SCSC.uk logo
SCSC.uk logo
Log inRegister
2
SCSC Publications
SCSC Publications
Log inRegister
2

Log in to SCSC.uk

Please log in using either your email address or your membership number.

New user?
Register on SCSC.uk
Forgot password?
Request a reset

Register on SCSC.uk

Please register with your name, email address, password and email preferences. You will be sent an email to verify the address.

   No thanks
   No thanks

Reset your password

Please enter the email address used for your account. A temporary password will be emailed to you.

The SCSC publishes a range of documents:

Newsletter

The club publishes its newsletter Safety Systems three times a year in February, June and October.  The newsletter is distributed to paid-up members and can be made available in electronic form for inclusion on corporate members' intranet sites.

Symposium proceedings

The proceedings of the annual symposium, held each February since 1993, are published in book form. Since 2013 copies can be purchased from Amazon.

Safety-Critical Systems eJournal

The club publishes the Safety-critical Systems eJournal (ISSN 2754-1118) containing high-quality, peer-reviewed articles on the subject of systems safety.
 If you are interested in being an author or a reviewer please see the Call for Papers.

All publications are available to download free by current SCSC members (please log in first), recent books are available as 'print on demand' from Amazon at reasonable cost.

All PublicationsPage

Feb 2021
The Safety-Critical Systems Club Newsletter, Volume 29, Number 1
Oct 2020
The Safety-Critical Systems Club Newsletter, Volume 28, Number 3
May 2020
The Safety-Critical Systems Club Newsletter, Volume 28, Number 2
Feb 2020
Proceedings of the Twenty-eighth Safety-Critical Systems Symposium, York, UK.
Feb 2020
The Safety-Critical Systems Club Newsletter, Volume 28, Number 1
Feb 2020
by the SCSC Data Safety Initiative Working Group [DSIWG]
This resource is superseded by: [SCSC-127H]
Feb 2020
This resource is superseded by: [SCSC-156C]
Oct 2019
The Safety-Critical Systems Club Newsletter, Volume 27, Number 2
Feb 2019
Proceedings of the Twenty-seventh Safety-Critical Systems Symposium, Bristol, UK.
Feb 2019
by the SCSC Data Safety Initiative Working Group [DSIWG]
This resource is superseded by: [SCSC-127H]
Jan 2019
The Safety-Critical Systems Club Newsletter, Volume 27, Number 1
Feb 2018
[SCSC-140] Evolution of System Safety
 Proceeding cover image
Proceedings of the Twenty-sixth Safety-Critical Systems Symposium, York, UK.
Edited by Mike Parsons and Tim Kelly
Ref: ISBN-13: 978-1979733618
Available: Printed book, download book or individual papers.
Evolution of System Safety contains papers presented at the twenty-sixth annual Safety-critical Systems Symposium, held in York, UK, in February  …    Evolution of System Safety contains papers presented at the twenty-sixth annual Safety-critical Systems Symposium, held in York, UK, in February 2018. The Symposium is for engineers, managers and academics in the  field of system safety, across all industry sectors, so the papers making up this volume offer wide coverage of current safety topics, and a blend of academic research and industrial experience. They include both recent developments in the  field and discussion of open issues and questions. The topics covered in this volume include: Autonomy, AI and Machine Learning, Safety Services, Improving Practice, Human Factors and Safety Culture, Risk Analysis and Assessment, Security Informed Safety, Data Safety and Agile Development. This book will be of interest to practitioners, managers and academics working in the safety-critical and safety-related systems areas.  
Download:

