A system is safety-critical if its malfunctioning could have catastrophic consequences for people, property or the environment, e.g., the failure in a car's braking system could be potentially tragic. To produce such type of systems, special procedures, and strategies, that permit their safer deployment into society, should be used. Therefore, manufacturers of safety-critical systems comply with domain-specific safety standards, which embody the public consensus of acceptably safe. Safety standards also contain a repository of expert knowledge and best practices that can, to some extent, facilitate the safety-critical system’s engineering. In some domains, the applicable safety standards establish the accepted procedures that regulate the development processes. For claiming compliance with such standards, companies should adapt their practices and provide convincing justifications regarding the processes used to produce their systems, from the initial steps of the production. In particular, the planning of the development process, in accordance with the prescribed process-related requirements specified in the standard, is an essential piece of evidence for compliance assessment. However, providing such evidence can be time-consuming and prone-to-error since it requires that process engineers check the fulfillment of hundreds of requirements based on their processes specifications. With access to suitable tool-supported methodologies, process engineers would be able to perform their job efficiently and accurately. Safety standards prescribe requirements in natural language by using notions that are subtly similar to the concepts used to describe laws. In particular, requirements in the standards introduce conditions that are obligatory for claiming compliance. Requirements also define tailoring rules, which are actions that permit to comply with the standard in an alternative way. Unfortunately, current approaches for software verification are not furnished with these notions, which could make their use in compliance checking difficult. However, existing tool-supported methodologies designed in the legal compliance context, which are also proved in the business domain, could be exploited for defining an adequate automated compliance checking approach that suits the conditions required in the safety-critical context. The goal of this Licentiate thesis is to propose a novel approach that combines: 1) process modeling capabilities for representing systems and software process specifications, 2) normative representation capabilities for interpreting the requirements of the safety standards in an adequate machine-readable form, and 3) compliance checking capabilities to provide the analysis required to conclude whether the model of a process corresponds to the model with the compliant states proposed by the standard's requirements. Our approach contributes to facilitating compliance checking by providing automatic reasoning from the requirements prescribed by the standards, and the description of the process they regulate. It also contributes to cross-fertilize two communities that were previously isolated, namely safety-critical and legal compliance contexts. Besides, we propose an approach for mastering the interplay between highly-related standards. This approach includes the reuse capabilities provided by SoPLE (Safety-oriented Process Line Engineering), which is a methodological approach aiming at systematizing the reuse of process-related information in the context of safety-critical systems. With the addition of SoPLE, we aim at planting the seeds for the future provision of systematic reuse of compliance proofs. Hitherto, our proposed methodology has been evaluated with academic examples that show the potential benefits of its use. / AMASS

Insulin pumps are designed for the self-management of diabetes mellitus in patients and are known for their complexity of use. Pump manufacturers engage trainers to teach patients how to use the devices correctly to control the symptoms of their disease. Usability research related to insulin pumps and other infusion pumps with first-time users as participants has centered on the relationship between user interface design and the effectiveness of task completion. According to prior research, the characteristics of system behavior in a real life environment remain elusive. A suitable approach to acquire information about potential usability problems encountered by first-time users is to obtain this information from the health care professionals who train them. The purpose of the study was to discover the lived experiences and shared impressions of insulin pump trainers during training sessions with first-time users. Interpretative Phenomenological Analysis (IPA) was used to uncover the phenomena associated with usability challenges that first-time users of insulin pumps face when learning to use the device. Six participants representing a homogeneous sample were recruited from a wide geographic area in the United States, and semi-structured interviews containing open-ended questions were conducted with the respondents. The data from the lived experiences and shared impressions of the participants were used to develop the following five super-ordinate themes: Emotion-charged Environment, Personalized Training, Safety Issues and Disaster Planning, Professional Dedication, and The Voice. The essence of participants’ experience was described around the pivotal moment when the training sessions are successfully completed and insulin pump therapy becomes alive. The findings of this study have implications for information systems professionals who conduct research on the safe design and usability of safety critical medical devices. In addition, the findings from this study create opportunities for practice to improve the initiation of insulin pump therapy in patients with diabetes.

