The Functional Reasoning Design Language (FRDL): Supporting Hazard Analysis with Graphical Models of Behavioral Interaction

Industrial processes contain inherent risks and to assess such risks the use of Process Hazard Analysis (PHA) are commonly applied. The benefits of first principles qualitative and quantitative models and empirical knowledge support for PHA are explored. The use of qualitative hazard analysis based on functional modelling to guide hazard analysis is emphasized. The study proposes a framework for investigating potential hazard scenarios based on functional modeling, e.g. Multilevel Flow Modeling of process system. Subsequently quantitative hazard analysis is used to prioritize the hazard scenarios with highest potential. MFM represents the process on several levels of abstraction and supports logical inference. The potential hazard scenarios are ranked by likelihood and severity. Judgment about likelihood, severity and the tolerability of the resulting risk is made on a subjective basis using the empirical knowledge of the PHA team members. The potential hazard scenario generation procedure can be computer-aided. The proposed framework is applied for a water injection system to increase oil recovery from existing reservoir with better safety performance. Qualitative functional models are efficient for detailed description of possible accident scenarios. Domino effects can be visualized in an MFM model. The possible major accident scenarios are selected by likelihood and severity of their effects. The major accident scenarios can be examined in detail through further quantitative analysis. The hazard analysis of a water injection system demonstrates the feasibility and applicability of the proposed framework. In industrial practice, formulation of the major accident scenario is usually based on historical incidents and the outcome of HAZOP/HAZID type hazard identification studies. Such studies are dependent on the team and their collective knowledge rather than being systematic and objective in nature. The proposed framework performs systematic and comprehensive plant failure and consequence path generation by a computer-aided tool.

7 - Process technology safety and hazard analysis

This paper presents a method for formalization of operations on certain class of syntactically represented linked Data Structures and then defines a set of functions to perform the operations. The formalization will be done by designing a set of transformation rules which are based on the grammars generating these Data Structures. Rooted in formal language theory, this method of formalization provides a basis for mathematical demonstration of the correctness of the operations. The function definitions are based on the idea of Functional Programming (FP) originated by John Backus. These function definitions will provide more functions for implementation of Extended Functional Programming (EFP) language designed for operations on Data Structures.

Many countries are now facing problems related to their past mining activities. One of the greatest problems concerns the potential surface instability. In areas where a room-and-pillar extraction method was used, deterministic methodologies are generally used to assess the hazard of surface collapses. However, those methodologies suffer from not being able to take into account all the uncertainties inherent in any hazard analysis. Through the practical example of the assessment of a single pillar stability in a very simple mining layout, this article introduces a logical framework that can be used to incorporate the different kinds of uncertainties related to data and models, as well as to specific expert's choices in the hazard or risk analysis process. Practical recommendations and efficient tools are also provided to help engineers and experts in their daily work.

Surveying the current state of practice of spacecraft autonomy, one can detect many different attributes of the various autonomy systems currently employed to maintain the safety of the spacecraft. In an effort to move beyond the state of practice, Johns Hopkins University Applied Physics Lab has focused on three of these attributes not found together in current systems: Understandability, Flexibility and Verifiability. Understandability defines the ability to specify and review the autonomy system in such a way that any nonsoftware domain expert or system engineer can understand the design. Flexibility defines the ability to modify the design preand post-launch in parts without patching or without complete code uploads. Verifiability defines the ability to exhaustively and rapidly verify correct autonomy system behavior before it is uploaded to the spacecraft. With the goal of attaining all three of these attributes, JHU/APL has designed and developed a new autonomy system called ExecSpec (short for Executable Specification). The system has been progressed to TRL 5 and is now poised for infusion into future spacecraft programs. ExecSpec is a new visual programming approach to autonomy system development that enables any system designer or domain expert to visually create spacecraft functionality and autonomous behavior in the form of up-loadable specification diagrams. ExecSpec allows developers to interactively construct autonomy systems by drawing diagrams of individual Finite State Machines (FSM) and linking them together to form autonomy components and subsystems. The diagram components are easily understandable by non-software domain experts and system engineers, allowing for system-level review of the autonomy system design. The diagram components can either be built from scratch, or instantiated from libraries of reusable FSM components. In contrast to current software capabilities, ExecSpec is not a code generator but rather an interpreter-based system which enables the uploading diagrams directly to an on-board FSM execution engine, allowing the autonomy system to be rapidly and safely modified at any time in a project's lifecycle and thus reducing overall lifecycle and maintenance costs. This makes the system inherently flexible to post launch modifications and enables changes on the individual FSM level such that new FSM diagrams can be added or interchanged. The resulting diagram behavior produced by ExecSpec can be tested directly through interactive stimulation of system inputs or by playing back scripted input scenarios. Model checking tools can also be used to rapidly verify that the diagrams obey specified constraints and requirements, and the uploaded system behavior can be visually monitored during flight. This combination of interactive testing, model checking and in-flight monitoring ensures autonomy systems built within ExecSpec can be exhaustively verified in a rapid manner. This paper will describe in detail the three attributes chosen by JHU/APL, including the driving need for each, then go on to describe how the new ExecSpec system meets these attributes. Finally, the paper will describe the current state of the ExecSpec development and plans for infusion into future spacecraft systems.

