During cooperation with the Bender Robotics company a need for operational safety assessment of an autonomous mobile robot (AMR) emerged. Operational safety evaluation is a step towards mass production of the studied robot. Market entry of a product requires a string of various actions and safety assessment is one of them. For risk identification and severity rating were used legal requirements, best practice given by standards, FMEA method, experiment and RIPRAN method. Threats, possible scenarios and risks analysis is systematically discussed through all areas of operation of the robot, from design and construction to control software. All the steps are described in logical order. Starting with information research, going on with series of analysis and ending with suggestions for increased operational safety of autonomous mobile robots.

Highly Automated Vehicles (AVs) have the capability to revolutionize the transportation system. These systems have the possibility to make roads safer as AVs do not have limitations that human drivers do, many of which are common causes of vehicle crashes (e.g., distraction or fatigue) often defined generically as human error. The deployment of AVs is likely to be very gradual however, and there will exist situations in which the AV will be driving in close proximity with human drivers across the foreseeable future. Given the persistent crash problem in which the makority of crashes are attributed to driver error, humans will continue to create potential collision scenarios that an AV will be expected to try and avoid or mitigate if developed appropriately. The absence of unreasonable risk in an AVs ability to comprehend and react in these situations is referred to as operational safety. Unlike advanced driver assistance systems (ADAS), highly automated vehicles are required to perform the entirety of the dynamic driving task (DDT) and have a greater responsibility to achieve a high level of operational safety. To address this concern, scenario-based testing has increasingly become a popular option for evaluating AV performance. On a functional level, an AV typically consists of three basic systems: the perception system, the decision and path planning system, and vehicle motion control system. A minimum level of performance is needed in each of these functional blocks to achieve an adequate level of operational safety. The goal of this study was to investigate the effects that perception system performance (i.e., target object state errors) has on vehicle operational safety in collision scenarios similar to that created by human drivers. In the first part of this study, recent annual crash data was used to define a relevant crash population of possible scenarios involving intersections that an AV operating as an urban taxi may encounter. Common crash maneuvers and characteristics were combined to create a set of testing scenarios that represent a high iii percentage of the overall crash population. In the second part of this study, each test scenario was executed using an AV test platform during closed road testing to determine possible real-world perception system performance. This provided a measure of the error in object detection measurements compared to the ideal (i.e., where a vehicle was detected to be compared to where it actually was). In the third part of this study, a set of vehicle simulations were performed to assess the effect of perception system performance on crash outcomes. This analysis simulated hypothetical crashes between an AV and one other collision partner. First an initial worst-case impact configuration was defined and was based on injury outcomes seen in crash data. The AV was then simulated to perform a variety of evasive maneuvers based on an adaptation of a non-impaired driver model. The impact location and orientation of the collision partner was simulated as two states: one based on the object detection of an ideal perception system and the other based on the object detection of the perception system from the AV platform used during the road testing. For simulations in which the two vehicles contacted each other, a planar momentum-impulse model was used for impact modeling and injury outcomes were predicted using an omni-directional injury model taken from recent literature. Results from this study indicate that errors in perception system measurements can change the perceived occupant injury risk within a crash. Sensitivity was found to be dependent on the specific crash type as well as what evasive maneuver is taken. Sensitivities occurred mainly due to changes in the principal direction of force for the crash and the interaction within the injury risk prediction curves. In order to achieve full operational safety, it will likely be important to understand the influence that each functional system (perception, decision, and control) may have on AV performance in these crash scenarios. / Master of Science / Highly Automated Vehicles (AVs) have the capability to revolutionize the transportation system. These systems have the possibility to make roads safer as AVs do not have many of the limitations that human drivers do, many of which are common causes of vehicle crashes (e.g., distraction or fatigue). AVs will be expected to drive alongside human drivers, and so these drivers are likely to continue to be at fault in causing crashes. As part of ensuring safety, AVs will reasonably be expected to try and avoid or help reduce the severity of these crashes. AVs operate using three main systems: the perception system which consists of sensors that see the objects around the AV, the decision and path planning system, which makes decision on what the AV will do, and the vehicle motion control system. Due to the nature of the real-world, these systems may not work exactly as intended which may affect the ability of the AV to react to possible crash scenarios. Because of this, the goal of this study was to investigate the effects that perception system performance (i.e., target object state errors) has on the ability of an AV to react to crash scenarios similar to those created by human drivers. This study first defined crash scenarios using real-world crash data. A real-world perception system was then tested in these scenarios to determine object detection performance. Based on this performance, effects on safety were assessed through vehicle crash simulations. Results from this analysis showed that safety can vary based on both perception system performance and crash scenario. This highlights that it will be important to address system performance in order to achieve high levels of driving safety.

