Examensarbetet är utfört vid BAE Systems Bofors AB i Karlskoga. Projektet har gått ut på att utvärdera den nya teorin STAMPoch testa det tillhörande verktyget STPAinom säkerhetsarbete mot det avgränsade ARCHER-systemets delsystem granatgrip-/lyftdon. I dag blir systemen mer och mer komplicerade och de nuvarande metoderna har inte utvecklats i samma takt för att göra en grundläggande säkerhetsanalys då många av olyckorna härrör från oförutsedda interaktioner. Teorin och verktyget är en nyutvecklad metod för att identifiera och värdera risker i ett system eller en produkt. Företaget har ännu inte satt sig in tillräckligt i professorn på MIT, Nancy Levesons rapport som ligger bakom denna nya metod för att arbeta med riskbedömning. Eftersom det är en relativt ny teori inom säkerhetsarbete så finns det inte speciellt mycket forskning att tillgå och antalet källor som finns tillgängliga är få. Den forskning som finns är för det mesta test från olika företags verksamheter med hela hennes tankesätt som grund. Det vi kommit fram till är att STAMP och STPA är ett väldigt bra verktyg inom säkerhetsarbete för att identifiera faror och olycko rmen också att det ger väldigt mycket information som sedan är irrelevant. Det finns även tillägg till teorin STAMP och verktyget STPA som kommer vara nyttiga för BAE Systems att ta till sig men som inte varit relevant i detta examensarbete. / The thesis is performed at BAE Systems AB in Karlskoga. The purpose of this project is to evaluate the new theory STAMP and try-out the associated tool STPA within safety work unto the defined ARCHER-system’s subsystem "grenade-grip/hoists". Today systems have become more complex and the current methods have not evolved at the same pace as the technology to make a basic safety analysis when many of the accidents occur from unforeseen interactions. The theory and the tool is a newly developed method to identify and assess risks in a system or product. The company has not yet familiarized themselves enough in the professor at MIT, Nancy Leveson’s report that is the founder of this new method in finding risks. It is a relatively new theory in safety and therefore, there’s not much research and the number of sources available are few. The research available is for the most part various tests from different corporate activities with Nancy’s whole mindset as basis. Our results show that STAMP and STPA is a very good theory and tool within safety analysis to identify hazards and accidents. The only disadvantage is that it also gives a lot of information that was irrelevant. The theory also have some additions to STAMP and STPA that will be useful for BAE Systems to embrace but has not been relevant in this thesis.

Este trabalho apresenta os principais conceitos de um modelo de referência, chamado de Consciência Situacional em Voo (In-Flight Awareness, IFA), e sua implementação embarcada IFA2S (In-Flight Awareness Augmentation System). IFA é um conceito novo e realista e voltado à melhoria da segurança de voo de VANTs. IFA2S tem o potencial de alavancar confiabilidade dos VANTs aos níveis encontrados na aviação geral. Ele aumenta a consciência aeronave tanto em relação a si mesma e seu ambiente circundante e, ao mesmo tempo reconhece restrições da plataforma para agir de acordo com algoritmos de decisão pré-definidos. Este trabalho apresenta o IFA como consequência dos requisitos de segurança estabelecidos através da metodologia STPA, faz uma avaliação quantitativa do impacto do IFA2S no risco operacional dos VANTs e apresenta orientações de implementação em hardware. Simulações de validação são realizadas com uso do software Labview e do simulador de voo XPlane. / This work presents the key concepts of IFA, In-Flight Awareness, and its implementation IFA2S (In-Flight Awareness Augmentation System). IFA is a novel and realistic concept intended to enhance flight safety. IFA2S has the potential to leverage UAVs reliability to the levels of general aviation aircraft. It increases aircraft awareness regarding both itself and its environment and, at the same time recognizes platform constraints to act in accordance to predefined decision algorithms. This paper presents the IFA as a consequence of the safety requirements established using STPA methodology, a quantitative assessment of the impact of IFA2S in the operational risk of UAVs as well as suggestions for hardware implementation. Simulations are carried out using Labview software and the flight simulator XPlane.

