The Usability Engineering Repository UsER for the Development of Task- and Event-based Human-Machine-Interfaces

This paper describes a learning-based approach to operating safety-critical control systems. A reference governor is an add-on scheme used to guard the nominal system against violation of pre-specified constraints by modifying set-point commands. A learning algorithm is developed in this paper to evolve the reference governor parametrization to gradually improve its performance in terms of response speed. In particular, the learning algorithm does not rely on an explicit model of the control system, i.e., it is model-free, and guarantees constraint satisfaction for all time, both during and after learning. The approach is applied to a case study of ground vehicle rollover avoidance to illustrate its functionality and characteristics.

Control Barrier Functions (CBFs) have become a popular tool for enforcing set invariance in safety-critical control systems. While guaranteeing safety, most CBF approaches are myopic in the sense that they solve an optimization problem at each time step rather than over a long time horizon. This approach may allow a system to get too close to the unsafe set where the optimization problem can become infeasible. Some of these issues can be mitigated by introducing relaxation variables into the optimization problem; however, this compromises convergence to the desired equilibrium point. To address these challenges, we develop an approximate optimal approach to the safety-critical control problem in which the cost of violating safety constraints is directly embedded within the value function. We show that our method is capable of guaranteeing both safety and convergence to a desired equilibrium. Finally, we compare the performance of our method with that of the traditional quadratic programming approach through numerical examples .

Exposing inconsistencies can uncover many defects in software specifications. One approach to exposing inconsistencies analyzes two redundant specifications, one operational and the other property-based, and reports discrepancies. This paper describes a formal method, based on this approach and the SCR (software cost reduction) tabular notation, that can expose inconsistencies in software requirements specifications. Because users of the method do not need advanced mathematical training or theorem-proving skills, most software developers should be able to apply the method without extraordinary effort. This paper also describes an application of the method which exposed a safety violation in the contractor-produced software requirements specification of a sizable, safety-critical control system. Because the enormous state space of specifications of practical software usually renders direct analysis impractical, a common approach is to apply abstraction to the specification. To reduce the state space of the control system specification, two pushbutton abstraction methods were applied, one which automatically removes irrelevant variables and a second which replaces the large, possibly infinite, type sets of certain variables with smaller type sets. Analyzing the reduced specification with the model checker Spin uncovered a possible safety violation. Simulation demonstrated that the safety violation was not spurious but an actual defect in the original specification.

In industrial automation, safety-critical control systems need robust timing guarantees in addition to functional correctness. Unfortunately, devices that are typically used in this domain, such as Programmable Logic Controllers, often feature architectures that are not amenable to static timing analysis, for instance relying on general purpose microprocessors or embedded operating systems. As a result, designers often rely on timing values gained from simple measurement of running applications, an approach that only provides very weak guarantees at best. The synchronous approach for IEC 61499 Function Blocks, in contrast, has been demonstrated to be time predictable when run on appropriate hardware, such as simple microprocessors. However, simple microprocessors are often not fast or powerful enough for modern automation requirements. In this paper, we examine how the performance of synchronous IEC 61499 can be improved through the usage of the multi-core T-CREST architecture, data scratchpads, and an optimised compiler. Overall, our improvements resulted in 60% shorter worst-case execution times.

The detection accuracy of psycho-emotional disorders depends on correct processing of speech signals. The main reason of low accuracy and large errors in measurements is associated with the use of inefficient and non-adaptive methods for processing of non-stationary speech signals. In this paper, the authors propose a method for increasing the detection efficiency of psycho-emotional disorders based on adaptive decomposition technology for non-stationary signals, namely, improved complete ensemble empirical mode decomposition with adaptive noise and mel-frequency cepstral analysis. A block diagram for the method and a brief mathematical description are presented. The research results are presented, on the basis of which it was concluded that the method proposed by the authors can successfully be tested in safety-critical control systems

Considering uncertainties and disturbances is an important, yet challenging, step in successful decision making. The problem becomes more challenging in safety-constrained environments. In this paper, we propose a robust and safe trajectory optimization algorithm through solving a constrained min-max optimal control problem. The proposed method leverages a game theoretic differential dynamic programming approach with barrier states to handle parametric and nonparametric uncertainties in safety-critical control systems. Barrier states are embedded into the differential game’s dynamics and cost to portray the constrained environment in a higher dimensional state space and certify the safety of the optimized trajectory. Moreover, to find a convergent optimal solution, we propose to perform line-search in a Stackleberg (leader-follower) game fashion instead of picking a constant learning rate. The proposed algorithm is evaluated on a velocity-constrained inverted pendulum model in a moderate and high parametric uncertainties to show its efficacy in such a comprehensible system. The algorithm is subsequently implemented on a quadrotor in a windy environment in which sinusoidal wind turbulences applied in all directions.