Autonomous Cyber Physical Systems (CPSs) are often required to handle uncertainties and self-manage the system operation in response to problems and increasing risk in the operating paradigm. This risk may arise due to distribution shifts, environmental context, or failure of software or hardware components. Traditional techniques for risk assessment focus on design-time techniques such as hazard analysis, risk reduction, and assurance cases among others. However, these static, design-time techniques do not consider the dynamic contexts and failures the systems face at runtime. We hypothesize that this requires a dynamic assurance approach that computes the likelihood of unsafe conditions or system failures considering the safety requirements, assumptions made at design time, past failures in a given operating context, and the likelihood of system component failures. We introduce the ReSonAte dynamic risk estimation framework for autonomous systems. ReSonAte reasons over Bow-Tie Diagrams (BTDs) which capture information about hazard propagation paths and control strategies. Our innovation is the extension of the BTD formalism with attributes for modeling the conditional relationships with the state of the system and environment. We also describe a technique for estimating these conditional relationships and equations for estimating risk based on the state of the system and environment. To help with this process, we provide a scenario modeling procedure that can use the prior distributions of the scenes and threat conditions to generate the data required for estimating the conditional relationships. To improve scalability and reduce the amount of data required, this process considers each control strategy in isolation and composes several single-variate distributions into one complete multi-variate distribution for the control strategy in question. Lastly, we describe the effectiveness of our approach using two separate autonomous system simulations: CARLA and an unmanned underwater vehicle.

A Whole Person Care model was developed by The New England School of Whole Health Education following a 2-year pilot study that demonstrated the transformational effects of whole health education. This holistic model of health education and behavioral interaction provides a tool for nurses, physicians, and staff to redirect the momentum of care toward in-the-moment, relationship-centered whole person care, improving healthcare worker and patient satisfaction and outcomes.

Integrating self-health awareness in autonomous systems

In STOC 93, Jones sketched the existence of a hierarchy within problems decidable in linear time by a first-order functional language based on tree-structured data (F), as well as for an extension of that language based on graph-structured data (Fsu).We consider the Categorical Abstract Machine (CAM), a canonical machine model for implementing higher order functional languages. We show the existence of such a hierarchy for the CAM based on tree-structured data (without selective updating facilities), as well as in the case of graphstructured data (with selective updating). In conclusion we establish two local robustness results where first-order functional programs and higher order functional programs define the same class of linear-time decidable problems.Keywordslinear timecomplexity hierarchyCAMoperational semanticsfunctional languagesselective updatestructured data

We are using the ACL2 theorem-proving system for formally verifying properties of the X86-compatible, 64-bit VIA Nano microprocessor. To validate Nano circuit models, we translate its Verilog into our formally defined HDL. We write specifications in the ACL2 logic, and mechanically verify HDL descriptions using the ACL2 theorem prover to orchestrate the use of BDDs, AIGs, SAT, symbolic simulations techniques, and the theorem prover itself. Our system has been integrated into the Centaur design toolflow; this includes rapid and regular translation of the Nano design into our framework and daily regression runs.Our tools are written in ACL2, which is itself a functional language. For instance, our BDD package is written in ACL2 and has been proven correct using the ACL2 theorem prover -- likewise so is our AIG package and many other tools. Our symbolic simulation system for the entire ACL2 logic is also written in ACL2, and it has been verified by the ACL2 theorem prover. In fact, the entire ACL2 system is written in the ACL2 language. ACL2 is in commercial use by a number of companies, including AMD, Centaur, IBM, and Microsoft.We believe the FP community should consider the same operational paradigm. In fact, we challenge the FP community to write analysis tools for their functional programs in their own programing languages. This kind of eating one's own dog food tends to make one's system better. Our combined ACL2/CAD system may be the world's largest functional program as the source code exceeds five megabytes. Without our associated mechanical verification system, we couldn't begin to manage the complexity we have created. We have wondered if we could apply our tools to other functional languages.