Pedreiras que sofreram uma extração precária ou sem planejamento no passado, apresentam, atualmente, áreas de riscos operacionais ligadas, sobretudo, à geotecnia dos taludes. Desmontes esculturais são aplicados na indústria mineral visando a melhorias nas questões ambientais e geotécnicas. O objetivo deste trabalho foi aplicar técnicas de desmontes esculturais para solucionar problemas na segurança operacional, os quais são relacionados diretamente com a instabilidade das bancadas. Além disso, identificar a relação da qualidade do maciço rochoso no resultado do desmonte e a viabilidade desse projeto nas questões técnicas e econômicas. Os desmontes experimentais foram aplicados em uma mina de calcário da Região Metropolitana da cidade de São Paulo, modificando a geometria do plano de fogo e o carregamento dos furos. O desempenho dos experimentos foi medido a partir de indicadores de performance, os quais serão relacionados com um mapa de distribuição do RQD da parede da bancada, construído a partir de um mapeamento geomecânico. A viabilidade do projeto foi dimensionada a partir de parâmetros operacionais, de segurança e econômico. As análises mostraram que as regiões que apresentaram o maior valor de RDQ tiveram o melhor resultado no desmonte, comprovando, assim, a influência da qualidade do maciço na qualidade do desmonte. Apesar de o desmonte escultural aumentar o custo anual do empreendimento, os impactos positivos gerados na segurança e na operação são significativos: redução no volume de matacos e na geração de blocos soltos na parede da bancada, menor tempo de carregamento dos caminhões e queda do efeito backbreak. Os resultados dos experimentos também mostram que a aplicação do desmonte escultural pode ser uma solução aos problemas nas áreas de riscos do empreendimento. Com isso, há um aumento na vida útil da cava e o incremento no custo torna-se um investimento no negócio, tornando o projeto viável. / Precarious material extraction or unplanned exploitation of quarries in the past resulted today in many operational problems of entire zones of those sites, mainly because of slopes instability. Contour blasting is applied in mining industry to respond to environmental and geotechnical-related issues. The objective of this work is thus to apply contour blasting techniques to solve problems related to operational safety, which are directly related to slopes instability. The strong impact of rock mass quality on the results of blasting as well as on technical and economic sustainability of the project is also stressed out in this study. Blasting experiments were performed in a calcareous mine in the metropolitan region of São Paulo (Brazil). Parameters such as blasting pattern and hole loading have been modified. The efficiency of those tests was then measured with key performance indicators and compared to the distribution of RQD values at the surface of the slope, which was mapped thanks to a preliminary geomechanical study. The assessment of project sustainability was based on operational, safety and economic parameters. The analysis of the results showed that regions with a higher RQD presented a better blasting efficiency, which proved the importance of the rock mass quality on the blasting quality. In spite of representing a higher annual cost than regular blasting techniques, contour blasting has a significant positive impact on safety and operations: reduction in volume of over rock blocks, decreasing number of loose blocks at the surface of the slope, decreasing duration of truck loading and less backbreak effect. The experimental results thus showed that the application of contour blasting can be a solution in risk-exposed areas of a quarry as it enables to increase the operating life of the site, which turns the higher cost of contour blasting into a durable investment and improves the sustainability of the project.

