O avanço recente da tecnologia na área de sistemas digitais representa uma grande oportunidade para realizar um importante progresso em diversos aspectos dos sistemas de controle e proteção tradicionais. No entanto, os requisitos provenientes do uso intensivo de software em sistemas críticos de segurança, aumenta a demanda por uma abordagem adequada que possa ser baseada na experiência nesta área. Apesar de vários modelos de capacidade de maturidade estarem em constante desenvolvimento, ainda é um desafio estabelecer uma forma coerente para a melhoria e avaliação do processo de desenvolvimento de software. O objetivo desta pesquisa é propor um método para obtenção de perfis de capacidade baseados na aplicação do modelo de referência brasileiro para melhoria do processo de software MR-MPS, em conjunto com a extensão de segurança do modelo de capacidade e maturidade CMMI-DEV +SAFE, embasado pela percepção de especialistas em segurança por meio da aplicação de um modelo de decisão por múltiplos critérios. / The recent technology advance in the digital systems area represents a great opportunity to make important progress in many aspects of traditional control and protection systems. However, requirements derived from the intensive use of software in safety critical systems raises the demand for a suitable approach that can be based on the expertise in this area. Although a number of capability maturity models have been in constant development, it is still challenging to establish a coherent path for software process improvement and evaluation. The goal of this research work is to propose a method for building capability profiles based on the application of the Brazilian Reference Model for Software Process Improvement MR-MPS, along with the Capability Maturity Model for Development safety extension CMMI-DEV +SAFE, supported by safety engineers insight through the application of a multi criteria decision model.

This thesis examines the application of Systems-Theoretic Accident Model and Processes (STAMP) in healthcare and the analysis of patient safety incidents. Healthcare organisations have a responsibility for the safety of the patients they are treating. This includes the avoidance of unintended or unexpected harm to people during the provision of care. Patient safety incidents, that is adverse events where patients are harmed, are investigated and analysed as accidents are in other safety-critical industries, to gain an understanding of failure and to generate recommendations to prevent similar incidents occurring in the future. However, there is some dissatisfaction with the current quality of incident analysis in healthcare. There is dissatisfaction with the recommendations that are generated from healthcare incident analysis which are felt to produce weak and ineffective remedial actions, often including retraining of individuals and small policy change. Issues with current practice have been linked to the use of Root Cause Analysis (RCA), an analysis method that often results in the understanding of an accident as being the result of a linear chain of events. This type of simple linear approach has been the target of criticism in safety science research and is not felt to be effective in the analysis of incidents in complex systems, such as healthcare. Research in accident analysis methods has developed from a focus on technical failure and individual human actions to consideration of the interactions between people, technology and the organisation. Accident analysis methods have been developed that guide investigations to consideration of the whole system and interactions between system components. These system approaches are judged to be superior to simple linear approaches by the research community, however, they are not currently used in healthcare incident investigation practice. The systems approach of STAMP is felt to be a promising method for the improvement of healthcare incident analysis. STAMP strongly embodies the concepts of systems theory and analyses human decision-making. The application of STAMP in healthcare was investigated through three case studies, which applied STAMP in: 1. The analysis of the large-scale organisational failure at Mid-Staffordshire NHS Trust between 2005-2009. 2. The analysis of a common small-scale hospital-based medication prescription error. 3. The analysis of patient suicide in the community-based services of a Mental Health Trust. The effectiveness of the STAMP applications was evaluated with feedback from healthcare stakeholders on the usability and utility of STAMP and discussion of the STAMP applications against criteria for accident analysis models and methods. Healthcare stakeholders were generally positive about the utility of STAMP, finding it to provide a system view and guide consideration of interactions between system components. They also felt it would help them generate recommendations and were positive about the future application of STAMP in healthcare. However, many felt it to be a complicated method that would need specialist expertise to apply. The STAMP applications demonstrated the ability of STAMP to consider the whole system and guide an analysis to the generation of recommendations for system measures to prevent future incidents. From the findings of the research, recommendations are made to improve STAMP and to assist future applications of STAMP in healthcare. The research also discusses the other factors that influence incident analysis beyond that of the analytical approach used and how these need to be considered to maximise the effectiveness of STAMP.

