Morphing Wing Integrated Safety Approach and Results

This chapter provides an introduction to the steps involved in creating dependable systems. This starts with a description of functional hazard assessment (FHA). The steps involved in preliminary system safety assessment (PSSA) and system safety assessment (SSA) are reviewed. The chapter introduces fault tree analysis (FTA) and failure modes and effects analysis (FMEA) as important tools in the safety assessment process. This chapter also introduces the basics of probability theory which can guide quantitative assessment. The concepts behind common cause analysis are introduced. To make the book self-contained, more detailed mathematical concepts are presented in the appendices which can be skipped by less mathematically inclined readers.

Most of the functions of civil aircraft are achieved through software at present. Therefore, the safety of airborne software has become an important part of safety analysis. However, to achieve complex functions, the onboard software becomes very complicated, and it is usually difficult to guarantee safety. ARP4761(Guidelines and Methods for Conducting the Safety Assessment Process on Civil Airborne Systems and Equipment) is an important safety assessment guideline for civil aircraft, but it believes that software development can satisfy safety as long as the software development process complies with the software development standards, instead of incorporating the software into the safety analysis process. To improve airborne software safety, this paper proposes a safety analysis method based on the ARP4761 process which is tailored to adapt to the software. In the software requirements and design, the method uses FHA(Functional Hazard Assessment) to analyze the hazards of the software and define the hazard levels, then use FTA(Fault Tree Analysis) to build a software fault tree, and carry out CCA(Common Cause Analysis) analysis based on the fault tree; after the software development is completed, the method uses FMEA(Failure Modes and Effects Analysis) and FMES(Failure Modes and Effects Summary) to summarize the failures of the software and return these failures to the fault tree to determine whether the software can meet the defined requirements. At the end of the article, an anti-icing software is used as an example to explain the process and effectiveness of the method.

Model‐based systems engineering is a powerful methodology to develop safety‐critical systems. The use of the system model as a single source of truth for risk and dependability analysis results in a consistent and complete assessment. Besides, representation and logging of the assessment within the model result in a complete and up‐to‐date single source of information that can be used during the device certification as well. This paper aims to provide a comprehensive risk management SysML profile that includes interconnected safety analysis [functional hazard assessment (FHA), fault tree, and failure mode and effect analysis (FTA, FMEA)], control measure, and evaluation model elements in compliance with the medical standards. Model‐based risk assessment of a point‐of‐care diagnostic device for sepsis has been shown as a case study to show the implementation of the profile. This device is a standalone unit and the test results obtained directly affect the patient. Therefore, both the top‐down (FHA and FTA) and bottom‐up (FMEA) safety assessment methods have been used. Another objective of the study is to define a systematic and holistic method to perform fault tree analysis, not only from the system architecture models but also from the functional, activity, and sequence diagrams of the system model.

In morphing structures, actuation is a key system for general aircraft-level functions. Similarly to the demonstration of safety compliance applied to aircraft control surfaces, novel functions resulting from the integration of a morphing device (ATED), imposes a detailed examination of the associated risks. Because of the concept novelty, literature references for a safe design of a morphing trailing edge device are hard to be found. The safety-driven design of ATED requires a thorough examination of the potential hazards resulting from operational faults involving either the actuation chain, such as jamming, or the external interfaces, such as loss of power supplies and control lanes. In this work, a study of ATED functions is qualitatively performed at both subsystem and aircraft levels to identify potential design faults, maintenance and crew faults, as well as external environment risks. The severity of the hazard effects is determined and placed in specific classes, indicative of the maximum tolerable probability of occurrence for a specific event, resulting in safety design objectives. A fault tree is finally produced to evaluate the impact of actuation kinematics on specific aspects of ATED morphing operation and reliability.