Este trabalho apresenta os principais conceitos de um modelo de referência, chamado de Consciência Situacional em Voo (In-Flight Awareness, IFA), e sua implementação embarcada IFA2S (In-Flight Awareness Augmentation System). IFA é um conceito novo e realista e voltado à melhoria da segurança de voo de VANTs. IFA2S tem o potencial de alavancar confiabilidade dos VANTs aos níveis encontrados na aviação geral. Ele aumenta a consciência aeronave tanto em relação a si mesma e seu ambiente circundante e, ao mesmo tempo reconhece restrições da plataforma para agir de acordo com algoritmos de decisão pré-definidos. Este trabalho apresenta o IFA como consequência dos requisitos de segurança estabelecidos através da metodologia STPA, faz uma avaliação quantitativa do impacto do IFA2S no risco operacional dos VANTs e apresenta orientações de implementação em hardware. Simulações de validação são realizadas com uso do software Labview e do simulador de voo XPlane. / This work presents the key concepts of IFA, In-Flight Awareness, and its implementation IFA2S (In-Flight Awareness Augmentation System). IFA is a novel and realistic concept intended to enhance flight safety. IFA2S has the potential to leverage UAVs reliability to the levels of general aviation aircraft. It increases aircraft awareness regarding both itself and its environment and, at the same time recognizes platform constraints to act in accordance to predefined decision algorithms. This paper presents the IFA as a consequence of the safety requirements established using STPA methodology, a quantitative assessment of the impact of IFA2S in the operational risk of UAVs as well as suggestions for hardware implementation. Simulations are carried out using Labview software and the flight simulator XPlane.

This thesis aims to solicit and elicit the view of experienced system safety analysts in the applicability and use of STPA, a hazard analysis derived from the STAMP-framework. The increase in complexity in systems elevates the chance of hazards and risks being obfuscated. Thus, the intention is to expand, deepen and theorize about the STPA-methodology in relation to the role of system safety analysts in Sweden. The results show that the greatest use of STPA might lie in integrating the desired procedural steps with the hazard analysis techniques used today. This is due to individual capabilities, guidance in identification and evaluation of risks, as well as the reductionistic perspective that prevails in society today. Unlike STPA’s claim for completeness, the impression of the system analysts is that absolute safety can never be guaranteed.

No description available.

There have been several accidents involving autonomous vehicles on public roadways under scenarios that are normally avoidable by competent human drivers. This thesis contains a review of these accidents and their causes as a result of inadequate hazard mitigation. As a solution to this problem, a novel design pattern is proposed. This design pattern was developed from a hazard analysis using Systems Theoretic Process Analysis ( STPA ) methodologies that analyzed the circumstances common to several of these accidents. To demonstrate the effectiveness of the novel design pattern, an example system is constructed and tested in simulation against several accident scenarios similar to the ones studied. The results are then explained to demonstrate the effectiveness of the proposed design pattern. / Thesis / Master of Applied Science (MASc)

The adoption of Health Information Systems (HIS) by primary care clinics and practitioners has become a standard in the healthcare industry. This increase in HIS utilization enables the informatization and automation of many paper-based clinical workflows, such as clinical referrals, through systems interoperability. The healthcare industry defines several interoperability standards and mechanisms to support the exchange of data among HIS. For example, the health authorities, Interior Health and Northern Health, created the CDX system to provide interoperability for HIS across British Columbia using SOAP Web Services and HL7 Clinical Document Architecture (CDA) interoperability standards. The CDX interoperability allows HIS such as Electronic Medical Record (EMR) systems to exchange information with other HIS, such as patients clinical records, clinical notes and laboratory testing results. In addition, to ensure the EMR systems adhere to the CDX specification, these health authorities conduct conformance testing with the EMR vendors to certify the EMR systems. However, conformance testing can only cover a subset of the systems' specifications and a few use cases. Therefore, systems properties that are not closely associated with the systems (i.e. emergent properties) are hard, or even impractical, to assure using only conformance testing. System safety is one of these properties that are particularly significant for EMR systems because it deals with patient safety. A well-known approach for improving systems safety is through hazard analysis. For scenarios where the human factor is an essential part of the system, such as EMR systems, the System-Theoretic Process Analysis (STPA) is more appropriate than traditional hazard analysis techniques. In this work, we perform a hazard analysis using STPA on the CDX conformance profile in order to evaluate and improve the safety of the CDX system interoperability. In addition, we utilize and customize a tool named FASTEN to support and facilitate the analysis. To conclude, our analysis identified a number of new safety-related constraints and improved a few other already specified constraints. / Graduate