Pedreiras que sofreram uma extração precária ou sem planejamento no passado, apresentam, atualmente, áreas de riscos operacionais ligadas, sobretudo, à geotecnia dos taludes. Desmontes esculturais são aplicados na indústria mineral visando a melhorias nas questões ambientais e geotécnicas. O objetivo deste trabalho foi aplicar técnicas de desmontes esculturais para solucionar problemas na segurança operacional, os quais são relacionados diretamente com a instabilidade das bancadas. Além disso, identificar a relação da qualidade do maciço rochoso no resultado do desmonte e a viabilidade desse projeto nas questões técnicas e econômicas. Os desmontes experimentais foram aplicados em uma mina de calcário da Região Metropolitana da cidade de São Paulo, modificando a geometria do plano de fogo e o carregamento dos furos. O desempenho dos experimentos foi medido a partir de indicadores de performance, os quais serão relacionados com um mapa de distribuição do RQD da parede da bancada, construído a partir de um mapeamento geomecânico. A viabilidade do projeto foi dimensionada a partir de parâmetros operacionais, de segurança e econômico. As análises mostraram que as regiões que apresentaram o maior valor de RDQ tiveram o melhor resultado no desmonte, comprovando, assim, a influência da qualidade do maciço na qualidade do desmonte. Apesar de o desmonte escultural aumentar o custo anual do empreendimento, os impactos positivos gerados na segurança e na operação são significativos: redução no volume de matacos e na geração de blocos soltos na parede da bancada, menor tempo de carregamento dos caminhões e queda do efeito backbreak. Os resultados dos experimentos também mostram que a aplicação do desmonte escultural pode ser uma solução aos problemas nas áreas de riscos do empreendimento. Com isso, há um aumento na vida útil da cava e o incremento no custo torna-se um investimento no negócio, tornando o projeto viável. / Precarious material extraction or unplanned exploitation of quarries in the past resulted today in many operational problems of entire zones of those sites, mainly because of slopes instability. Contour blasting is applied in mining industry to respond to environmental and geotechnical-related issues. The objective of this work is thus to apply contour blasting techniques to solve problems related to operational safety, which are directly related to slopes instability. The strong impact of rock mass quality on the results of blasting as well as on technical and economic sustainability of the project is also stressed out in this study. Blasting experiments were performed in a calcareous mine in the metropolitan region of São Paulo (Brazil). Parameters such as blasting pattern and hole loading have been modified. The efficiency of those tests was then measured with key performance indicators and compared to the distribution of RQD values at the surface of the slope, which was mapped thanks to a preliminary geomechanical study. The assessment of project sustainability was based on operational, safety and economic parameters. The analysis of the results showed that regions with a higher RQD presented a better blasting efficiency, which proved the importance of the rock mass quality on the blasting quality. In spite of representing a higher annual cost than regular blasting techniques, contour blasting has a significant positive impact on safety and operations: reduction in volume of over rock blocks, decreasing number of loose blocks at the surface of the slope, decreasing duration of truck loading and less backbreak effect. The experimental results thus showed that the application of contour blasting can be a solution in risk-exposed areas of a quarry as it enables to increase the operating life of the site, which turns the higher cost of contour blasting into a durable investment and improves the sustainability of the project.