The advanced vertical lift aircraft demonstrator has been designed and analyzed to meet the requirements of the 2013-2014 American Helicopter Society International Design Competition request for proposal for a vertical take-off and landing experimental aircraft. Although the subject aircraft is a demonstrator aircraft, it is important to consider the effects of reliability in design due to the implications it has on possible future production versions of the aircraft. While there is little need for large life-times at this stage, a low maintenance footprint will eventually be desirable, and hover lift and drive systems would not have to be re-designed. Design recommendations for a reliable system are proposed. A preliminary systems safety assessment was used to set safety goals, which contributed to the analyses of three design options for the hover lift and drive systems. Operational and functional architectures are presented along with the function descriptions of the demonstrator. To classify functional importance, potential failure modes, and the criticality of their impact on the system, a functional hazard assessment was created. The analysis was performed based on reliability models including a Weibull distribution, mean time to failure, and failure time modeling, which were determined for each component of the system. A fault tree analysis and reliability block diagrams were created for the proposed transmission lift systems, and their results were compared. In addition, a stochastic petri analysis was performed to model one year of projected operations of a production version of the demonstrator aircraft, where the dynamic changes allowed understanding of how the redundancy inherent in the aircraft would affect mission failure rates. These analyses were followed by an operational availability assessment and calculations for maintenance free operation periods of the proposed lift and drive systems.

Robotic systems (RSs) are often used for performing critical tasks with little or no human intervention. Such RSs must satisfy certain dependability requirements including reliability, availability, security and safety. In this paper, we focus on the safety aspect and propose a methodology and associated framework for safety assessment of RSs in the early phases of development. The methodology relies upon model-driven engineering approach and describes a preliminary safety assessment of safety-critical RSs using fault tree (FT) analysis (FTA). The framework supports a domain specific language for RSs called RobotML and includes facilities (i) to automatically generate or manually construct FTs and perform both qualitative and quantitative FTA, (ii) to make semantic connections with formal verification and FTA tools, (iii) to represent FTA results in the RobotML modeling environment. In the case study, we illustrate the proposed methodology and framework by considering a mobile robot developed in the scope of the Proteus project.

Fault tree analysis (FTA) is one of the most prominent techniques used in risk analysis, this method aimed to identify how component failures lead to system failure using logical gates (i.e. AND, OR gates). However, some limitations appear on FTA due to its static structure. Bayesian networks (BNs) have become a popular technique used in reliability analysis; it represents a set of random variables and their conditional dependencies. This paper discusses the advantages of Bayesian networks over fault tree in reliability and safety analysis. Also, it shows the ability of BN to update probabilities, to represent multi-state variables, dependent failures, and common cause failure. An example taken from the literature is used to illustrate the application and compare the results of both fault tree and bayesian networks techniques.

PurposeRisk analysis is a critical investigation field for many sectors and organizations to maintain the information management reliable. Since mining is one of the riskiest sectors for both workers and management, comprehensive risk analysis should be carried out. The purpose of this paper is to explore comprehensively the undesired events that may occur during a particular process with their main reasons and to perform a risk analysis for these events, by developing a risk analysis methodology. For performing risk analysis, discovering and defining the potential accidents and incidents including their root causes are important contributions of the study as distinct from the related literature. The fuzzy approach is used substantially to obtain the important inferences about the hazardous process by identifying the critical risk points in the processes. In the scope of the study, the proposed methodology is applied to an underground chrome mine and obtaining significant findings of mining risky operations is targeted.Design/methodology/approachFault tree analysis and fuzzy approach are used for performing the risk analysis. When determining the probability and the consequences of the events which are essential components for the risk analysis, expressions of the heterogeneous expert group are considered by means of the linguistic terms. Fault tree analysis and fuzzy approach present a quiet convenience solution together to specify the possible accidents and incidents in the particular process and determine the values for the basis risk components.FindingsThis study primarily presents a methodology for a comprehensive risk analysis. By implementing the proposed methodology to the underground loading and conveying processes of a chrome mine, 28 different undesired events that may occur during the processes are specified. By performing risk analysis for these events, it is established that the employee’s physical constraint while working with the shovel in the fore area, the falling of materials on employees from the chute and the scaling bar injuries are the riskiest undesired events in the underground loading and conveying process of the mine.Practical implicationsThe proposed methodology provides a confidential and comprehensive method for risk analysis of the undesired events in a particular process. The capability of fault tree analysis for specifying the undesired events systematically and the applicability of fuzzy approach for converting the experts’ linguistic expressions to the mathematical values provide a significant advantage and convenience for the risk analysis.Originality/valueThe major contribution of this paper is to develop a methodology for the risk analysis of a variety of mining accidents and incidents. The proposed methodology can be applied to many production processes to investigate the dangerous operations comprehensively and find out the efficient management strategies. Before performing the risk analysis, determining the all possible accidents and incidents in the particular process using the fault tree analysis provides the effectiveness and the originality of the study. Also, using the fuzzy logic to find out the consequences of the events with experts’ linguistic expressions provides an efficient method for performing risk analysis.