<p>The use of computer-based systems is rapidly increasing and such systems can now be found in a wide range of applications, including safety-critical applications such as cars and aircrafts. To make the development of such systems more efficient, there is a need for tools for automatic safety analysis, such as analysis of fault tolerance.</p><p>In this thesis, a tool for automatic formal analysis of fault tolerance was developed. The tool is built on top of the existing development environment for the synchronous language Esterel, and provides an output that can be visualised in the Item toolkit for fault tree analysis (FTA). The development of the tool demonstrates how fault tolerance analysis based on formal verification can be automated. The generated output from the fault tolerance analysis can be represented as a fault tree that is familiar to engineers from the traditional FTA analysis. The work also demonstrates that interesting attributes of the relationship between a critical fault combination and the input signals can be generated automatically.</p><p>Two case studies were used to test and demonstrate the functionality of the developed tool. A fault tolerance analysis was performed on a hydraulic leakage detection system, which is a real industrial system, but also on a synthetic system, which was modeled for this purpose.</p>

In the presence of operational uncertainty, one of the greatest challenges in systems engineering is to ensure system effectiveness, mission capability and survivability. Safety management is shifting from passive, reactive and diagnosis-based approaches to autonomous architectures that will manage safety and survivability through active, proactive and prognosis-based solutions. Resilience engineering is an emerging discipline, with alternative recommendations on safer and more survivable system architectures. A resilient system can "absorb" the impact of change due to unexpected disturbances, while it "adapts" to change, in order to maintain its physical integrity and mission capability. A framework of proposed resilience estimations is the basis for a scenario-based assessment technique, driven by modeling and simulation-based (M&S) analysis, for obtaining system performance, health monitoring, damage propagation and overall mission capability responses. For the technique development and testing, a small-scale canonical problem has been formulated, involving a reconfigurable spring-mass-damper system, in a multi-spring configuration. Operational uncertainty is introduced through disturbance factors, such as external forces with varying magnitude, input frequency, event duration and occurrence time. Case studies with varying levels of damping and alternative reconfiguration strategies return the effects of operational uncertainty on system performance, mission capability, and survivability, as well as on the "restore", "absorb", and "adapt" resilience capacities. The Topological Investigation for Resilient and Effective Systems, through Increased Architecture Survivability (TIRESIAS) technique is demonstrated for a reduced scale, reconfigurable naval cooling network application. With uncertainty effects modeled through network leak combinations, TIRESIAS provides insight on leak effects to survival times, mission capability degradations, and on resilience function capacities, for the baseline configuration. Comparative case studies were conducted for different architecture configurations, which have been generated for different total number of control valves and valve locations on the topology.

Thesis (Ed. D.)--West Virginia University, 2001. / Title from document title page. Document formatted into pages; contains xxxviii, 330 p. : ill. Includes abstract. Includes bibliographical references (p. 327-330).

The thesis introduces a new quantitative safety modelling approach for large scale socio-technical systems that exhibit Low Probability High Consequence (LPHC) accidents. This approach uses Bayesian Belief Networks (BBN) and overcomes inherent difficulties of current methods, difficulties that make these methods incapable of coping with complexities of socio-technical systems.

The use of computer-based systems is rapidly increasing and such systems can now be found in a wide range of applications, including safety-critical applications such as cars and aircrafts. To make the development of such systems more efficient, there is a need for tools for automatic safety analysis, such as analysis of fault tolerance. In this thesis, a tool for automatic formal analysis of fault tolerance was developed. The tool is built on top of the existing development environment for the synchronous language Esterel, and provides an output that can be visualised in the Item toolkit for fault tree analysis (FTA). The development of the tool demonstrates how fault tolerance analysis based on formal verification can be automated. The generated output from the fault tolerance analysis can be represented as a fault tree that is familiar to engineers from the traditional FTA analysis. The work also demonstrates that interesting attributes of the relationship between a critical fault combination and the input signals can be generated automatically. Two case studies were used to test and demonstrate the functionality of the developed tool. A fault tolerance analysis was performed on a hydraulic leakage detection system, which is a real industrial system, but also on a synthetic system, which was modeled for this purpose.

