Towards Identifying and closing Gaps in Assurance of autonomous Road vehicleS -- a collection of Technical Notes Part 1

Electronic checklist is the key guidance document that the crew of the flight can rely on, which plays an important role in the safe flight. Therefore, the safety analysis and the capture and verification of safety requirements of the electronic checklist system is very important. Traditional safety analysis methods pay less attention to the interaction between the electronic checklist system and the external environment, failing to capture the safety requirements that arise in the interaction, and there is no strict verification of safety requirements of the electronic checklist system. To this end, this paper combines the system theoretic process analysis and the lightweight formalization method, and analysis the safety of electronic checklist system and validates the safety requirement. Firstly, analyzing the risk of the electronic checklist system. Then according to the principle of the implementation of the electronic checklist, constructing the control structure of the electronic checklist system, and identifying the unsafe control behavior of each control loop which could lead to the a hazardous state, then obtaining the safety requirements, and determining how each potential hazardous control action could occur. Finally, we use the lightweight formalization method to formalize the safety requirements and use tools to automatically verify the safety requirements.

A Comprehensive Safety Engineering Approach for Software-Intensive Systems Based on STPA

Novel methodology for developing a safety standard based on clustering of experts’ assessments of safety requirements

A systematic co-engineering of safety and security analysis in requirements engineering process

<div class="section abstract"><div class="htmlview paragraph">For high-level autonomous vehicles, under many circumstances, accidents are not caused by functional failures, but by system performance limitations and human misuses. ISO 21448 defines this kind of safety issue as safety of the intended functionality (SOTIF). However, most of SOTIF-related researches focus on hazard identification and risk evaluation, as well as verification and validation. There is still lack of public systematic identification method for triggering events. Therefore, this paper proposes an identification framework for triggering events which are related to system performance limitations and human misuses. In the aspect of system performance limitations, there are four steps, which are the specification of the research target, the analysis of influencing factors, the identification of triggering events, and the verification test. In the aspect of human misuses, triggering events can be identified based on the guide words for human error. Furthermore, based on the identification of triggering events, a safety analysis and verification framework for both high-level and low-level autonomous vehicles is proposed. The proposed framework contains five steps, which are hazard identification and risk evaluation, the identification of triggering events, the generation of test cases, test and results analysis, and the derivation of functional safety requirements. Besides, a SAE L3 autonomous vehicle is analyzed and corresponding tests are conducted. Two tests are illustrated in detail in this paper, which involve triggering events related to system performance limitations and human misuses, respectively. And the results show that the two triggering events could both lead to effective hazardous events, which proves the feasibility of the proposed framework.</div></div>

Safety requirements describe risk mitigations against failures that may cause catastrophic consequences on human life, environment and facilities. To be able to implement the correct risk mitigations, it is fundamental that safety requirements are defined based on the results issued from the safety analysis. In this paper, we introduce a heuristic approach to elicit safety requirements based on the knowledge about hazard's causes, hazard's sources and hazard's consequences (i.e. hazard's components) acquired during the safety analysis. The proposed approach is based on a Hazard Ontology that is used to structure the knowledge about the hazards identified during the safety analysis in order to make it available and accessible for requirements elicitation. We describe how this information can be used to elicit safety requirements, and provide a guidance to derive the safety requirements which are appropriate to deal with the hazards they mitigate.

This paper presents the implementation of an autonomous electric vehicle (EV) project in the National Taiwan University of Science and Technology (NTUST) campus in Taiwan. The aim of this work was to integrate two important practices of realizing an autonomous vehicle in a campus environment, including vehicle positioning and path tracking. Such a project is helpful to the students to learn and practice key technologies of autonomous vehicles conveniently. Therefore, a laboratory-made EV was equipped with real-time kinematic GPS (RTK-GPS) to provide centimeter position accuracy. Furthermore, the model predictive control (MPC) was proposed to perform the path tracking capability. Nevertheless, the RTK-GPS exhibited some robust positioning concerns in practical application, such as a low update rate, signal obstruction, signal drift, and network instability. To solve this problem, a multisensory fusion approach using an unscented Kalman filter (UKF) was utilized to improve the vehicle positioning performance by further considering an inertial measurement unit (IMU) and wheel odometry. On the other hand, the model predictive control (MPC) is usually used to control autonomous EVs. However, the determination of MPC parameters is a challenging task. Hence, reinforcement learning (RL) was utilized to generalize the pre-trained datum value for the determination of MPC parameters in practice. To evaluate the performance of the RL-based MPC, software simulations using MATLAB and a laboratory-made, full-scale electric vehicle were arranged for experiments and validation. In a 199.27 m campus loop path, the estimated travel distance error was 0.82% in terms of UKF. The MPC parameters generated by RL also achieved a better tracking performance with 0.227 m RMSE in path tracking experiments, and they also achieved a better tracking performance when compared to that of human-tuned MPC parameters.