Contents

Paper: Safe Self-Driving Cars: Challenges and Some Solutions - Jonas Nilsson
Proceedings of the Twenty-sixth Safety-Critical Systems Symposium, Bristol, UK.
Self-driving cars have the potential to make traffic safer, smoother and more fuel-efficient. Driver error is a contributing factor in the majority  …    Self-driving cars have the potential to make traffic safer, smoother and more fuel-efficient. Driver error is a contributing factor in the majority of traffic accidents and automation means removing these errors from the traffic system. However, automation also means that other sources of errors, such as design errors, technical faults and insufficiency in understanding the environment are added to the system. Efficient strategies to handle these dependability challenges are key for market introduction of self-driving cars.  
Paper: The State of Solutions for Autonomous Systems Safety - Rob Alexander, Rob Ashmore, Andrew Banks
Proceedings of the Twenty-sixth Safety-Critical Systems Symposium, Bristol, UK.
Autonomous Systems are seeing increasing use and increasingly safety-significant application. Consequently, the safety of autonomous systems is an  …    Autonomous Systems are seeing increasing use and increasingly safety-significant application. Consequently, the safety of autonomous systems is an important topic. To reflect this importance the Safety Critical Systems Club (SCSC) has established the Safety of Autonomous Systems Working Group (SASWG). This paper introduces the SASWG and describes (and justifies) the approach it is taking. A running example is used to illustrate challenges, which are organised against three “difficulty horizons”. Potential solutions to some of the challenges are outlined; possible research directions are suggested for other challenges. Some proposed but invalid solutions are also identified. Overall, whilst the SASWG acknowledges the very significant benefits that could accrue from autonomous systems, it believes their development and implementation should be pursued carefully and thoughtfully.   
Paper: Ethics and the safety of autonomous systems - Catherine Menon, Rob Alexander
Proceedings of the Twenty-sixth Safety-Critical Systems Symposium, Bristol, UK.
The ethical landscape surrounding the introduction of autonomous vehicles is complex, and there are real concerns over whether the operational  …    The ethical landscape surrounding the introduction of autonomous vehicles is complex, and there are real concerns over whether the operational safety of these systems can be adequately demonstrated. In this paper we focus on the ethical factors relevant to the design and safety justification of autonomous systems, considering issues such as risk transfer, ALARP considerations, capability vs risk trade-offs and emergent behaviours. We look beyond the “trolley problem” to consider how design decisions can reflect a wider ethical framework. We also look at the wider landscape around the emergence of autonomous systems, with a particular focus on the driving social factors which encourage early adoption of new technologies in this domain. We present some arguments for encouraging an explicit discussion of social and ethical factors within the safety framework for autonomous systems.  
Paper: Safety of Artificial Intelligence and its role in Autonomy: A Maritime Perspective - John McDermid, Kevin Daffey
Proceedings of the Twenty-sixth Safety-Critical Systems Symposium, Bristol, UK.
Artificial Intelligence (AI) is a key technology in autonomous systems. AI has undoubted benefits, and the capabilities of many systems are very  …    Artificial Intelligence (AI) is a key technology in autonomous systems. AI has undoubted benefits, and the capabilities of many systems are very impressive, but AI poses challenges to classical safety processes and principles. This paper surveys the challenges in assessing the safety of AI, and considers historical and more recent work on AI safety assessment. Many of the issues are generic, i.e. do not depend on the application domain, but some aspects such as compliance with standards are domain specific. The paper is generic, so far as is possible, but reflects the requirements and standards of the maritime sector, where it is helpful or necessary to do so. Overall the aim of the paper is both to outline the state of the art in assessing the safety of AI, and to indicate important research directions.   
Paper: Machine Learning Safety: An Overview - José M. Faria
Proceedings of the Twenty-sixth Safety-Critical Systems Symposium, Bristol, UK.
Machine learning (ML) algorithms allow computers to learn without being explicitly programmed. Their utilization is spreading to highly  …    Machine learning (ML) algorithms allow computers to learn without being explicitly programmed. Their utilization is spreading to highly sophisticated tasks across multiple domains, like medical diagnostics or fully autonomous vehicles. Whereas this presents a great potential, it also raises new safety concerns as ML has many specificities that make its behaviour prediction and assessment much different from explicitly programmed software systems. A good number of relevant questions are open topics of research. This paper surveys the published work in the area, covering both supervised and reinforcement learning. It presents an overview of the characteristics of ML that (safety) engineers should understand, the challenges posed by them in a safety relevant context, and potential approaches for addressing such challenges. To ML practitioners less familiar with safety concerns, the paper offers a wide-ranging introduction to the subject.  