There are still many challenges in the field of VANETs that encouraged researchers to conduct further investigation in this field to meet these challenges. The issue pertaining to routing protocols such as delivering the warning messages to the vehicles facing Non-Line of Sight (NLOS) situations without causing the storm problem and channel contention, is regarded as a serious dilemma which is required to be tackled in VANET, especially in congested environments. This requires the designing of an efficient mechanism of routing protocol that can broadcast the warning messages from the emergency vehicles to the vehicles under NLOS, reducing the overhead and increasing the packet delivery ratio with a reduced time delay and channel utilisation. The main aim of this work is to develop the novel routing protocol for a high-density environment in VANET through utilisation of its high mobility features, aid of the sensors such as Global Positioning System (GPS) and Navigation System (NS). In this work, the cooperative approach has been used to develop the routing protocol called the Co-operative Volunteer Protocol (CVP), which uses volunteer vehicles to disseminate the warning message from the source to the target vehicle under NLOS issue; this also increases the packet delivery ratio, detection of NLOS and resolution of NLOS by delivering the warning message successfully to the vehicle under NLOS, thereby causing a direct impact on the reduction of collisions between vehicles in normal mode and emergency mode on the road near intersections or on highways. The cooperative approach adopted for warning message dissemination reduced the rebroadcast rate of messages, thereby decreasing significantly the storm issue and the channel contention. A novel architecture has been developed by utilising the concept of a Context-Aware System (CAS), which clarifies the OBU components and their interaction with each other in order to collect data and take the decisions based on the sensed circumstances. The proposed architecture has been divided into three main phases: sensing, processing and acting. The results obtained from the validation of the proposed CVP protocol using the simulator EstiNet under specific conditions and parameters showed that performance of the proposed protocol is better than that of the GRANT protocol with regard to several metrics such as packet delivery ratio, neighbourhood awareness, channel utilisation, overhead and latency. It is also successfully shown that the proposed CVP could detect the NLOS situation and solves it effectively and efficiently for both the intersection scenario in urban areas and the highway scenario.

The diploma thesis deals with security risk assessment at the VUT object on Purkyňova Street. The aim is to detect security vulnerabilities and to propose measures that could reduce security risks.

<p>Extra-terrestrial habitats will be embedded in challenging environments and involve complex and tightly coupled combinations of hardware, software, and humans. Such systems will be exposed to many risks, both known and unknown, and anticipating all failures and environmental impacts will not be possible. In addition, complexity and tight coupling in these systems means space habitats are likely to experience system accidents, which arise not only from the failure of individual components but also from the interactions among components. Therefore, we propose a control-theoretic approach to resilient space habitat design, which is grounded in system safety engineering and goes beyond event and component-centric failure models underlying conventional risk-based design. We model the system from a state-based perspective where the habitat is in one of four distinct types of states at a given time: nominal, hazardous, safe, or accident. The habitat transitions from a nominal state to a hazardous state via disruptions, and further to safe and accident states via triggers. We use safety controls to prevent the system from entering or remaining in a hazardous or accident state, or to transition the system into a temporary safe state or back to a nominal state. We develop a safety control option space, from which designers choose the best control strategy to meet resilience, performance, cost, and other system goals. We show the development of a control effectiveness metric, which is defined to assess how well safety controls address the hazardous state or disruption for which they are designed. The control effectiveness metric is one dimension of the overall hazard mitigation evaluation, which should also include aspects like cost and launch mass. We validate this approach by assessing individual safety controls in the Modular-Coupled Virtual Testbed (MCVT). This physics-based habitat simulation models complex disruption scenarios which include unique combinations of hazardous states and safety controls. The MCVT allows for the activation of individual (and sets of) safety controls of varying control effectiveness values to evaluate habitat resilience under different control architectures. Using this simulation, we evaluate the control effectiveness metric to determine whether the definition is appropriate to select safety controls that lead to desired habitat resilience. Completing the validation of this metric is the first step towards the validation of the overall control-theoretic approach to resilient space habitat design. </p>