Model-based Safety Assessment Research Articles

Integration of the Functional Hazard Assessment Within a Model-Based Systems Engineering Framework

A major challenge in developing novel aircraft concepts is demonstrating the safety of increasingly complex and multifunctional aircraft systems. Aircraft manufacturers are adopting model-based systems engineering approaches to develop these new aircraft. The safety assessment process follows suit with model-based safety assessment. However, system and safety engineers still transfer information that is mainly document-based during the system architecting process. This paper aims to improve this process. First, a framework for developing system architecture specification models is introduced using the Architecture Analysis and Design Integrated Approach (ARCADIA)/Capella methodology and tool, illustrated with an aircraft landing gear braking system. Secondly, the paper proposes enhancements to the system specification model to enable functional hazard assessment and to capture the results within the system architecture specification model, i.e., using color-coding of system functions according to the severity of their associated failures as a visual aid to the system architect. In addition, the proposed features in the system specification model can help the safety engineer analyze failure relationships better. In summary, the proposed method improves consistency between the system architect and the safety expert in making safety-informed architecting decisions early in the development process, improving its effectiveness.

Integrating Null Controllability and Model-Based Safety Assessment for Enhanced Reliability in Drone Design

The increasing use of drones for safety-critical applications, particularly beyond visual lines of sight and over densely populated areas, necessitates safer and more reliable designs. To address this need, this paper introduces a novel methodology integrating Null Controllability with the Model-Based Safety Assessment (MBSA) framework AltaRica 3.0 to optimize propulsor configurations and system architectures. The main advancement of this method lies in the automation of reliability modeling and the integration of controllability assessment, eliminating restrictions on the types of propulsor configurations and system architectures that can be evaluated and significantly reducing the effort required for each design iteration. Through a hexarotor drone case study, the proposed method enabled a high number of design iterations, efficiently exploring various aspects of the design problem simultaneously, such as configuration, system architecture, and controllability hypothesis, which is not possible with state-of-the-art techniques. This approach demonstrated significant reliability improvements by implementing and optimizing redundancies, reducing the probability of loss of control by up to 99%. The case study also highlighted the increasing difficulty of enhancing reliability with each iteration and confirmed that it is unnecessary to consider more than two simultaneous failures for design optimization. A comparison of reliability figures with previous studies highlights the crucial role of system architecture in effectively enhancing drone design reliability. This work advances the field by providing an effective multidisciplinary modeling framework for drone design, enhancing reliability in safety-critical applications.

An Engine-Level Safety Assessment Approach of Sustainable Aviation Fuel Based on a Multi-Fidelity Aerodynamic Model

Safety is essential for sustainable aviation fuels (SAFs). However, evaluating SAFs’ impacts on aero-engine safety is challenging because it involves multiple space scales and the strongly coupled relationships of aero-engine components. Aiming at addressing this problem, a model-based approach is proposed to establish the relationship between the fuel-level physical properties and engine-level safety parameters. Firstly, a unified modeling criterion is proposed to consider the interrelations of aero-engine components. Under this criterion, aero-engine secondary air system (SAS) components are included in SAF safety assessment, since they have non-neglectable influences on aero-engine safety. Secondly, this paper proposes a surrogate-based iteration strategy to embed the combustor’s high-dimensional computational fluid dynamics (CFD) model into the aero-engine flow network model. Then, the proposed model-based safety assessment approach is applied to a Fischer–Tropsch hydro-processed synthesized paraffinic kerosine (F-T SPK) safety assessment case. The effects of fuel flow and blending ratio are considered. The results indicate the necessity to evaluate SAFs’ safety at the aero-engine level and consider the influences of SAS components. The proposed model-based approach may provide a preliminary screening before SAFs’ certification tests. This convenience may be beneficial for reducing the cost and accelerating SAFs’ application.

A Decentralized Voting and Monitoring Flight Control Actuation System for eVTOL Aircraft

The emergence of eVTOL (electrical Vertical Takeoff and Landing) aircraft necessitates the development of safe and efficient systems to meet stringent certification and operational requirements. The primary state-of-the-art technology for flight control actuation in eVTOL aircraft is electro-mechanical actuators (EMAs), which heavily rely on multiple redundancies of critical components to achieve fault tolerance. However, challenges persist in terms of insufficient reliability, immaturity, and a lack of a measurable evaluation method. This research addresses these issues by elucidating the design requirements for EMAs in eVTOL aircraft and proposing a systematic design and evaluation approach for EMA architecture. A key enhancement involves the incorporation of decentralized voting and monitoring (VoDeMo) mechanisms within the Electronic Control Units (ECUs) to improve the overall safety of the EMA. The paper introduces an innovative triple-dual redundant architecture for aircraft control effectors, comprising three dissimilar lanes of ECUs and two similar redundant parallel channels of power electronics and motors. The design is synergistically supported by a comprehensive evaluation that incorporates quantifiable Model-Based Safety Assessment (MBSA), utilizing both physical simulation and logical safety models. Hardware-In-the-Loop (HIL) tests are conducted on a constructed prototype to validate the proposed architecture.