Paper: Safety-Critical Software and Safety-Critical Artificial Intelligence: Integrating New Practices and New Safety Concerns for AI systems - Mark Douthwaite, Tim Kelly
Proceedings of the Twenty-sixth Safety-Critical Systems Symposium, Bristol, UK.
Bayesian Networks (BNs) are commonly used in a range of Artificial Intelligence-based (AI) systems. Example applications include aspects of  …    Bayesian Networks (BNs) are commonly used in a range of Artificial Intelligence-based (AI) systems. Example applications include aspects of navigation systems aboard autonomous vehicles and advanced disease and fault diagnosis systems. The nature of BNs introduces assurance concerns beyond those typical of conventional software systems. For example, BNs are often designed and built using large amounts of operational data in combination with subjective expert knowledge. A BN is an abstract probabilistic graphical model that represents a target domain or problem. The structure and parameterisation of this data-driven model influences the behaviour of a software system utilising it. A number of assurance considerations arise from the interactions between these data- and model-focussed system aspects. This paper introduces a set of system viewpoints that integrate the concerns and practices of AI practitioners with those of conventional software assurance practices. This approach captures concerns that are broadly applicable to other AI technologies and highlights several inadequacies in existing approaches to software assurance.  
Paper: Will we ever learn to love AI? - John A Clark
Proceedings of the Twenty-sixth Safety-Critical Systems Symposium, Bristol, UK.
Artificial Intelligence currently has an exceptionally high profile and is at the heart of much envisaged economic, societal and industrial  …    Artificial Intelligence currently has an exceptionally high profile and is at the heart of much envisaged economic, societal and industrial progress. There is a general feeling that AI’s time has come. However, for AI to reach its full potential here needs to be confidence that it will behave safely and securely. Safety, in particular is necessarily a conservative domain, and the way many AI techniques work leaves a persistent feeling that current assurance approaches simply aren’t up to the job. Furthermore, the rise of malicious cyber-attacks mean that there are new vectors by which safety problems can occur. Particularly nasty is the notion of a trapdoor in an AI component that has been trained maliciously to operate well under almost all circumstances, but which malfunctions when presented with a maliciously crafted situation. In this talk I will consider the prospects for AI and in particular for prospects of assured AI. I will also consider how AI may be used to advance how assurance in AI can be gained. I will mix absolute fact with personal judgement and in some cases speculation.  
This paper is not available in the symposium proceedings.
Paper: Service-Based Safety Assurance - Craig Harris, Mike Parsons, Alan Simpson
Proceedings of the Twenty-sixth Safety-Critical Systems Symposium, Bristol, UK.
A new approach to safety assurance is proposed when using a service-based approach. Many safety systems today are used in a service context, i.e.  …    A new approach to safety assurance is proposed when using a service-based approach. Many safety systems today are used in a service context, i.e. used as part of an operational scenario involving collaborative working of the systems, people, processes (and contracts and subcontractors). It is only when the whole picture is considered that the overall safety position can be made. Such safety-related services can be of many forms, for instance Air Navigation, Fleet Maintenance or e-Prescribing and can be found in diverse domains, such as Transport, Defence, Energy or Healthcare. The new approach and methodology is based on service concepts where the Service Catalogue, Contract, Service Level Agreements (SLA) and Capability of the Service Provider(s) become the cornerstones of the assurance position; contrary to traditional systems assurance there is less need to "open the box" to examine the technology components and their construction. Of note is that many safety-related Information Technology systems have moved to an IT service provision model where established safety standards and guidelines don't readily apply; something new is needed. This paper describes the current progress in developing methods for assuring these key elements and how an assurance argument may be constructed for the Customer-Facing Services and the whole Service-Orientated Architecture (SOA). The ongoing work of the SCSC Service Assurance Working Group is a key input for this work.  
Paper: The Fumble Programmer - Roderick Chapman
Proceedings of the Twenty-sixth Safety-Critical Systems Symposium, Bristol, UK.
This paper reflects on the need for formality, discipline and humility in programming. Starting with the work of Turing, Dijkstra and Humphrey,  …    This paper reflects on the need for formality, discipline and humility in programming. Starting with the work of Turing, Dijkstra and Humphrey, this paper goes on to cover our experience with the Personal Software Process, formal programming with SPARK, and the impact of putting the two together.  
Paper: MISRA C under the Spotlight - Frank van den Beuken
Proceedings of the Twenty-sixth Safety-Critical Systems Symposium, Bristol, UK.
