Performing a More Realistic and Complete Safety Analysis by Means of the Six-Variable Model. Nelufar Ulfat-Bunyadi, Denis Hatebur, Maritta Heisel

Transcription

1 Performing a More Realistic and Complete Safety Analysis by Means of the Six-Variable Model Nelufar Ulfat-Bunyadi, Denis Hatebur, Maritta Heisel

2 Motivation Safety analysis: Hazard Analysis and Risk Assessment (HARA), Fault Tree Analysis (FTA) HARA: identify and categorize hazardous events Hazardous event: hazard + operational situation Hazard: potential source of harm caused by malfunctioning behavior of system FTA: identify failure events (within system) that can lead to hazard Problem: Focus of traditional safety analysis on identifying failure events within system, but hazardous event may also occur due to invalid environmental assumptions Motivation Problem Solution Conclusion 2

3 Example: Autopilot of Lufthansa A320 Flight to Warsaw Accident: Plane ran off the end of the waterlogged runway resulting in injuries and loss of life. Requirement: Enable reverse thrust iff plane is moving on runway. Assumption: Plane is moving on runway when wheels are turning. Cause: Wheels were not turning due to aquaplaning. Autopilot assumed plane is not moving on runway. It did not enable reverse thrust. Invalid environmental assumption was cause of hazardous event, not a system failure! Motivation Problem Solution Conclusion 3

4 Traditional Safety Analysis Control System input values Sensor monitored quantities Software Environment output values Actuator controlled quantities 2. Fault tree analysis (FTA) Hazardous events 1. Hazard analysis and risk assessment (HARA) Motivation Problem Solution Conclusion 4

5 Traditional Safety Analysis (Example) Software Sensors / Actuators Monitored / controlled environment System measured speed, distance, lateral offset of VA Long Range Radar sensors speed, distance, relative position course Vehicles ahead software measured speed, yaw rate, steering wheel angle, lateral acceleration of V braking-torque-to-be engine-torque-to-be Engine management system decelerate accelerate Motivation Problem Solution Conclusion 5

6 Identifying vehicles ahead on same lane Course Vehicle ahead a: lateral offset of vehicle ahead b: course of V c: relative position of VA 1) a measured by LRR sensor 2) b predicted by based on sensor data 3) c calculated by, c = b a vehicle Reference: Konrad Reif (Hrsg.): Fahrstabilisierungssysteme und Fahrerassistenzsysteme, Bosch Fachinformation Automobil, Vieweg+Teubner Verlag, 1. Auflage, Motivation Problem Solution Conclusion 6

7 Traditional Safety Analysis (Example) Software Sensors / Actuators Monitored / controlled environment System measured speed, distance, lateral offset of VA Long Range Radar sensors F3 F4 speed, distance, relative position course Vehicles ahead software F2 measured speed, yaw rate, steering wheel angle, lateral acceleration of V braking-torque-to-be engine-torque-to-be F1 Engine management system decelerate accelerate Unintended braking Motivation Problem Solution Conclusion 7

8 The Six-Variable Model Control System i Sensor m m: monitored quantities c: controlled quantities i: input values o: output values r: referenced variables d: desired variables r Software Environment Requirement d o Actuator c Reference: N. Ulfat-Bunyadi, R. Meis, M. Heisel: The Six-Variable Model - Context Modelling Enabling Systematic Reuse of Control Software. Proc. of ICSOFT-PT 2016, pp Motivation Problem Solution Conclusion 8

9 Safety Analysis based on Six-Variable Model System measured speed, distance, lateral offset of VA Long Range Radar sensors speed, distance, relative position measured speed, yaw rate, lateral acceleration, steering wheel angle of V braking-torque-to-be course Vehicles ahead speed, distance, lane lane Maintain desired speed and keep safety distance to vehicles ahead enginetorque-to-be EMS decelerate accelerate speed adapted Motivation Problem Solution Conclusion 9

10 Safety Analysis based on Six-Variable Model System F3 measured speed, distance, lateral offset of VA F4 Long Range Radar sensors speed, distance, relative position measured speed, yaw rate, lateral acceleration, steering wheel angle of V braking-torque-to-be F5 course F2 Vehicles ahead F6 F7 speed, distance, lane lane Maintain desired speed and keep safety distance to vehicles ahead enginetorque-to-be EMS decelerate accelerate F1 speed adapted Unintended speed reduction Motivation Problem Solution Conclusion 10

11 Resulting Fault Tree (Excerpt: Upper Part) Hazard: Unintended speed reduction Legend: HAZARD USR r=0, event fault OR AND vehicle decelerates erroneously although input does not require deceleration decelerates because it receives a decelerate request F V1 FA V DEC F1 r=1e-08 Newly considered due to Six-Variable Model requests erroneously decelerate due to fault F DEC requests decelerate due to input FA DEC r=1e-08 11

12 Resulting Fault Tree (Excerpt: Lower Part) requests decelerate due to input FA DEC CAN (with E2E protection requests erroneously decelerate due to CAN fault CAN requests decelerate due to input from sensors F CAN DEC2 New FA CAN DEC2 New r=1e-08 sensors send wrong speed and/or yaw rate (fault of sensors) Course of V does not reflect lane of V LRR sends wrong speed, distance, and/or relative position (LRR fault) Speed, distance, and/or relative position do not reflect speed, distance, lane of VA F S F V2 F LRR F VA r=1e-08 r=0,0001 F6 r=1e-06 r=0,0001 F7 12

13 Benefit of Our Method Consideration of environmental assumptions results in higher overall failure rate, but this is more realistic Environmental assumptions can also turn invalid Safety analysis is more complete: Identification of system failures as possible cause Identification of invalid assumptions as possible cause Too strong assumptions can be weakened or abandoned by changing system design Adding sensors/actuators Using other sensors/actuators Motivation Problem Solution Conclusion 13

14 Future Work Extend STPA (Systems-Theoretic Process Analysis) with Six- Variable Model and compare the two methods Safety as control problem: hazards occur when component failures, external disturbances, and/or dysfunctional interactions among system components are not adequately handled Preventing hazards means designing control structure that enforces constraints Method for definition of safety requirements and safety cases based on the Six-Variable Model Motivation Problem Solution Conclusion 14

15 Thanks for your attention Questions?