Integrated model-based design and functional hazard assessment with SysML on the example of a shock control bump system

Integrating new functions into the aircraft can, for example, increase performance or reduce fuel consumption. Since the installation of such additional functions increases the overall aircraft complexity, it is crucial to adapt methods and tools that support the development and ensure traceability, consistency, and verifiability. In this context, model-based systems engineering and the associated Systems Modeling Language (SysML) have been established as a standard methodology. This paper presents an overview of a system development and modeling process with SysML at the concept design stage using a position-variable shock control bumps system as an example. In addition to the system modeling, safety and reliability analyses have to be considered during the design process. To keep both, the model and the associated safety assessment consistent, this work introduces an extension of SysML to enable the execution of a functional hazard assessment (FHA) according to the ARP4754A and ARP 4761 guidelines. This is the first step in conducting a model-based safety assessment. Furthermore, a modeling process with concepts management methods is performed. In summary, the presented modeling process consists of three main parts: the system modeling, functional hazard assessment and concept management.

A Safety-Focused System Architecting Framework for the Conceptual Design of Aircraft Systems

To reduce the environmental impact of aviation, aircraft manufacturers develop novel aircraft configurations and investigate advanced systems technologies. These new technologies are complex and characterized by electrical or hybrid-electric propulsion systems. Ensuring that these complex architectures are safe is paramount to enabling the certification and entry into service of new aircraft concepts. Emerging techniques in systems architecting, such as using model-based systems engineering (MBSE), help deal with such complexity. However, MBSE techniques are currently not integrated with the overall aircraft conceptual design, using automated multidisciplinary design analysis and optimization (MDAO) techniques. Current MDAO frameworks do not incorporate the various aspects of system safety assessment. The industry is increasingly interested in Model-Based Safety Assessment (MBSA) to improve the safety assessment process and give the safety engineer detailed insight into the failure characteristics of system components. This paper presents a comprehensive framework to introduce various aspects of safety assessment in conceptual design and MDAO, also considering downstream compatibility of the system architecting and safety assessment process. The presented methodology includes specific elements of the SAE ARP4761 safety assessment process and adapts them to the systems architecting process in conceptual design. The proposed framework also introduces a novel safety-based filtering approach for large system architecture design spaces. The framework’s effectiveness is illustrated with examples from applications in recent collaborative research projects with industry and academia. The work presented in this paper contributes to increasing maturity in conceptual design studies and enables more innovation by opening the design space while considering safety upfront.

Normal cloud model theory-based comprehensive fuzzy assessment of wooden pagoda safety

• It's the first time to apply normal cloud model into wooden pagoda safety assessment. • Two-way mapping of the "quantitative description-qualitative concept". • A four-level safety assessment index system. Currently the safety assessment of wood structure ancient buildings is mainly qualitative description, ignoring accurate quantitative calculation, and there are uncertain factors such as fuzziness and randomness that affect the results in the assessment process. Therefore, based on the cloud model theory of transformation between qualitative and quantitative uncertainties, this paper proposes a normal cloud model-based safety assessment approach for the protection research of wooden pagoda. A multi-level assessment system combining qualitative and quantitative indexes is constructed, and the comprehensive weight of the evaluation indexes is determined by combination weighting method. And combining with the scoring of evaluation indexes through quantitative analysis of point cloud, qualitative evaluation of experts, and published high-level papers, the comprehensive evaluation cloud model is constructed. According to the standard grade division, the criteria cloud model is constructed. And safety performance grade is determined by comparing the cloud similarity between the two clouds. Then this paper sets Yingxian wooden pagoda in China as an example, safety performance is quantified under this approach to determine its safety performance grade. The results show that the pagoda is the closest to third grade, in a certain dangerous state and consistent with the actual situation. The method takes into account the randomness and fuzziness factors, which makes assessment process more comprehensive and objective, provides a research paradigm for the safety assessment of ancient wooden buildings.