MISRA, the Motor Industry Software Reliability Association, is a well-established worldwide consortium known for the quality and the rigorousness  …    MISRA, the Motor Industry Software Reliability Association, is a well-established worldwide consortium known for the quality and the rigorousness of their coding standards. In April 2016, the MISRA committee presented a collection of four new documents that specify the evolution of the process of compliancy and highlights the suitability of the C coding standard as effective security and safety-oriented guidelines. Where is MISRA C heading? We interpret the new content as intent to broaden the scope until now limited to safety-critical systems and as a need to provide a more rigorously defined process of deviation and justification; both allowing a better control of code quality and reliability. We will discuss changes, improvements, implications, and residual challenges that an organization - not necessarily one developing safety-related software - will have to make when they decide to adopt MISRA C:2012.  
Paper: Regulatory perspective on the review and content of a behaviour-based safety case - Stephen Barker and Andrew Eaton
Proceedings of the Twenty-sixth Safety-Critical Systems Symposium, Bristol, UK.
This paper describes the consequences of work undertaken to identify and document how a Regulator should systematically review a change  …    This paper describes the consequences of work undertaken to identify and document how a Regulator should systematically review a change safety case. The work found that there were key elements necessary in a change safety case to demonstrate that the predicted behaviour of a changed system will meet the necessary safety criteria. The paper describes some of the challenges associated with establishing a systematic risk-based review process, the key elements that were found to be necessary and their relationships. The paper also discusses how the review process may be enhanced to ensure that the change safety case addresses cyber security. The guidance itself is due to be published in 2018.  
Paper: Error Management combining people and systems - Rebecca Canham, Michael Wright & Ludmila Musalova
Proceedings of the Twenty-sixth Safety-Critical Systems Symposium, Bristol, UK.
A significant amount of attention has focused on enhancing understanding of Human Error, both as a potential cause of incidents and for  …    A significant amount of attention has focused on enhancing understanding of Human Error, both as a potential cause of incidents and for managing incident response effectively. Solutions often comprise of ergonomics, user centred design and workforce training. Some industries, including Aviation and Healthcare are adopting a more novel approach to Human Error Management, training their workforce in psychological techniques that support error identification and effective incident response. Such techniques include a heightened awareness of cognitive biases such as ‘groupthink’ and ‘tunnel vision’; the way in which heuristics (mental shortcuts) can influence the decision-making process; and refinement of non-technical skills. Organisations, such as the NHS, recognise the frequency of error occurrence, whether the result of organisational factors, or individual behaviour. Subsequently, all individuals, directly or indirectly involved in frontline operations, are encouraged to identify the potential for human error by critically reviewing the thoughts and actions of themselves, peers and superiors, to enable error prevention and error correction through taught techniques. This paper looks at examples of Error Management Training being applied across high hazard industries and how psychological techniques and non-technical skills overlap to effectively manage Human Error.  
Paper: A method for quantitative measurement of safety culture based on ISO 26262 - Arash Khabbaz Saberi, Frank Benders, Richard Koch, Johan J. Lukkien, Mark van den Brand
Proceedings of the Twenty-sixth Safety-Critical Systems Symposium, Bristol, UK.
Safety culture is the collective attitude of members of an organization regarding safety issues: awareness, communication, knowledge, etc. In the  …    Safety culture is the collective attitude of members of an organization regarding safety issues: awareness, communication, knowledge, etc. In the automotive industry, specifically in its Research and Development (R&D) environments, safety culture is relatively new. Recent incidents related to functional safety issues in automotive software and hardware, call for the improvement of safety culture in R&D environments. In ISO 26262 safety culture is identified as a requirement for safety management. Improving on safety culture is essential for using this standard as a way of working. In this article, a method for measuring the safety culture in accordance with ISO 26262 is introduced. We quantified safety culture based on participants’ response to a questionnaire. This quantification is done by measuring several contributing factors such as management commitment, awareness, flow of information, knowledge and skills. For each contributing factor, some survey items are designed and verified by external experts’ reviews. The final questions are chosen from the survey items based on experts’ feedback. Finally, the survey is performed at the Department of Integrated Vehicle Safety (IVS) of TNO, an R&D environment. An indication of current status of safety culture was obtained; furthermore, the survey provided new insights into improvement points for the IVS Department.  