The development of Automated Driving Systems (ADS) has been ongoing for decades in varying levels of sophistication. Levels of automation are defined by Society of American Engineers (SAE) as 0 through 5, with 0 being full human control and 5 being full automation control. Another way to describe levels of automation is through concepts of Functional Safety (FuSa) and Operational Safety (OpSa). These terms of FuSa and OpSa are important, because ADS testing relies on both. Current recommendations for ADS testing include both OpSa and FuSa requirements. However, an examination of ADS safety requirements (e.g., industry reports, post-crash analysis reports, etc.) reveals that ADS safety arguments, in practice, depend almost completely on well-trained human operators, referred to in the industry as in vehicle fallback test drivers (IFTD). To date, the industry has never fielded a truly SAE L4 ADS on public roads due to this persistent hurdle of needing a human operator for Operational Safety. There is a tendency in ADS testing to reference International Standards Organization (ISOs) for validated vehicles for vehicles that are still in development (i.e., unvalidated). To be clear, ISOs for ADS end products are not necessarily applicable to ADS in development. With this in mind, there is a clear gap in the industry for unvalidated ADS literature. Because of this gap, ADS testing for unvalidated vehicles often relies on safety requirements for validated vehicles. This issue remains a significant challenge for ADS testing. Recognizing this gap in on-road, in-development vehicle safety, there is a need for the ADS industry to develop a clear strategy for transitioning from an IFTD (Operational Safety) to an ADS (Functional Safety). Therefore, the purpose of this thesis is to present a framework for transitioning from Operational Safety to Functional Safety. The framework makes this possible through an inductive analysis of available definitions of onroad safety to arrive at a definition that leverages Functional and Operational Safety along a continuum. Ultimately, the framework aims to contribute to onroad safety testing for the ADS industry. / Master of Science / The development of Self-Driving Cars has been ongoing for decades in varying levels of sophistication. Levels of automation are defined by Society of American Engineers (SAE) as 0 through 5, with 0 being full human control and 5 being full automation control. Another way to describe levels of automation is through concepts of Robotic Control and Human Control. If a vehicle relies completely on Human Control, a human operator is responsible for all on-road safety. On the other hand, a fully autonomous would be considered fully in Robotic Control. These terms of Robotic Control and Human Control are important, because Self-Driving Car testing relies on both. Current recommendations for Self-Driving Car testing include both Robotic Control and Human Control requirements. However, an examination of Self-Driving Cars documentation (e.g., industry reports, post-crash analysis reports, etc.) reveals that Self-Driving Car safety arguments, in practice, depend almost completely on well-trained human operators. To date, the industry has never fielded a truly SAE L4 Self-Driving Car on public roads due to this persistent hurdle of needing a human operator for Human Control. There is a tendency in Self-Driving Car testing to reference standars for validated vehicles for vehicles that are still in development (i.e., unvalidated). To be clear, standards for Self-Driving Car end products are not necessarily applicable to Self-Driving Cars in development. With this in mind, there is a clear gap in the industry for unvalidated Self-Driving Car literature. Because of this gap, Self-Driving Car testing for unvalidated vehicles often relies on documentation for validated vehicles. This issue remains a significant challenge for Self-Driving Car testing. Recognizing this gap in on-road, in-development vehicle safety, there is a need for the Self-Driving industry to develop a clear strategy for transitioning from Human Control to Robot Control. Therefore, the purpose of this thesis is to present a framework for transitioning from Human to Robot Control. The framework makes this possible through an inductive analysis of available definitions of onroad safety to arrive at a definition that leverages all definitions of Safety along a continuum. Ultimately, the framework aims to contribute to onroad safety testing for the Self-Driving industry.