International Maritime Organization (IMO) implements the principles of risk management through a systematic process called Formal Safety Assessment (FSA). FSA is a structured and systematic methodology, aimed at enhancing maritime safety, including protection of life, health, the marine environment and property, by using risk analysis and cost benefit assessment. One of the most widely used hazard identification and risk analysis techniques in FSA is Fault Tree Analysis (FTA) method. However, only basic conventional methodology of the FTA technique is used in FSA. When dealing with large fault trees, the limitations of FTA in terms of accuracy and the efficiency become apparent. It is necessary for IMO to improve FTA method in FSA. In recent years, the Binary Decision Diagram (BDD) method has been developed that solves fault trees and overcomes the disadvantages of the conventional FTA approach. In this paper, the BDD method is introduced for the application in FSA, as it has never been used in FSA studies. A commonly used construction method and some basic event ordering methods of BDD are described. By applying BDD to FTA, two main issues concerned in FSA, minimal cut set and top event probability, can be obtained efficiently and accurately comparing to the analysis using a conventional FTA method.

Brake is a safety critical system for railway vehicles and brake failures have caused many catastrophic accidents in the history. Detailed accident investigation reports are available and National Transportation Safety Board (NTSB) also makes safety recommendations to Federal Railroad Administration and the industry. However, there is limited research on how to improve the brake safety from the perspective of design, system integration and safety analysis. In this paper, a framework for braking safety design and analysis is introduced, which includes four parts: failure alarming system, safety design, safety analysis and preventative maintenance. For failure alarming, according to the severity level, the failures will be notified to the operator, to Operation Control Center (OCC) or saved for the maintainer. For safety design, redundant design for fail-safe feature, automatic braking, brake release, weight control, ergonomics design for easy operation and maintenance are discussed and several application examples are illustrated. In the safety analysis section, Preliminary Hazard Analysis (PHA) as a semi-quantitative analysis, Failure Modes, Effects, and Criticality Analysis (FMECA) as a bottom-up method and Fault Tree Analysis as a top-down method are used. The hazards details, system assurance actions and closure references are recorded in the Hazard Tracking Log (HTL) to ensure all the safety related items are well tracked and documented. Preventative Maintenance (PM) which is regularly performed on the brake components to lessen the likelihood of failing is also discussed in combination with the reliability prediction and safety analysis for a balance of safety and economy. The safety design framework and principles introduced in this paper can also be applied into other railway systems, such as Propulsion, Signaling, Doors, etc. and may provide insights to similar industries such as automotive, energy and so on.

<div class="htmlview paragraph">Fault tree analysis (FTA) evolved from the aerospace industry in the 1960’s. A fault tree is deductive logic model that is generated with a top undesired event in mind. FTA answers the question, “how can something occur?” as opposed to failure modes and effects analysis (FMEA) that is inductive and answers the question, “what if?” FTA is used in risk, reliability and safety assessments. FTA is currently being used by several industries such as nuclear power and chemical processing. Typically the automotive industries uses failure modes and effects analysis (FMEA) such as design FMEAs and process FMEAs. The use of FTA has spread to the automotive industry. This paper discusses the use of FTA for automotive applications. With the addition automotive electronics for various applications in systems such as engine/power control, cruise control and braking/traction, FTA is well suited to address failure modes within these systems. FTA can determine the importance of these failure modes from various perspectives such as cost, reliability and safety. A fault tree analysis of a car starting system is presented as an example.</div>