Paper: The Increasing Risks of Risk Assessment: On the Rise of Artificial Intelligence and Non-Determinism in Safety-Critical Systems - C.W. Johnson
Proceedings of the Twenty-sixth Safety-Critical Systems Symposium, Bristol, UK.
Risk assessment plays a key role in Safety Management Systems. For more than forty years, likelihood and consequence have been used to guide  …    Risk assessment plays a key role in Safety Management Systems. For more than forty years, likelihood and consequence have been used to guide the allocation of finite resources. Standards, such as IEC61508 and the DO-178 series, extended these concepts to support the development of software related systems. Human reliability analysis developed risk assessment techniques to represent and reason about operator ‘error’ and management failure. However, new challenges raise questions about the utility of traditional approaches to the development of safety-critical systems. The introduction of artificial intelligence within autonomous systems makes it hard to reason about the probability and consequences of adverse events when control applications must use previous training sets to guide their response to novel situations. This paper struggles to retain the foundations of risk assessment as a tool for safety engineering in the face of these new challenges for the development of safety-critical applications.  
Paper: Hazard and Risk Analysis of Health Informatics: Fundamental Challenges and New Directions - Ibrahim Habli, Sean White
Proceedings of the Twenty-sixth Safety-Critical Systems Symposium, Bristol, UK.
There is an increasing focus on the importance of the availability and interchange of digital health information within health and care  …    There is an increasing focus on the importance of the availability and interchange of digital health information within health and care organisations as a means of improving patient care quality and outcomes. In England, this has recently been emphasised through the Government’s vision for a ‘paperless’ National Health Service (NHS) by 2020. The scope of the technology supporting health informatics is expanding and is used to improve the integration between primary, secondary, community and social care settings. To promote patient-centred care, mobile apps, wearable devices and social media are used to actively involve patients in their own health and well-being management. Despite potential benefits, the new information-intensive capabilities pose a fundamental safety challenge: how should engineers and health and care professionals identify hazards and assess the risks posed by the technology in this large-scale, complex and dynamic socio-technical system? In this paper, we deconstruct this challenge and identify concrete safety problems, and opportunities for improvement, by examining current practice in hazard and risk analysis for health informatics. We then introduce the Safety Modelling, Assurance and Reporting Toolset (SMART), which has been developed collaboratively between The University of York and NHS Digital to help address these challenges and support clinicians and engineers to systematically assure the safety of health informatics.  
Paper: Cyber security enhancements for an ARINC 653 safety-critical avionics platform - Arlen Baker, Paul Parkinson
Proceedings of the Twenty-sixth Safety-Critical Systems Symposium, Bristol, UK.
Safety-critical software standards and processes for avionics software have facilitated the development and deployment of safety-critical software  …    Safety-critical software standards and processes for avionics software have facilitated the development and deployment of safety-critical software in avionics systems on many civil and military aircraft. Historically, these avionics systems have often been isolated from external security threats through physical isolation or air-gap security. The evolution of airborne networking, and increased network connectivity through satellite broadband to aircraft and the advent of the Internet of Things (IoT) means that avionics systems now need to be developed with both safety and security in mind. In this paper, we discuss the role of avionics security standards RTCA DO-326, DO-355 and DO-356 and their impact on the development of safety-critical avionics systems, and their on-going assurance post deployment. In addition, we present a case study in relation to the security enhancement of an ARINC 653-compliant avionics software platform to address specific Confidentiality, Integrity and Availability requirements, and the implementation approach undertaken using Secure Boot, AES encryption, Digital Signature Verification and other techniques.  
Paper: Securing a wireless command and control system for the UK national rail network - Andrew Hawthorn, Richard Myers
Proceedings of the Twenty-sixth Safety-Critical Systems Symposium, Bristol, UK.
For the past two years, Altran – in collaboration with Network Rail - have been developing COMPASS (DMWS), a system which provides an  …    For the past two years, Altran – in collaboration with Network Rail - have been developing COMPASS (DMWS), a system which provides an electronic degraded-mode working solution that includes trackside, trainborne and central control and communication systems that communicate using wireless technologies. The COMPASS (DMWS) project team is carrying out security analysis against ISO/IEC 62443-3-3:2013 and Network Rail’s Security Assurance Framework to secure this system for use on the UK national rail network. This paper introduces the system and the security analysis process, and walks through the issues that influence the security architecture.  