La RATP est l'exploitant et le gestionnaire du réseau de transport métropolitain de la ville de Paris et de sa banlieue proche. Actuellement, avec près de 10 millions de voyageurs par jour, il est l'un des réseaux les plus chargés au monde. Dans ce contexte de fortes exigences d'exploitation, les gestionnaires de la RATP doivent assurer la sécurité, la capacité de service et la pérennité d'un patrimoine d'infrastructures hétérogène et ancien. Mais les ressources disponibles sont, par nature, limitées et, dans ces circonstances, deux tâches deviennent essentielles : justifier les budgets nécessaires et optimiser les programmations de travaux de maintenance. Le système de maintenance actuel est fondé sur des inspections visuelles permettant de relever les désordres affectant l'état structurel des ouvrages. Ensuite, les gestionnaires doivent choisir et prioriser les ouvrages à entretenir en fonction de ces résultats et des différentes contraintes qui interviennent dans la gestion du patrimoine. Ce processus décisionnel est fondé sur l'expertise des gestionnaires et n'est pas formalisé. Ainsi, l'objectif de cette thèse consiste à développer un outil d'aide à la gestion patrimoniale qui réduise la variabilité intrinsèque des actions de surveillance visuelle et le manque de transparence dans les décisions. Pour fournir aux gestionnaires de la RATP un tel outil, cette recherche s'appuie sur les étapes suivantes :- La modélisation fonctionnelle des mécanismes de dégradation des ouvrages bâtie à partir des outils de la Sûreté de Fonctionnement. L'Analyse Fonctionnelle (AF), l'Analyse des Modes de Défaillance et de leurs Effets(AMDE) et des graphes causaux sont appliqués pour connaître comment les infrastructures fonctionnent, se dégradent et interagissent avec leur environnement.- La construction d'un outil d'aide à la gestion fondé sur les méthodes multicritère d'aide à la décision. Dans un premier temps, nous construisons une famille cohérente de critères qui formalise les différents aspects techniques et socioéconomiques qui interviennent dans le processus décisionnel de la RATP (méthode d'agrégation à base de règles). Ensuite, à partir des méthodes ELECTRE, nous développons un outil multicritère d'aide à la décision permettant d'optimiser la gestion du patrimoine de la RATP. Après une application sur la ligne 4 du métro de Paris, les perspectives ouvertes par un tel outil sont étudiées, dont la principale est le développement opérationnel de cet outil dans le cadre de la gestion du patrimoine d'infrastructures de la RATP / The RATP is the operator and asset manager of the public railway transport of Paris and the next suburbs. Nowadays, with more than 10 million trips per day, this transport network is one of the most crowded in the world. In this context of high service requirements, the RATP asset managers must assure the structural integrity, the quality of service and the sustainability of an aging and heterogeneous asset. However, available budgets are, by nature, limited and, in this context, two tasks become essential: to justify budget requirements and to optimize the programming of maintenance actions. The current asset strategy is based on visual inspections to detect degradation symptoms that concern the structural integrity of the structure. Depending on these results, managers must select and prioritize the maintenance actions taking into account the constraints involved in asset management. This decision-making process is based on the expert knowledge and is not formalized. In this context, the purpose of this thesis is to develop a multicritera decision support tool which reduces the inherent variability degree of visual inspections and the lack of transparency in the decision-making process. In order to provide RATP's managers a decision support tool, this research is based on the next stages :- The development of a functional model of degradation mechanisms by the application of the operational safety methods. The Functional Analyse (FA), the Failure Mode and Effect Analysis (FMEA) and the casual graphs are applied to know how infrastructures function, degrade and interact with the environment.- The construction of a decision support tool based on multicriteria methods. The first stage is the construction of a lot of criteria formalizing the technical, economic and social aspects involved in the RATP's asset management (rule based assignment model). The second stage is the application of ELECTRE methods to develop a multicriteria decision support tool which optimizes the management of the RATP's asset. This tool is tested on the line 4 of the Paris metro in order to study development prospects. The main prospect is the operational development of this tool in the context of the management of the RATP's asset

Die vorliegende Diplomarbeit enthält eine Analyse von Untersuchungsberichten der deutschen Eisenbahnunfalluntersuchung sowie den darin betrachteten Unfallereignissen. Als Grundlage der Überlegungen wird dargestellt, welche Kriterien bei der Einstufung von gefährlichen Ereignissen zur Anwendung kommen. Anhand der festgestellten Unfallursachen erfolgen eine Kategorisierung von Ursachen und eine Zuordnung aller untersuchten Ereignisse gemäß den erarbeiteten Definitionen. Die Analyse befasst sich neben einer quantitativen und qualitativen Auswertung der Ursachenkategorien mit vielen weiteren berichts- sowie ereignisbezogenen Aspekten von Eisenbahnunfällen. Dabei werden auch mögliche Ansätze zur Verbesserung der Betriebssicherheit genannt. Anhand eines Beispiels werden abschließend die Zuständigkeiten in der Umsetzung von Sicherheitsempfehlungen erarbeitet. / This thesis analyses reports on accidents by the German railway accident investigation body as well as the investigated accidents themselves. Criteria for the assessment of railway incidents are presented. Corresponding to the identified causes, a categorisation of the accidents is made and all investigated events are classified according to definitions developed in advance. In addition to evaluating categories of accident causes both by quantity and by quality, this thesis addresses additional reporting-related and event-related aspects of railway accidents. Possible approaches to improving railway safety are proposed. Finally, following a case model, different jurisdictions for implementing safety recommendations are elaborated on.