Autonomous Vehicles (AVs) should result in tremendous benefits to safe human transportation. Recent reports indicate a global average of 3,287 road crash related fatalities a day with the blame, in most cases, assigned to the human driver. By replacing the main cause, AVs are predicted to significantly reduce road accidents -- some claiming up to a 90% reduction on US roads. However, achieving these numbers is not simple. AVs are expected to assume tasks that human drivers perform both consciously and unconsciously -- in some instances, with Machine Learning. AVs incur new levels of complexity that, if handled incorrectly, can result in failures that cause loss of human life and damage to the environment. Accidents involving SAE Level 2 vehicles have highlighted such failures and demonstrated that AVs have a long way to go. The path towards safe AVs includes system architectures that provide effective failure monitoring, detection and mitigation. These architectures must produce AVs that degrade gracefully and remain sufficiently operational in the presence of failures. We introduce Safe-AV, a fault tolerant safety architecture for AVs that is based on the commonly adopted E-Gas 3 Level Monitoring Concept, the Simplex Architecture and guided by a thorough hazard analysis in the form of Systems-Theoretic Process Analysis (STPA). We commenced the architecture design with a review of some modern AV accidents which helped identify the types of failures AVs can present and acted as a first step to our STPA. The hazard analysis was applied to an initial AV architecture (without safety mechanisms) consisting of components that should be present in a typical AV (based on the literature and our ideas). Our STPA identified the system level accidents, hazards and corresponding loss scenarios that led to well-founded safety requirements which, in turn, evolved the initial architecture into Safe-AV. / Thesis / Master of Applied Science (MASc)

The increasing complexity of embedded systems development is becoming difficult to handle with development environments based on disjoint engineering tools. Support for interactions between various engineering tools, especially through automated means, has therefore received an increased amount of attention during the last few years. The subsequent increase in the amount of tool integration is leading to an increased impact of tool integration on non-functional properties of development efforts, development environments and end products. At the same time there is a lack of methods and tools for analysing the relationship between these properties and tool integration. To establish a foundation for analysing this generic relationship, the specific relationship between tool integration and the safety of end products is analysed in this thesis. A survey was conducted to analyze the State of the Art of tool integration as related to safety. This survey specifically identified the lack of an efficient handling of tool integration by modern safety standards as an important concern. In relation to this survey, three theories were identified as of specific importance. These are the school of thought known as Systems Thinking, the Systems-Theoretic Accident Model and Processes (STAMP) causality model and the System-Theoretic Process Analysis (STPA) hazard analysis technique. Building on these theories, this thesis provides original contributions intended to (1) describe concepts and models related to tool integration and safety (the first and second contribution), (2) link tool integration to safety in a way that reduces complexity during analysis (the third contribution) and (3) propose how to interpret and make use of the implications of the presented theories and the first three contributions (the fourth and fifth contribution). • The first contribution is a new conceptual model of a development effort that emphasizes tool integration. • The second contribution is a new reference model for tool integration in highly heterogeneous environments. • The third contribution consists of nine safety-related tool chain properties, i.e. properties of tool chains that could mitigate at least part of the risks introduced by tool integration. • The fourth contribution is a proposition on how to identify safety implications due to a high level of automation of tool integration. • The fifth contribution is a proposition for a new software tool qualification process.

This report delves into the early developmental phase of an autonomous vehicle designed for defense applications. Navigating diverse terrains, this unmanned ground vehicle (UGV) poses unique challenges, particularly in the absence of clearly defined directives found in typical traffic scenarios. The analysis employs the Systems-Theoretic Process Analysis (STPA) to identify and anticipate risks inherent in the conceptual stage of product development. Beyond the specific UGV case, the report explores the broader landscape of validating autonomous systems. It discusses prevalent methods, emphasizing adaptability to different contexts and stages of development. By shedding light on the risks and challenges of autonomy in vehicles and examining effective validation strategies, this report aims to contribute valuable insights to the ongoing discourse surrounding autonomous vehicle development.