Future autonomous vehicles will rely mainly on global navigation satellite system (GNSS) receivers for positioning services. However, GNSS cannot maintain an accurate, continuous and reliable navigation solution in the presence of jamming. The widespread availability of in-car jammers or personal privacy devices (PPDs) made GNSS receivers an attractive target for signal jamming. Jammers not only jeopardize current positioning and timing services; they can indeed endanger the safety of the evolving intelligent transportation, autonomous road vehicles and critical infrastructure. The disruption of GNSS signal in some applications, especially safety-critical ones can lead to crucial consequences and risks such as loss of time synchronization and potential loss of life, to name a few. Thus, it is essential for future autonomous vehicles and transport service providers to deploy reliable GNSS anti-jamming techniques. This paper introduces a novel anti-jamming technique based on a high-resolution spectral estimation that utilizes fast orthogonal search (FOS) algorithm in which the jamming signal is modeled using a set of candidate functions and then eliminated from the received signal. The performance of the proposed method is assessed using experiments obtained from Spirent_TM GSS6700 simulation system. The jamming signal is either obtained from a real jammer or simulated using interference signal generator that is connected to Spirent_TM system. The results showed that the developed anti-jamming algorithm was able to successfully suppress the continuous wave (CW) interference signal, thus, the performance of the acquisition, tracking and navigation modules within a GPS software receiver were all enhanced.

Verification of safety requirements is one important task during the development of safety critical systems. The increasing complexity of systems makes manual analysis almost impossible. This paper introduces a new methodology for formal verification of technical systems with smartIflow (State Machines for Automation of Reliability-related Tasks using Information FLOWs). smartIflow is a new modeling language that has been especially designed for the purpose of automating the safety analysis process in early product life cycle stages. It builds up on experience with existing approaches. As is common practice in current approaches, components are modeled as finite state machines. However, new concepts are introduced to describe component interactions. Events play a major role for internal interactions between components as well as for external (user) interactions. Our approach to the verification of formally specified safety requirements is a two-step method. First, an exhaustive simulation creates knowledge about a great variety of possible behaviors of the system, especially including reactions on suddenly occurring (possibly intermittent) faults. In the second step, safety requirements specified in CTL (Computation Tree Logic) are verified using model checking techniques, and counterexamples are generated if these are not satisfied. The practical applicability of this approach is demonstrated based on a Java implementation using a simple Two-Tank-Pump-Consumer system.

Computer‐based systems (CBSs) are complex and critical, with risks to human lives and the environment. Ensuring their safety requires rigorous methods. Unlike traditional approaches that model system mission specifications in a single step before introducing safety requirements, this paper proposes a layered strategy for modelling both mission and safety requirements. This strategy ensures alignment between safety and mission requirements at each layer and formally proves their sufficiency with respect to system‐level safety constraints (SLSCs), thereby achieving synchronised assurance of functionality and safety. Mission requirements are specified in Event‐B, while System‐Theoretic Process Analysis (STPA) derives safety requirements (SRs) to address system‐level hazards. These SRs and SLSCs are integrated into the Event‐B model to ensure consistency and verify compliance. By iteratively applying this pattern at each STAMP refinement step, a layered CBS is developed with safety as a core feature. Key contributions include stepwise STAMP refinement aligned with the system architecture hierarchy, coordinated development of Event‐B models and STPA analysis using common STAMP models, and managing abstraction levels to ensure compliance between SRs and SLSCs while addressing formal verification complexity. A case study of a computer‐based interlocking system demonstrates the approach's practical application.