The Java platform is becoming a vital tool for developing real-time and safety-critical systems. Design patterns and the availability of Java libraries, both provide solutions to many known problems. Furthermore, the object-oriented nature of Java simplifies modular development of real-time systems. However, limitations of Java as a programming language for real-time systems are a notable obstacle to producing safe real-time systems. These limitations are found in the unpredictable execution model of the language, due to Java’s garbage collector, and the lack of support for non-functional specification and verification tools. In this dissertation I introduce SafeJML, a specification language for support of functional and non-functional specifications, based on an implementation of a safety-critical Java platform and the Java Modeling Language (JML). This dissertation concentrates on techniques that enable specification and dynamic checking of timing constraints for some important Java features, including methods and subtyping. SafeJML and these dynamic checking techniques allow modular specification and checking of safety-critical systems, including those that use object-orientation and design patterns. Such coding techniques could have maintenance benefits for real-time and safety-critical software

No description available.

No description available.

In this thesis I take up the challenge to see whether designers would benefit from using science fiction in order to extend their resources when generating novel interaction design concepts for emergency situations. I discuss the relationship between the nature of fiction and design, and trademarks for emergency situations. I choose four scenes from different media types to analyse, further ideate and evaluate in order to derive final concepts, which I submitted to user testing. I argue that designers may well take science fiction into consideration when generating novel interaction design concepts in a successful way.

Modern complex safety-critical socio-technical systems (STSs) operate in an environment that requires high levels of human-machine interaction. Given the potential for catastrophic events , understanding human errors is a critical research area spanning disciplines such as management science, cognitive engineering, resilience engineering, and systems theory. However, a research gap remains when researching how errors impact system performance from a systemic perspective. This dissertation employs a systematic methodology and develops models that explore the relationship between errors and system performance, considering both macro-organizational and micro-worker perspectives. In Essay 1, the focus is on how firms respond to serious errors (catastrophic events), by exploring the oscillation behavior associated with the organizational learning and forgetting theory. The proposed simulation model contributes to the organizational science literature with a comprehensive approach that assesses the firm's response time to "serious" errors when the firm has a focus on safety with established safety thresholds. All of these considerations have subsequent impact on future performance. Essay 2 explores the relationship between safety-critical system's workers' workload, human error, and automation reliance for the Belgian railway traffic control center. Key findings include a positive relationship between traffic controller performance and workload, and an inverted U-shaped relationship with automation usage. This research offers new insights into the effects of cognitive workload and automation reliance in safety-critical STSs. Essay 3 introduces a calibrated System Dynamics model, informed by empirical data and existing theories on workload suboptimality. This essay contributes to the managerial understanding of workload management, particularly the feedback mechanism between operators' workload and human errors, which is driven by overload and underload thresholds. The model serves as a practical tool for managerial practitioners to estimate the likelihood of human errors based on workload distributions. Overall, this dissertation presents an interdisciplinary and pragmatic approach, blending theoretical and empirical methodologies. Its broad impacts extend across management science, cognitive engineering, and resilience engineering, contributing significantly to the understanding and management of safety-critical socio-technical systems. / Doctor of Philosophy / This dissertation is motivated by the increasing autonomy in infrastructure systems designed to enhance safety performance. Yet paradoxically, we continue to witness system failures leading to catastrophic disasters. High-profile incidents such as the Metro-North train derailment in New York City, the Boeing 737 MAX plane crashes, and the Challenger and Columbia space shuttle accidents highlight this contradiction. This research delves into safety-critical systems where the intricate collaboration between humans and machines is crucial, and where even minor human errors can lead to disastrous consequences. This dissertation is presented in three parts. In the first part I examine how firms react to serious errors. The study focuses on their learning processes following safety incidents and the potential for these lessons to be forgotten over time. I introduced a simulation model grounded in the organizational science literature, offering deeper insights into how companies respond to errors, including changes in safety focus, safety culture, and policy, and the impact of these factors on future company's performance. The second part shifts to a worker-centered perspective, exploring the relationship between workload, performance, and automation usage among traffic controllers. The findings indicate that while performance can improve with an increase in workload up to a certain threshold, excessive reliance on automation may lead to a decline in performance. This part of the study sheds light on how cognitive workload and technology usage influence operators in safety-critical roles. The final part of the dissertation presents another simulation model, this time focusing on how workload, and the resulting stress and boredom due to workload, influence the likelihood of errors. Utilizing real operational data from the Belgian railway transportation system, this model aids managers in understanding how to optimally balance workloads to minimize error risks. Overall, this dissertation takes an interdisciplinary and pragmatic approach, merging theoretical concepts with empirical data. Its extensive impact spans management science, cognitive engineering, and resilience engineering, significantly enhancing our comprehension and management of safety-critical socio-technical systems.