The vehicle industry is quickly becoming more connected and growing. This growth is due to advancements in cyber physical systems (CPSs) that enhance the safety and automation in vehicle. The modern automobile consists of more than 70 electronic control units (ECUs) that communicate and interact with each other over automotive bus systems. Passenger comforts, infotainment features, and connectivity continue to progress through the growth and integration of Internet-of-Things (IoT) technologies. Common networks include the Controller Area Network (CAN), Local Interconnect Network (LIN), and FlexRay. However, the benefits of increased connectivity and features comes with the penalty of increased vulnerabilities. Security is lacking in preventing attacks on safety-critical control systems. I will explore the state of the art methods and approaches researchers have taken to identify threats and how to address them with intrusion detection. I discuss the development of a hybrid based intrusion detection approach that combines anomaly and signature based detection methods. Machine learning is a hot topic in security as it is a method of learning and classifying system behavior and can detect intrusions that alter normal behavior. In this paper, we discuss utilizing machine learning algorithms to assist in classifying CAN messages. I present work that focuses on the reverse engineering and classification of CAN messages. The problem is that even though CAN is standardized, the implementation may vary for different manufacturers and vehicle models. These implementations are kept secret, therefore CAN messages for every vehicle needs to be analyzed and reverse engineered in order to get information. Due to the lack of publicly available CAN specifications, attackers and researchers need to reverse engineer messages to pinpoint which messages will have the desired impact. The reverse engineering process is needed by researchers and hackers for all manufacturers and their respective vehicles to understand what the vehicle is doing and what each CAN message means. The knowledge of the specifications of CAN messages can improve the effectiveness of security mechanisms applied to CAN.

This paper provides a novel and practical approach, to check the correctness and completeness of functional specifications (the completeness means complete for one specified function), especially for complex safety critical systems. This approach combines Artificial Intelligence (AI) planning technique, together with formal functional specification, to assist further cybersecurity vulnerability analysis on safety critical Industrial Control System (ICS). The effectiveness of this combination is represented by examples, which are based on a safety critical ICS-Refueling Machine (RM). RMs are widely used in Nuclear Power Plants (NPPs). The outcome of this idea is a correct and complete functional specification of specific functions, which is the key foundation for our further safety and security vulnerability analysis, especially for performing analysis based on model checking. This practical checking approach is applicable to further Instrumentation & Control (I&C) systems and platforms.

With the advances in Language Technologies and Natural Language Processing, conversational interfaces have begun to play an increasingly important role in the design of human-machine interaction systems in a number of devices and intelligent environments. One of the most demanding tasks when developing a dialog system consists of selecting the next system response considering the user’s actions and the dialog history, which is the fundamental task related to dialog management. In this paper we present an multiagent-based technique for the development of dialog managers. In our proposal, a multiagent system with specialized dialog agents is designed to deal with each specific subtask of dialog objective for which the dialog system has been designed. The practical application of the proposed technique to develop a dialog system acting as a customer support service shows that the use of these specialized dialog agents increases the quality and number of successful interactions with the system in comparison with developing a single agent to manage the dialog for the complete domain.

Surgical robotics in operating rooms is an innovative and rapidly evolving field, and performance levels need to be improved. Despite technological advances, there are still many limitations in surgeon-robot interaction, such as the lack of tactile feedback from the surgeon and visualization issues arising from the surgeon's position relative to the operating table. Therefore, among the challenges of robotic surgery is the design of efficient and ergonomic human-machine interaction systems that can improve and enhance the capabilities of the surgeon and the robot (Boyraz et al., 2019) while ensuring risk reduction and high levels of ergonomics and safety. This will improve the surgeon's perception and eliminate possible accidental contact with tissues and injuries. In this scenario, the contribution illustrates the reconnaissance and analysis activities carried out to identify the limitations and advantages of the current interfaces and visualization technologies applied to robotic surgery to verify their usability and the ways of surgeon-robot interaction.