Die vorliegende Studienarbeit befasst sich mit Berichten und Statistiken zu Daten der Eisenbahnsicherheit sowie Untersuchungsberichten von Eisenbahnunfällen. In diesem Zusammenhang werden sowohl deutsche Behörden und Institutionen als auch EU-weite Entwicklungen beschrieben. Es folgt eine Erläuterung und Abgrenzung zweier möglicher Kategorisierungen von gefährlichen Ereignissen im Bahnbetrieb. Daten ermittelter Quellen werden im Anschluss statistisch analysiert und Unterschiede dieser herausgearbeitet. Weiterhin wird die Durchführung einer ereignisbezogenen Unfalluntersuchung beschrieben sowie auf veröffentlichte Untersuchungsberichte eingegangen. Nach Bewertung der Berichte werden abschließend Vorschläge zur Verbesserung von Unfallanalysen und Berichten der Eisenbahnsicherheit unterbreitet. / This paper deals with reports and statistics on railway safety data and with investigation reports on railway accidents. Relevant German authorities and institutions as well as EU-wide developments are described. This is followed by an explanation of and dissociation between two possible categorisations of dangerous events in railway operations. Data from selected sources are then analysed statistically and differences within these are ascertained. Furthermore, the implementation of individual accident investigations is described and published investigation reports are outlined. After evaluating these reports, improvements for accident analyses and railway safety reports are suggested.

System identification is used in engineering sciences to build mathematical models from data. A common issue in system identification problems is that the true inputs to the system are not fully known. In this thesis, existing approaches to unknown input problems are classified and some of their properties are analyzed.  A new indirect framework is proposed to treat system identification problems with unknown inputs. The effects of the unknown inputs are assumed to be measured through possibly unknown dynamics. Furthermore, the measurements may also be dependent on other known or measured inputs and can in these cases be called indirect input measurements. Typically, these indirect input measurements can arise when a subsystem of a larger system is of interest and only a limited set of sensors is available. Two examples are when it is desired to estimate parts of a mechanical system or parts of a dynamic network without full knowledge of the signals in the system. The input measurements can be used to eliminate the unknown inputs from a mathematical model of the system through algebraic manipulations. The resulting indirect model structure only depends on known and measured signals and can be used to estimate the desired dynamics or properties. The effects of using the input measurements are analyzed in terms of identifiability, consistency and variance properties. It is shown that cancelation of shared dynamics can occur and that the resulting estimation problem is similar to errors-in-variables and closed-loop estimation problems because of the noisy inputs used in the model. In fact, the indirect framework unifies a number of already existing system identification problems that are contained as special cases. For completeness, an instrumental variable method is proposed as one possibility for estimating the indirect model. It is shown that multiple datasets can be used to overcome certain identifiability issues and two approaches, the multi-stage and the joint identification approach, are suggested to utilize multiple datasets for estimation of models. Furthermore, the benefits of using the indirect model in filtering and for control synthesis are briefly discussed.  