Unmanned Aerial Systems (UAS, a.k.a., drones) are a compelling technology with numerous possibilities for highly productive new airspace operations. Safety of operators and bystanders is of paramount concern, and a common, accepted, safety methodology is a pressing need to enable widespread adoption of UAS. This paper provides a methodology for safety analyses that can be conducted for multiple applications using common models and a suggested standardized architecture for small UAS. To date, in the US, safety analyses have been done on an individualized, custom basis, mainly in support of waivers for specific, limited UAS operations. For example, safety analyses have been conducted in the Federal Aviation Administration's (FAA) Pathfinder Program for use of drones in three focus areas: beyond visual line of sight for infrastructure inspections, extended visual line of sight in rural areas, and flight over people. In addition, approximately 400 waivers have been granted for multiple individual applicants [1]. The waiver process is highly specific to an individual applicant's operation and a special safety analysis must be conducted for each waiver request. This is an inefficient use of resources for both the FAA and industry. It would be more efficient if a common model for UAS safety analysis could be employed that was adaptable to varied applications. An important subclass of UAS operations which currently requires waivers are operations termed Beyond Visual Line of Sight (BVLOS). BVLOS operations allow for UAS flight operations which are out of the visual line of sight of the UAS operator. BVLOS will allow multiple economically beneficial applications, for example, infrastructure inspection and agriculture. Our approach seeks to begin providing an adaptable framework for analyses, focusing on Beyond Visual Line of Sight operations, that allows rapid assurance of operational safety. The benefits of this approach are twofold: first, in the near term, the workload involved in applying for waivers, both for the FAA and for applicants, would be significantly reduced, and second, the approach can be used to inform industry standards on key system requirements. This would give industry an important start in the development of common standards for equipment requirements, as is typically done in standards bodies such as RTCA. To provide a UAS reference model, a common small UAS architecture is proposed to conduct analyses across UAS platforms and operations. The architecture enables the safety model's inputs to be adapted to target UAS platforms and operational scenarios. This approach allows for large scale simulations that can analyze the impact of various vehicle performance configurations in differing operational scenarios. This paper also provides a fault-tree analysis model that is customizable to specific operations, and shows some initial results that help provide insights into tradeoffs and potential requirements. The paper explores these tradeoffs in the context of previous analysis conducted by Patterson et al. [2] which identifies a top-level requirement for “Loss of Controlled Flight for any Reason.” The fault-tree analysis helps to identify the various root causes (basic events) of the model's system failure condition (top event) — loss of controlled flight of the UAS vehicle. The attractiveness of the model is that it is easily adaptable to different operations, safety guidelines, reliability requirements, equipment standards, etc. The paper demonstrates a sensitivity analysis to assess the varying impact of the basic events on system failure at different error levels. The fault-tree model and sensitivity analysis results, along with the accompanying common architecture, together provide a flexible approach to UAS safety analyses.

The automation of road vehicles is still developing, moving towards improved technology, safety, energy and fuel efficiency, comfort, economic growth, and real-world applications. Vehicle connectivity and information exchange over the road is an essential requirement for the future of automated driving. This book is intended to help bridge the gap between theory and applications of autonomous vehicles. Vehicular Ad Hoc Networks and Emerging Technologies for Road Vehicle Automation covers autonomous road vehicles and systems, with a particular focus on vehicular ad-hoc networks (VANETs). VANETs are a key part of the intelligent transport systems framework. They are created by applying the principles of mobile ad-hoc networks to vehicles; that is, the spontaneous creation of a wireless network of mobile devices based on inter-vehicle communication. Coverage also includes further aspects of autonomous road vehicles, including hybrid vehicles, autonomous intelligent vehicles, and autonomous decentralized systems (ADS). The book is essential reading for researchers and advanced students from academia, industry and government working on the automation of road vehicles. Additionally, it is a helpful resource for students, researchers and newcomers to the field; providing an in-depth understanding of autonomous road vehicles, their internal structure, types, and fundamental principles, helping to inform and direct their research, and identify challenging areas and problems where further investigations are needed.

SARISTU morphing wing is mainly based on three devices: enhanced adaptive droop nose (EADN), adaptive trailing edge device (ATED) and winglet active trailing edge (WATE). All these devices are used together to improve the overall wing efficiency and to reduce the aerodynamic noise. The safety activities described in this paper were performed to verify whether this concept can comply with the standard civil flight safety regulations and airworthiness requirements. The safety analysis was performed in two steps: a functional hazard assessment (FHA) and a system safety assessment (SSA). Both analyses were performed at wing integration level (IS12) and at single morphing wing devices level. A complete mapping between these two levels of analysis was structured from the beginning of the process, starting from the aircraft functional definition, to integrate and harmonize both FHA and fault trees results. FHA was used to assess the severity of the identified Failure Conditions and then allocate safety requirements. Fault tree modelling technique was used to verify the compliance of the system architectures to the quantitative safety requirements resulting from the FHAs. The paper sets out the hypotheses and common data used by the fault trees. A complete but simple example illustrates the safety approach all through the different steps of the safety methodology. Other safety activities commonly performed in the aeronautical field such as the particular risk analysis (PRA), common mode analysis (CMA) and zonal safety analysis (ZSA) were identified in the frame of SARISTU project. This paper concludes with a summary highlighting the main results of these safety activities with some lessons learned from the safety approach adapted to SARISTU context.

Formal verification efforts in the area of robotics are still comparatively scarce. In this paper we report on our experiences with one such effort, which was concerned with designing, implementing and certifying a safety function for autonomous vehicles and robots. We outline the algorithm which was specifically designed with safety through formal verification in mind, and present our verification methodology, which is based on formal proof and verification using the theorem prover Isabelle. The necessary normative measures that are covered are discussed. The algorithm and our methodology have been certified for use in applications up to SIL 3 of IEC61508-3 by a certification authority. Throughout, issues we recognised as being important for a successful application of formal methods in the domain at hand are highlighted. These pertain to the development process, the abstraction level at which specifications should be formulated, and the interplay between simulation and verification, among others.

A methodology for automatic generation, formal verification and implementation of safe PLC programs for power supply equipment of the electric lines of railway control systems