Software Product Line Engineering (SPLE) has been proven to reduce development and maintenance costs, improving the time-to-market, and increasing the quality of product variants developed from a product family via systematic reuse of its core assets. SPLE has been successfully used in the development of safety-critical systems, especially in automotive and aerospace domains. Safety-critical systems have to be developed according to safety standards, which demands safety analysis, Fault Tree Analysis (FTA), and assurance cases safety engineering artefacts. However, performing safety analysis, FTA, and assurance case construction activities from scratch and manually for each product variant is time-consuming and error-prone, whereas variability in safety engineering artefacts can be automatically managed with the support of variant management techniques. As safety is context-dependent, context and design variation directly impact in the safety properties changing hazards, their causes, the risks posed by these hazards to system safety, risk mitigation measures, and FTA results. Therefore, managing variability in safety artefacts from different levels of abstraction increases the complexity of the variability model, even with the support of variant management techniques. To achieve an effective balance between benefits and complexity in adopting an SPLE approach for safety-critical systems it is necessary to distinguish between reusable safety artefacts, whose variability should be managed, and those that should be generated from the reused safety artefacts. On the other hand, both industry and safety standards have recognized the use of model-based techniques to support safety analysis and assurance cases. Compositional safety analysis, design optimization, and model-based assurance cases are examples of techniques that have been used to support the generation of safety artefacts required to achieve safety certification. This thesis aims to propose a model-based approach that integrates modelbased development, compositional safety analysis, and variant management techniques to support the systematic reuse and generation of safety artefacts in safety-critical software product line engineering. The approach contributes to reduce the effort and costs of performing safety analysis and assessment for a particular product variant, since such analysis is performed from the reused safety artefacts. Thus, variant-specific fault trees, Failure Modes and Effects Analysis (FMEA), and assurance case artefacts required to achieve safety certification can be automatically generated with the support the model-based safety analysis and assurance case construction techniques.

Architectural design modeling has emerged as a discipline in a complex system development. To implement early safety analysis, techniques for architectural design have been extended to concern the safety property. Various safety standard profiles, quantitative and qualitative analysis methods are proposed for assessment. However, few of them focuses on the feedback of the safety properties or analysis results on the adjustment to improve original architecture. In this paper, we present an approach to combine safety analysis with architecture modeling. First, we extend the meta-model of our architecture description language - Breeze/ADL with safety elements for design. Second, safety specifications are generated from Breeze/ADL, and then to be converted into Open FTA for FTA (Fault Tree Analysis). Our Breeze/ADL also supports rule definitions to adjust the architecture, to cope with safety problems. Moreover, model checking will be applied to verify the correctness of the adjustment. Finally, the tool Breeze/SA demonstrates the feasibility of our approach.

The Italian construction sector suffered more than the other industrial sector the negative effects of the world economic crisis. A consequence has been a change in its organization concerning labour and managent on the health and safety issues. Evidence of this can be found in an increase of fatal accidents and occupational diseases. In particular occupational diseases became a health concern in construction. The aim of the presented research work is to assess the hazard of asbestos fibres inhalation due to decommissing of old industrial promises with roofing of asbestos. The developed approach starts from a probabilistic assessment of the risk, using the Risk Analysis tools, the Fault Tree Analysis (FTA) and the Failure Mode and Effect Analysis (FMEA). Risk assessment through the FTA is based on a backward approach: it starts from the malfunction of the system, called Top Event, in order to look for the triggering causes (events); on the contrary, the FMEA analysis is based on a forward approach: they start from a set of events and go on in order to analyse what kind of malfunctioning these can generate in the system. Both the FTA and the FMEA are applied to three approved decontamination techniques (encapsulation, confinement and removal), and for each of them operational phases, equipment, building products and PPE (Personal Protective Equipment) are evaluated highlighting the procedures needed to operate in complete safety. With this approach the main factors that contribute to the increase of the risk of asbestos fibres inhalation are detected: preliminary analysis and assessment of the state of building decay, the use and maintence of PPE and machinery, and the supervision during main working phases.

Electronic checklist is the key guidance document that the crew of the flight can rely on, which plays an important role in the safe flight. Therefore, the safety analysis and the capture and verification of safety requirements of the electronic checklist system is very important. Traditional safety analysis methods pay less attention to the interaction between the electronic checklist system and the external environment, failing to capture the safety requirements that arise in the interaction, and there is no strict verification of safety requirements of the electronic checklist system. To this end, this paper combines the system theoretic process analysis and the lightweight formalization method, and analysis the safety of electronic checklist system and validates the safety requirement. Firstly, analyzing the risk of the electronic checklist system. Then according to the principle of the implementation of the electronic checklist, constructing the control structure of the electronic checklist system, and identifying the unsafe control behavior of each control loop which could lead to the a hazardous state, then obtaining the safety requirements, and determining how each potential hazardous control action could occur. Finally, we use the lightweight formalization method to formalize the safety requirements and use tools to automatically verify the safety requirements.