<p dir="ltr">Safety and explainability are a top priority across many real-world applications of control in safety-critical systems. Networked dynamic systems are one sub-class of models that encompass many of the safety-critical systems in need of such safety guarantees. In this dissertation, we present our work in the safety-critical control of general non-networked epidemic processes, as well as our work on the modeling and analysis of networked epidemic-spreading processes. We then present a framework for the safety-critical control of networked dynamic systems including individual node vulnerability analysis and a CBF-based collaborative-safety condition. We develop a collaborative-safety framework that leverages high-order barrier functions to encode the effect of neighbors on individual safety requirements and demonstrate how this framework can be used in both epidemic models and in formation control problems. We provide an analysis on the finite-time convergence rate of our collaborative-safety algorithm in the special case of a tree structure network for a formation control application. Finally, we provide some concluding remarks and discussion on important directions for future work in the field of collaborative control for multi-agent autonomous systems.</p>

The importance and requirements of certifying safety critical software is today more apparent than ever. This study focuses on the standards and practices used within the avionics, automotive and medical domain when it comes to safety critical software. We identify critical problems and trends when certifying safety critical software and propose a proof-of-concept using static analysis, model checking and incremental SAT solving as a contribution towards solving the identified problems. We present quantitative execution times and code coverage results of our proposed solution. The proposed solution is developed under the assumptions of safety critical software standards and compared to other studies proposing similar methods. Lastly, we conclude the issues and advantages of our proof-of-concept in perspective of the software developer community

Internet applications have been extended to various aspects of everyday life and offer services of high reliability and security. In the Academia, Internet applications offer useful tools for the remote creation of simulation models and real-time conduction of control experiments. The aim of this study was the design of a reliable, safe and secure software system for real time operation of a remote aero gas turbine, with the use of standard Internet technology at very low cost. The gas turbine used in this application was an AMT Netherlands Olympus micro gas turbine. The project presented three prototypes: operation from an adjacent computer station, operation within the Local Area Netwok (LAN) of Cranfield University and finally, remotely through the Internet. The gas turbine is a safety critical component, thus the project was driven by risk assessment at all the stages of the software process, which adhered to the Spiral Model. Elements of safety critical systems design were applied, with risk assessment present in every round of the software process. For the implementation, various software tools were used, with the majority to be open source API’s. LabVIEW with compatible hardware from National Instruments was used to interface the gas turbine with an adjacent computer work station. The main interaction has been established between the computer and the ECU of the engine, with additional instrumentation installed, wherever required. The Internet user interface web page implements AJAX technology in order to facilitate asynchronous update of the individual fields that present the indications of the operating gas turbine. The parameters of the gas turbine were acquired with high accuracy, with most attention given to the most critical indications, exhaust gas temperature (EGT) and rotational speed (RPM). These are provided to a designed real-time monitoring application, which automatically triggers actions when necessary. The acceptance validation was accomplished with a formal validation method – Model Checking. The final web application was inspired by the RESTful architecture and allows the user to operate the remote gas turbine through a standard browser, without requiring any additional downloading or local data processing. The web application was designed with provisions for generic applications. It can be configured to function with multiple different gas turbines and also integrated with external performance simulation or diagnostics Internet platforms. Also, an analytical proposal is presented, to integrate this application with the TURBOMATCH WebEngine web application, for gas turbine performance simulation, developed by Cranfield University.