can be attained in the volume of data that can be sent from devices based on commonly used microcontrollers, with only a modest toll on time and overall energy used.

Although Bangladesh has an abundant supply of inexpensive foods rich in beta-carotene close to 100 children go blind each day as a result of clinical vitamin A deficiency. This study evaluated the effectiveness of health education campaigns conducted in northern Bangladesh an area with a high incidence of xerophthalmia during 1986-89 to promote consumption of local foods rich in vitamin A. Community participation was key and local working teams monitored program approaches. In addition to the mass media two distinct types of communication channels were utilized: channel 1 communicating to individuals and groups through direct contacts (e.g. women volunteers project workers health workers rural leaders) and channel 2 one-way communication to audiences in community settings (e.g. schools folk singers village film showings training at the village level). An analysis of food consumption data for 2011 households in the 3 preceding days indicated campaign exposure had an overall positive effect on consumption of dark green leafy vegetables. The most effective communication channels were those that targeted individuals and groups in a traditional fashion (channel 1). However entertainment approaches such as folk singers and film showings had a weaker association with higher consumption of vitamin A-rich vegetables than use of women volunteers. Maternal illiteracy and low household income were major obstacles to comprehension and implementation of messages about proper nutritional habits through channel 2 but not channel 1 methodologies. Finally consumption of protein items was more common among those informed through the mass media.

Integrated Modular Avionics (IMA), which is universally considered as safety-critical and software-intensive system, can effectively improve the efficiency comparing with the traditional avionics. However, it also brings up a series of problems, such as fault propagation and functional margin blur. Based on the ideology of preliminary hazard analysis(PHA), this paper firstly makes a rethinking about the common PHA, including the inner-philosophy, misinterpretations and limits, then a safety analysis method-Software-Intensive System PHA(SISPHA)-is presented through combining a consideration of Software-Intensive System characteristics and some PHA application experiences in the software safety area. Finally, on the basis of a certain unmanned aerial vehicle(UAV) IMA design scheme, an application case is provided, which can help explore the safety-critical problems and support the further safety analysis and design.