To show the applicability, the framework is applied to the roll dynamics of a ship for tracking of the loading conditions. The roll dynamics is very sensitive to changes in these conditions and a worst-case scenario is that the ship will capsize.  It is assumed that only motion measurements from an inertial measurement unit (IMU) together with measurements of the rudder angle are available. The true inputs are thus not available, but the measurements from the IMU can be used to form an indirect model from a well-established ship model. It is shown that only a subset of the unknown parameters can be estimated simultaneously. Data was collected in experiments with a scale ship model in a basin and the joint identification approach was selected for this application due to the properties of the model. The approach was applied to the collected data and gave promising results. / Till skillnad från många andra industrier där avancerade styrsystem har haft en omfattande utveckling under de senaste decennierna så har styrsystem för skepps- och marinindustrin inte alls utvecklats i samma utsträckning. Det är framförallt under de senaste 10 åren som lagkrav och stigande driftskostnader har ökat intresset för effektivitet och säkerhet genom användning av styrsystem. Rederier och den marina industrin är nu intresserade av hur de avancerade styrsystem som används inom andra områden kan tillämpas för marina ändamål. Huvudmålet är typiskt att minska den totala energianvändningen, och därmed också bränsleförbrukningen, genom att hela tiden planera om hur skeppet skall användas med hjälp av ny information samt styra skeppet och dess ingående system på ett sätt som maximerar effektiviteten. För många av dessa avancerade styrsystem är det grundläggande att ha en god förståelse för beteendet hos det systemet som skall styras. Ofta används matematiska modeller av systemet för detta ändamål. Sådana modeller kan skapas genom att observera hur systemet reagerar på yttre påverkan och använda dessa observationer för att finna eller skatta den modell som bäst beskriver observationerna. Observationerna är mätningar som görs med så kallade sensorer och tekniken att skapa modeller från mätningarna kallas för systemidentifiering. Detta är i grunden ett utmanande problem och det kan försvåras ytterligare om de sensorer som behövs inte finns tillgängliga eller är för dyra att installera. I denna avhandling föreslås en ny teknik där de mätningar som finns tillgängliga används på ett nytt och annorlunda sätt. Detta kan minska mängden nödvändiga sensorer eller möjliggöra användandet av alternativa sensorer i modell-framtagningen. Med hjälp av denna nya teknik kan enkla sensorer användas för att skatta en matematisk modell för en del av skeppet på ett sätt som inte är möjligt med traditionella metoder. Genom att skatta denna modell kan fysikaliska egenskaper hos skeppet, så som dess massa och hur massan är fördelad över skeppet, övervakas för att upptäcka förändringar. Just dessa två egenskaper har stor inverkan på hur skeppet beter sig och om skeppet är fellastat kan det i värsta fall kapsejsa. Vetskapen om dessa fysikaliska egenskaper kan alltså utöver effektivisering användas för att varna besättningen eller påverka styrsystemen så att farliga manövrar undviks. För att visa att tekniken fungerar i verkligheten har den använts på mätningar som har samlats in från ett skalenligt modellskepp. Experimenten utfördes i bassäng och resultaten visar att tekniken fungerar. Denna nya teknik är inte specifik för marint bruk utan kan också vara användbar i andra typer av tillämpningar. Även i dessa tillämpningar möjliggörs användandet av färre eller alternativa sensorer för att skatta modeller. Tekniken kan vara speciellt användbar när en modell av ett system eller process som verkar i ett nätverk av många system är av intresse, något som också diskuteras i avhandlingen.

