Different safety engineering processes of automated driving systems (ADS), such as hazard identification and risk assessment (HARA) or SOTIF analyses, require a model of the system's operational environment. Environment taxonomies like ISO 34503 and the "PEGASUS Six-Layer Model" can serve as a basis to derive such models. To ensure comprehensive coverage applicable for different ADS and operational design domains, these taxonomies must be defined at a generic abstract level. However, creating effective environment models relies on the engineer's ability to adapt a base taxonomy for a specific system, operational design domain, and safety analysis scope. This study examines how a base environment taxonomy can be tailored to enhance a specific safety engineering process. Our proposed method involves deriving guide questions from the process's quality requirements. Engineers then use these questions to systematically refine a given taxonomy for use in the safety process. We applied this method in a case study, adapting the ISO 34503 taxonomy to improve HARA quality for an autonomous last-mile delivery vehicle in urban intersection scenarios. The tailored taxonomy was compared with the generic baseline in identifying relevant situation elements for HARA. Industry experts interviewed post-study reported that the tailored taxonomy better structured the situation space exploration than the generic baseline. The detailed guide questions also revealed critical situation elements not identified with the generic taxonomy alone. This paper argues that the developed taxonomy tailoring method improves the quality of safety engineering processes. The case study confirmed the hypotheses that engineers profit from a guided analysis approach, especially in complex situation spaces and that, in consequence, critical situation elements can be identified with less dependence on the engineer's experience. Thus, we conclude that although the approach cannot guarantee a complete coverage of the situation space, it evidently improves the quality of safety engineering processes.
The increasing adoption of Unmanned Aerial Vehicles (UAVs) in various operations introduces new safety risks to people on ground and airspace users. As a result, EU regulations require the demonstration of safety for UAV-based operations, necessitating comprehensive hazard analyses that capture diverse event and failure contributions. This paper presents a generic, model-based approach for assessing UAV system safety, leveraging layered failure propagation models from [4]. Our twofold contribution includes: (1) a detailed exposition of each failure propagation layer's implementation in Altarica and their interconnections, and (2) the analysis of this layered model using associated Altarica tools to generate certification artefacts. A thorough case study on a rotary-wing UAV use-case illustrates our modelling methodology and its analysis capabilities.
The design of complex systems requires a careful consideration of the possible hazards and failure conditions that may affect system functions, possibly compromising system reliability and safety. Complex systems must be able to detect components faults and isolate them before they can propagate and cause system failures. To this aim, Preliminary Safety Assessment analyzes failure conditions and allocate safety requirements to components and subsystems, based on a candidate system architecture. A modern way to conduct this analysis is via the use of fault propagation models, i.e. formal representations linking the occurrence of basic faults to their effects on other components and subsystems. Examples of such models include Timed Failure Propagation Graphs (TFPG), Finite Degradation Models (FDM) and Propagation Graphs over Finite Degradation Structures (PGFDS). In this paper, we generalize previous models for fault propagation. We define a general formalism, called Unifying Propagation Graphs (UPG) which encompasses, and is strictly more expressive of, previous notations, and we formally define its syntax and semantics. We discuss the integration of UPG into the xSAP safety analysis platform, and the generalization of existing routines for fault propagation analysis to the complete fragment of UPG. Finally, as a first contribution, we extend the existing engine for computation of minimal cut sets of PGFDS to support interval timings, and we experimentally evaluate its performance.
Technological advances have increased complexity of avionics systems, requiring methods to efficiently and accurately derive both quantitative and qualitative safety assessments for certification. To address this challenge, Model-Based Safety Assessment techniques have emerged as promising solutions over the years. In December 2023, the new version of ARP4761A integrates MBSA formalism into the recommended practices for safety processes, as an alternative to classical safety assessment techniques (e.g. Fault Tree Analysis). The main contribution of the paper is to provide a case study demonstrating a successful application of an MBSA technique, to support the aforementioned safety process required by the certification authority. Accordingly, the generated outputs include probability of occurrence, DAL allocation, the elicitation of independence principles and requirements traceability. The example reported is a comprehensive MBSA process of an industrial rotorcraft Flight Control System: the article follows the architecture description, explains the safety model creation and comments on the derived results. In the final part of the article, lessons learned from the implementation of MBSA technology in an industrial environment are reported.
Safety-critical areas, such as aerospace, require in-depth and rigorous analysis of the systems under failures. In accordance with industry standards, complex assessments are created to describe how failures can lead to specific functional failures and to verify compliance with specific certification targets. This article reports on a comparison between two independent methods on which the assessments are based. The first is the well-known Fault Tree Analysis (FTA), the de facto industrial standard. While the second is the analysis of the system Failure Propagation Model (FPM) included within the newest paradigm of Model-Based Safety Assessment (MBSA). The objective of this work is to evaluate key parameters to highlight the characteristics of both techniques while integrating them into an industrial process for civil aviation development, in particular during the Preliminary System Safety Assessment (PSSA). A benchmark is provided by analysing a realistic rotorcraft flight control system on which both methods are developed.