Heterogeneous Models Integration for Safety Critical Mechatronic Systems and Related Digital Twin Definition: Application to a Collaborative Workplace for Aircraft Assembly

Nowadays, several manufacturing systems are evolving towards a greater collaboration between human and robots. The development of such systems requires integrated design tasks involving many disciplines and domains such as systems engineering, safety analyses and multi-physics. Furthermore, the increasing presence of multiple and structured requirements makes the use of models inevitable during the designing phases and also strongly helpful during other phases of the system life-cycle. Besides, for a better efficiency, there is an increasing demand to have a Digital Twin of the system to be used for different purposes such as design improvements by playing different scenarios, virtual commissioning and controlling maintenance activities. In this paper, we first summarize the research context, the reference methodologies, and the emerging needs for Digital Twin creation. Then, we apply a design approach including Model-Based Systems Engineering (MBSE), Model-Based Safety Assessment (MBSA) and multi-physics modeling for the design of a collaborative workplace for the assembly of Electro-Mechanical Actuators on an aircraft wing. An operational flow to integrate MBSE, MBSA and multi-physics modelling activities is provided. Then, after having identified some relevant scientific barriers, we provide a meta-model for system models integration within a digital twin framework.

Integrated System Design and Safety Framework for Model-Based Safety Assessment

The increased complexity of modern engineered systems has introduced novel challenges for assessing their safety early in the life cycle. For example, due to the iterative nature of the design and safety life cycle, there is constant data transformation and feedback of information between the system design models, safety analyses, and safety verification. Data transformation and feedback are often manually performed by engineers, which is time-consuming and error prone and can introduce inconsistencies in safety assessments. Although several model-based systems engineering approaches have been developed for safety analysis and safety verification, current approaches do not address the inconsistencies introduced in the safety assessment process. This study describes the Integrated System Design and Safety (ISDS) framework, which is a model-based safety assessment framework that aims to eliminate such inconsistencies. The framework combines a model-based safety analysis approach with a model-based safety verification. This paper extends previous work, which focused on the model-based safety analysis approach, to describe the model-based safety verification approach adopted in the ISDS framework. Safety verification is performed using a simulation-based fault injection approach and enabled by a fault injection engine, which injects failures into the system design and characterizes system behaviors to identify safety violations impacting the system. The results from the case study, in which the framework is used to assess the safety of a forward collision warning system, highlight that the algorithms and automated feedback loops of the framework can reduce inconsistencies in the safety assessment process while also identifying safety violations impacting the system.

Model-based safety assessment for conceptual aircraft systems design

Traditional system technology modeling in conceptual aircraft design mainly relies on empirical knowledge and methods derived from conventional systems, for which valid system architecture designs are known. Since these systems have been proven valid especially from a safety perspective, detailed system safety analyses are usually not necessary. For unconventional systems and innovative technologies, on contrary, new architectures have to be designed and system safety has, therefore, to be taken into account. Therefore, the application of model-based safety assessment (MBSA) for designing system architectures in conceptual aircraft design studies is proposed. A MBSA approach based on a Simulink architecture model is presented which is tailored for use in conceptual design studies. It is applied to the cryocooling system of a hybrid-electric powertrain architecture from an already-published study. The original architecture as well as possible architecture alternatives are investigated. As a result, a safer architecture version with lower number of components can be proposed. The application example indicates that using MBSA in conceptual design benefits the latter by providing insights into safety properties of the system and by pointing out architecture safety weaknesses. This could result in safer, thus more realistic system architectures.

Development of Failure Modes and Effects Analysis methodology using Model-Based Safety Assessment approach

During the development of aircraft systems, the safety assessment process activities are carried out in parallel. Traditionally, safety professionals perform Functional Hazard Assessment, Preliminary System Safety Assessment, and System Safety Assessment. Despite the availability of many modern and advanced tools for performing calculations during the implementation of the System Safety Assessment, a great responsibility (and, accordingly, the risk of error) remains with the person. Model-Based Safety Assessment is a new and rapidly developing approach to evaluate the safety of airborne equipment worldwide, which improves existing methodologies for performing various analyzes, such as Failure Modes and Effects Analysis (FMEA). Implementation of FMEA using this approach requires the development of special software tools that allow both to create a model of the analyzed onboard equipment and systems, and to provide an opportunity to use this model when performing FMEA. One such tool is ANSYS Medini Analyze. Model-oriented method for performing FMEA is proposed within this article. This method fully complies with the requirements of ARP-4761 and provides possibility to minimize the likelihood of human error. Model-oriented method for performing FMEA has been probated on the example of flight control system at various levels of abstraction (system, item, functional block and hardware/software level).