The increasing complexity associated with many modern engineering applications, including autonomous robot guidance and navigation, process control in sensor-rich environments, and control of biological systems, has far-reaching implications for control system design. As an example, reactive, embedded software systems, interacting among themselves and remote users over communication networks, introduce a whole new set of system-level challenges, and classic control design objectives such as stability, performance, and robustness are being complemented with a number of new questions. These include the cost of hardware implementation, measured for example not only by computational requirements such as speed and memory, but also by communication requirements such as available communication bandwidth. Moreover, the complexity associated with specifying the control procedures and with verifying the behavior of the closed-loop system increasingly plays a fundamental role, especially in safety-critical control systems arising in energy and transportation networks, and in medical applications.

In this paper we present the first investigation into the implementation of a Functional Hybrid Modelling language for non-causal modelling and simulation of physical systems. In particular, we present a simple way to handle connect constructs: a facility for composing model fragments present in some form in most non-causal modelling languages. Our implementation is realised as a domain-specific language embedded in Haskell. The method of embedding employs quasiquoting, thus demonstrating the effectiveness of this approach for languages that are not suitable for embedding in more traditional ways. Our implementation is available on-line, and thus the first publicly available prototype implementation of a Functional Hybrid Modelling language.

BackgroundThe adverse event report of medical devices is one of the postmarket surveillance tools used by regulators to monitor device performance, detect potential device-related safety issues, and contribute to benefit-risk assessments of these products. However, with the development of the related technologies and market, the number of adverse events has also been on the rise, which in turn results in the need to develop efficient tools that help to analyze adverse events monitoring data and to identify risk signals.ObjectiveThis study aimed to establish a hazard classification framework of medical devices and to apply it over practical adverse event data on infusion pumps. Subsequently, it aimed to analyze the risks of infusion pumps and to provide a reference for the risk management of this type of device.MethodsThe authors define a general hierarchical classification of medical device hazards. This classification is combined with the Trace Intersecting Theory to form a human-machine-environment interaction model. Such a model was applied to the dataset of 2001 to 2017 class I infusion pump recalls extracted from the Food and Drug Administration (FDA) website. This dataset does not include cases involving illegal factors.ResultsThe proposed model was used for conducting hazard analysis on 70 cases of class I infusion pump recalls by the FDA. According to the analytical results, an important source of product technical risk was that the infusion pumps did not infuse accurate dosage (ie, over- or underdelivery of fluid). In addition, energy hazard and product component failure were identified as the major hazard form associated with infusion pump use and as the main direct cause for adverse events in the studied cases, respectively.ConclusionsThe proposed human-machine-environment interaction model, when applied to adverse event data, can help to identify the hazard forms and direct causes of adverse events associated with medical device use.

The project Automated Unmanned Protective Vehicle for Highway Hard Shoulder Road Works (aFAS) aims to develop an unmanned protective vehicle to reduce the risk of injuries due to crashes for road workers. To ensure functional safety during operation in public traffic the system shall be developed following the ISO 26262 standard. After defining the functional range in the item definition, a hazard analysis and risk assessment has to be done. The ISO 26262 standard gives hints how to process this step and demands a systematic way to identify system hazards. Best practice standards provide systematic ways for hazard identification, but lack applicability for automated vehicles due to the high variety and number of different driving situations even with a reduced functional range. This contribution proposes a new method to identify hazardous events for a system with a given functional description. The method utilizes a skill graph as a functional model of the system and an overall definition of a scene for automated vehicles to identify potential hazardous events. An adapted Hazard and Operability Analysis approach is used to identify system malfunctions. A combination of all methods results in operating scenes with potential hazardous events. These can be assessed afterwards towards their criticality. A use case example is taken from the current development phase of the project aFAS.

We propose a novel method for generating test scenarios for a black box autonomous system that demonstrate critical transitions in its performance modes. In complex environments it is possible for an autonomous system to fail at its assigned mission even if it complies with requirements for all subsystems and throws no faults. This is particularly true when the autonomous system may have to choose between multiple exclusive objectives. The standard approach of testing robustness through fault detection is directly stimulating the system and detecting violations of the system requirements. Our approach differs by instead running the autonomous system through full missions in a simulated environment and measuring performance based on high-level mission criteria. The result is a method of searching for challenging scenarios for an autonomous system under test that exercise a variety of performance modes. We utilize adaptive sampling to intelligently search the state space for test scenarios which exist on the boundary between distinct performance modes. Additionally, using unsupervised clustering techniques we can group scenarios by their performance modes and sort them by those which are most effective at diagnosing changes in the autonomous system's behavior.