Acidentes graves em organizações com infraestruturas críticas, como a Usina Hidrelétrica Itaipu Binacional, embora raros, causam importantes impactos sociais e econômicos em sua área de influência. Portanto, eles devem ser evitados mesmo que, seja esperada uma taxa “normal” de acidentes por conta dos fatores de risco e complexidade da sua operação. Essa dissertação apresenta uma investigação das condições que levam a acidentes em casos específicos da operação da Itaipu Binacional sob o enfoque proativo da gestão da Segurança II de acordo com a Engenharia de Resiliência (ER). Ela se baseia na variabilidade da operação normal e, portanto, “no muito que dá certo”, em contraponto à visão tradicional da Segurança I, reativa, baseada na análise retrospectiva de acidentes e “no pouco que dá errado”. Com base em uma revisão da literatura quanto os requisitos, princípios e temas da ER e da Segurança-II e nas opiniões estruturadas de operadores foram desenvolvidos dois estudos: o primeiro traçou preocupações destes operadores em relação ao risco de incêndio em um transformador da Itaipu Binacional para desenvolver indicadores e planos de ação aderentes aos princípios da ER. O objetivo foi suplementar, com elementos de ER, uma análise de risco convencional baseada em árvore de falhas e árvore de eventos, e otimizar o plano de ação de emergência em caso de incêndio em transformador da unidade geradora Os resultados mostraram a oportunidade de melhoria para o desenvolvimento de indicadores proativos para a análise de risco. O segundo estudou, com base no método FRAM, a operação normal e a variabilidade de quatro manobras operacionais típicas selecionadas pelos operadores dentro dos quadrantes da matriz periodicidade-complexidade. Os resultados indicaram que as mesmas variabilidades influenciam nos passos operacionais, não importando a complexidade tampouco a periodicidade da manobra. Um comparativo entre a análise das variabilidades em situação normal e os relatórios das quatro falhas ocorridas entre 2006 e 2015 apontou que o sucesso e a falha advêm da mesma fonte, e que algumas variabilidades como “ambiente de manobra”, a “necessidade de confirmar os passos das manobras” e situações que tiram a atenção do operador atuam de forma decisiva em praticamente todas as manobras. Os resultados foram discutidos com os integrantes da equipe que propuseram adaptações necessárias para aumento da segurança operacional do trabalho normal sob a perspectiva de ER. / Serious accidents in organizations with critical infrastructures, such as the Itaipu Binacional Hydroelectric Power Plant, although rare, cause important social and economic impacts in their area of influence. Therefore, they must be avoided even if a "normal" rate of accidents is expected because of the risk factors and complexity of the operation. This dissertation presents an investigation on the conditions that lead to accidents in the operation of Itaipu Binacional under the proactive approach of Security II management according to Resilience Engineering (RE). It is based on the variability of the normal operation and, therefore, "in the many things that goes right", in contrast to the traditional and reactive view of Safety-I, based on the retrospective analysis of accidents and "the few things that went wrong". After a review of the literature on the requirements, principles and themes of RE and Security-II and on the structured opinions of the operational staff, two studies were developed: the first one brings the concerns of these operators in regard of the risk of fire in a transformer in order to develop indicators and action plans adherent to the RE principles. The objective was to supplement a conventional risk analysis based on fault tree and event trees with RE elements, optimizing the emergency action plan. The results showed the opportunity for improvement of proactive indicators for risk analysis The second one, inspired by the FRAM method, deals with the normal operation and variability of four typical operational maneuvers selected by operators within four quadrants of a periodicity-complexity matrix. The results indicated that the same variabilities influence the operational steps, regardless of the complexity or the periodicity of the maneuver. A comparison between the analysis of the variabilities in normal situation and the reports of the four operational failures occurred between 2006 and 2015 indicated that success and failure come from the same source, and that some variabilities such as “maneuver environment”, “necessity to confirm the maneuver steps” and “situations that take the attention of the operator” act decisively in virtually all maneuvers. The results were discussed with the team members who proposed the necessary adaptations to increase the operational safety of normal work from the RE perspective.