Finite-state machine method in the safety assessment process using Stateflow diagrams

Safety Assessment Process is one of the most important processes of the avionics systems design. Modern and perspective aircraft uses a Model-Based Design approach, but Safety Assessment performing with a high risk of error due to human factors. Nowadays design tools, like MATLAB Simulink and ANSYS medini analyze, propose new methods of the safety assessment process—Model-Based Safety Assessment. (MBSA). The types of MBSA were analyzed and classified. This work describes the MBSA approach in general and focuses on MBSA in part of the failure modeling using the finite-state machine method. The use of this method can help both the safety team and development team to have a clear dialogue about the system’s work and failures.

Model-based Safety Assessment of a Triple Modular Generator with xSAP

Abstract The system design process needs to cope with the increasing complexity and size of systems,motivating the replacement of labor intensivemanual techniques with automated and semi-automated approaches.Recently, formal methods techniques, such as model-based verification and safety assessment, have been increasingly used to model systems under fault and to analyze them, generating artifacts such as fault trees and FMEA tables. In this paper, we show how to apply model-based techniques to a realistic case study from the avionics domain: a high integrity power distribution system, the Triple Modular Generator (TMG). The TMG is composed of a redundant and reconfigurable plant and a controller that must guarantee a high level of reliability. The case study is a significant challenge, from the modeling perspective, since it implements a complex reconfiguration policy, specified via a number of requirements in natural language, including a set of mutually dependent and potentially conflicting priority constraints. Moreover, from the verification standpoint, the controller must be able to handle an exponential number of possible faulty configurations. Our contribution is twofold. First, we formalize and validate the requirements and, using a constraint-based modeling style, we synthesize a correct by construction controller, avoiding the enumeration of all possible fault configurations, as is currently done by manual approaches. Second, we describe a comprehensive methodology and process, supported by the xSAP safety analysis platform that targets the modeling and safety assessment of faulty systems. Using xSAP, we are able to automatically extract minimal cut sets for the TMG. We demonstrate the scalability of our approach by analyzing a parametric version of the TMG case study that contains more than 700 variables and 90 faults.

Model-based safety assessment with SysML and component fault trees: application and lessons learned

Mastering the complexity of safety assurance for modern, software-intensive systems is challenging in several domains, such as automotive, robotics, and avionics. Model-based safety analysis techniques show promising results to handle this challenge by automating the generation of required artifacts for an assurance case. In this work, we adapt prominent approaches and propose to augment of SysML models with component fault trees (CFTs) to support the fault tree analysis and the failure mode and effects analysis. While most existing approaches based on CFTs are only targeting the system topology, e. g., UML class diagrams, we propose an integration of CFTs with SysML internal block diagrams as well as SysML activity diagrams. We realized our approach in a prototypical tool. We conclude with best practices and lessons learned that emerged from our case studies with an electronic power steering system and a boost recuperation system.

A model-based and software-assisted safety assessment concept for reconfigurable PnP-systems

In times of volatile market situations, the deployment of Plug-and-Produce (PnP) technology for reconfigurable systems contributes to better responsiveness to satisfy changing production demands. However, the possibility for rapid system (re-)configuration raises safety uncertainties and complicates the required safety assessment procedure. In accordance to the legislative requirements, safety engineers must conduct a thorough safety assessment for the system under consideration, which is highly time-consuming and demands extensive evaluations to ensure error-free results. This publication proposes a model-based safety assessment concept (MBSAFE), utilizing the concept of digital representations, simulations and semantic modeling to facilitate safety engineers during safety assessment and decision-making.

Dynamic Fault Tree Generation for Safety-Critical Systems Within a Systems Engineering Approach

Systems are getting increasingly complex and challenging to design. For safety-critical systems, the integration between model-based systems engineering and model-based safety assessment to improve the choice of the system architecture since the early design stage becomes a necessity. One of the integration solutions is to generate fault trees (FTs), either static or dynamic, directly from the system description. In this paper, we are particularly interested in the generation of the dynamic fault trees (DFTs) of the systems that contain redundancies, which is widely used in safety-critical systems to enhance their reliability. The goal of this paper is, first, to propose a redundancy profile and, second, to automatically generate the DFTs from system models. Since errors are propagated via input and output ports of the components, the generation process starts with a depth-first search graph traversal through the systems modeling language internal block diagram of the system. This diagram is considered as a multidirected graph in order to detect the external inputs, the nonredundant components, the switch components, and the redundant components of the system. Then, the redundancy information incorporated in the system model is used to generate the appropriate combinations of the FT. This FT is represented in a suitable format that can be studied using FT analysis tools, for both qualitative and quantitative safety analyses.