This paper describes an experiment informal specification and validation performed in the context of an industrial joint project. The project involved an Italian company working in the field of railway engineering, Ansaldobreda Segnalamento Ferroviario, and the CNR Institutes IEI and CNUCE of Pisa, Within the project two formal models have been developed describing different aspects of a safety-critical system used in the management of medium-large railway networks. Validation of safety and liveness properties has been performed on both models. Safety properties have been checked primarily in presence of Byzantine faults as well as of silent faults embedded in the models themselves. Liveness properties have been more focused on a communication protocol used within the system. Properties have been specified by means of assertions or temporal logical formulae. We used PROMELA as specification language, while the verification was performed using the verification tool suite SPIN.

Verification of Test Procedures and Test Cases (TP, TC) is an important process stage for fulfilling the RTCA/DO-178B/C compliance objective while developing software for safety critical flight control systems. Correctness of these results, their requirement coverage (High/Low level) analysis and justified discrepancies (if any) are the primary objectives that must be satisfied. Manual reviews are the most common methods for achieving these objectives. This paper consolidates some of the past experiences of conducting manual reviews in the flight control software V&V for a commercial aircraft program. Through them a clear need and scope for automating portions of manual review is identified. This led to the development of an Auto Review Tool (ART) which is qualified for claiming the certification credits. All the necessary documents such as Tool's Operational Requirement (TOR), Tool Qualification Plan (TQP) and Tool Assessment Summary (TAS) are prepared. The paper presents the tool development process beginning with defining a library of Input/Output relation based functions for different control blocks, parser development and qualification activity that were performed by an independent testing team.

Basically, aircraft engines can be divided into a control embedded system and a controlled system with its environment. The behaviour of the controlled system is given a priori, while the control system still needs to be designed in a way guaranteeing the correct overall behaviour under all operational conditions depending on the flight domain. A large quantity of functions in control systems can be described by a formal system expressed in block diagrams and state-based representations. These representations can be translated to formal based tools relying on the synchronous languages Signal and Statecharts. SACRES is a tool set supporting the design of safety-critical embedded control systems. It integrates the tools and specification techniques Statemate, Sildex, and Timing Diagrams with tool components for automatic code generation, formal verification based on model checking techniques, and an innovative approach for automatic code validation for target code generated from DC+. Technical achievements are The main benefits of the SACRES approach are reduced risks for design errors and decreased design times and costs for the development of dependable (safety critical) embedded systems. SACRES is an attempt to avoid unpredictability (particularly that arising from late feedback from testing) associated with development of safety critical systems, through the use of the maximum degree of automation, especially in respect of code generation and verification. An outstanding property of SACRES is the combination of specification styles and specification tools being applied in practice with automatic tools to establish provable correctness with respect to required properties. Both dependability and productivity are increased by automatic code generation from high-level specifications such that the generated code can be validated against higher levels by rigorous proofs. These techniques allow traditional tests by sampling to be replaced by rigorous checking techniques which correspond to 100% coverage of test cases. In order to address a global innovative approach in the near future which match the whole software configuration, the SACRES tool set should be interfaced with asynchronous techniques matching the operating system development. This raises an open question in the software development future new process.

The purpose of this paper is to present a methodology and tools for the design and test of an EN298 compliant ASIC chip for a safety-critical gas burner control system. Safe operation, as far as the critical variable is concerned, is guaranteed in the presence of two simultaneous faults. Emphasis is put on circumventing methodology, EDA (Electronic Design Automation) and foundry limitations and on product certification requirements.

Fiber optic systems are often cited as a way to gain EMI immunity, reduce weight, and increase bandwidth. Avionics Full-Duplex Switched Ethernet (AFDX), specified in ARINC 664 Aircraft Data Network, Part 7, is a fiber optic avionics bus specification used on the Airbus A380, Boeing 787, and others. It was designed as an upgrade to the standard Ethernet protocol which added guaranteed determinism with bounded jitter and latency. This was done to allow hard real time, critical systems to communicate using standard IEEE 802.3 Ethernet protocol. It uses dual redundancy and full duplex links to minimize jitter and latency and eliminate packet collisions. Although AFDX was designed with hard real time systems in mind, it has not yet been used in a safety critical flight control system. Airbus has expressed interest in extending its use of AFDX from mission critical to flight critical systems[1]. The use of AFDX for flight control systems could provide a number of benefits over legacy systems such as MIL STD 1553 and ARINC 429 (A429). Other fiber optic busses do exist, including MIL STD 1773, ARINC 629, ARINC 636 and Fiber Channel, but these are not currently used for flight controls and comparisons to these busses is beyond the scope of this study.