Validation of decision logic of an autoland system for a UAV using model-based safety-assessment techniques

Software of automatic flight control systems requires thorough verification and validation. Traditionally, this is achieved with elaborate development processes following pertinent industry standards. To reduce the development effort, however, new methods have emerged: a model-based software development process is used at the Institute of Flight System Dynamics of the Technical University of Munich for the design of auto-flight systems with MATLAB/Simulink. Besides, the model-based safety assessment (MBSA) framework ExCuSe has been developed, which implements methods for fault modeling and automatic cut-set extraction using the Simulink Design Verifier. This paper proposes an application of MBSA techniques for the efficient requirements and design validation of decision logic in auto-flight-system software. With ExCuSe, software design models of an investigated decision logic are supplemented by models for off-nominal inputs (e.g., a sensor fault) and for the design requirements. With the analysis, either a formal proof is obtained that the investigated decision logic fulfills the requirements under any circumstances (guaranteed properties), or a counterexample illustrates a requirement violation. The functional principle and applicability of the method are demonstrated by the analysis of decision logic of the autoland system of the SAGITTA Demonstrator UAV. ExCuSe is used to prove that the logic guarantees a timely flare initiation so that a safe touchdown sink rate is achieved despite altitude-measurement inaccuracy and closed-loop flare dynamics uncertainty. As virtually all auto-flight systems feature decision logic, this initial demonstration of the technique opens up many opportunities for further applications in future work.

ADEPS: A Methodology for Designing Prognostic Applications

Prognostics applications predict the future evolution of an asset under study, by diagnosing the actual health state and modeling the future degradation. Due to rapidly growing interest in prognostics, different prediction techniques have been developed independently without a consistent and systematic design. In this paper we formalize the prognostics design process with a novel methodology entitled ADEPS (Assisted Design for Engineering Prognostic Systems). ADEPS combines prognostics concepts with model-based safety assessment, criticality analysis, knowledge engineering and formal verification approaches. The main activities of ADEPS include synthesis of the safety assessment model from the design model, prioritization of the system failure modes, systematic prognostics model selection and verification of the adequacy of the prognostics results with respect to design requirements. By linking system-level safety assessment models and prognostics results, design and safety models are updated with online information about different failure modes. This step enables system-level health assessment includingprognostics predictions of different failure modes. The endto-end application of themethodology for the design and evaluation of a power transformer demonstrates the benefits of the proposed approach including reduced design time and effort, complete consideration of prognostics algorithms and updated system-level health assessment.

Failure Propagation Modeling and Analysis via System Interfaces

Safety-critical systems must be shown to be acceptably safe to deploy and use in their operational environment. One of the key concerns of developing safety-critical systems is to understand how the system behaves in the presence of failures, regardless of whether that failure is triggered by the external environment or caused by internal errors. Safety assessment at the early stages of system development involves analysis of potential failures and their consequences. Increasingly, for complex systems, model-based safety assessment is becoming more widely used. In this paper we propose an approach for safety analysis based on system interface models. By extending interaction models on the system interface level with failure modes as well as relevant portions of the physical system to be controlled, automated support could be provided for much of the failure analysis. We focus on fault modeling and on how to compute minimal cut sets. Particularly, we explore state space reconstruction strategy and bounded searching technique to reduce the number of states that need to be analyzed, which remarkably improves the efficiency of cut sets searching algorithm.

A synthesis of logic and bio-inspired techniques in the design of dependable systems

Much of the development of model-based design and dependability analysis in the design of dependable systems, including software intensive systems, can be attributed to the application of advances in formal logic and its application to fault forecasting and verification of systems. In parallel, work on bio-inspired technologies has shown potential for the evolutionary design of engineering systems via automated exploration of potentially large design spaces. We have not yet seen the emergence of a design paradigm that effectively combines these two techniques, schematically founded on the two pillars of formal logic and biology, from the early stages of, and throughout, the design lifecycle. Such a design paradigm would apply these techniques synergistically and systematically to enable optimal refinement of new designs which can be driven effectively by dependability requirements. The paper sketches such a model-centric paradigm for the design of dependable systems, presented in the scope of the HiP-HOPS tool and technique, that brings these technologies together to realise their combined potential benefits. The paper begins by identifying current challenges in model-based safety assessment and then overviews the use of meta-heuristics at various stages of the design lifecycle covering topics that span from allocation of dependability requirements, through dependability analysis, to multi-objective optimisation of system architectures and maintenance schedules.