Paper: Data in Police and Criminal Justice Systems: How data errors could lead to harm to innocent citizens - Bill Blackburn, Paul Hampton, Mike Parsons
Proceedings of the Twenty-sixth Safety-Critical Systems Symposium, Bristol, UK.
This work looks at the ways in which data held in law enforcement systems can be incorrect; what the implications are for personal safety and  …    This work looks at the ways in which data held in law enforcement systems can be incorrect; what the implications are for personal safety and security; what mitigations are already extant and what can be done to make the situation better. As larger, more interconnected systems and big data are increasingly being adopted in the criminal justice and law enforcement sectors, data in systems now cover a multitude of types of uses. Many forms of data in this sector are now held electronically and could have serious implications if incorrect: everything from wrong offence codes, misspelt names and premature ageing of records could have serious impacts on both safety and security of the population at large. Several types of common data error in this sector will be considered including: Reuse, Ageing, Biasing, Dissociation, Masking, Overload, Mis-application, Mis-match and Falsification. This latter case is significant in this sector, with both unintentional and malicious causes explored.  
Paper: A Systems Engineering Approach to Data Risk - Louise Harney
Proceedings of the Twenty-sixth Safety-Critical Systems Symposium, Bristol, UK.
For several years, the SCSC Data Safety Initiative Working Group (DSIWG) has been meeting to develop methods for ensuring data safety issues, as  …    For several years, the SCSC Data Safety Initiative Working Group (DSIWG) has been meeting to develop methods for ensuring data safety issues, as distinct from hardware and software issues, are assessed and mitigated throughout the system engineering lifecycle. Current systems engineering approaches consider the functionality and quality attributes associated with the system (including data flow modelling), but not the properties specific to the data being used, stored and manipulated by that system. We need to delve into the detail of data within systems, as our increasing reliance on data threatens the safety and security of our designs. This paper attempts to show how the DSIWG Data Safety Guidance can be implemented with methods for managing data risks, enabling us to design and build more robust systems.  
Paper: Agile development of safety-related industrial automation solutions - Wolfgang Reinelt and Ajay Mishra
Proceedings of the Twenty-sixth Safety-Critical Systems Symposium, Bristol, UK.
Agile methods such as Scrum or XP have recently reached the development of safety1 related products after they have been successfully applied  …    Agile methods such as Scrum or XP have recently reached the development of safety1 related products after they have been successfully applied to software for some time. This paper briefly reviews Agile concepts and then discusses them in context of the safety lifecycle. Questions addressed are the type of developments that could be covered (electronics, firmware, software) as well as the added value for the organization in terms of release time, improved quality and safety through test automation, better communication and understanding of requirements and finally improved customer intimacy.  
Paper: The Agile FMEA Approach - Thor Myklebust, Are Hellandsvik, Geir Kjetil Hanssen Jan-Arne Eriksen
Proceedings of the Twenty-sixth Safety-Critical Systems Symposium, Bristol, UK.
During the last few years, there has been increased use of agile methods when developing safety-critical systems. This is done to shorten time to  …    During the last few years, there has been increased use of agile methods when developing safety-critical systems. This is done to shorten time to market and to reduce costs. Having an agile approach has become even more important due to the new functional safety requirements that are part of automatic and autonomous transports like trains, cars and ships. As a result, manufacturers of sensors and detectors, have to comply with safety standards such as the generic IEC 61508 standard, ISO 26262 for road vehicles or the strengthened requirements for Failure Mode and Effect Analysis (FMEA) in draft prEN 50126:2016 for railways. While FMEA traditionally has mainly been a hardware approach, new processes and the increasing use of software diagnostics makes the possibility of an agile approach. The FMEA is a multidisciplinary approach that should start early in the lifecycle and be updated during the whole life of a safety related system. Experience has shown that the FMEA has to be updated before some of the Gate reviews. In addition, we have empirical information about usage of different FMEA approaches at a safety company that has developed SIL 2 products for the last 15 years.  
Poster: The Safety Assurance of Intelligent and Self-Adaptive Systems - John Bragg and Ibrahim Habli
Proceedings of the Twenty-sixth Safety-Critical Systems Symposium, Bristol, UK.
Systems are becoming ever more complex, with software offering capabilities otherwise unachievable in hardware alone. This is particularly  …    Systems are becoming ever more complex, with software offering capabilities otherwise unachievable in hardware alone. This is particularly evident in systems that are now mimicking human-like behaviour, where decisions are made and behaviour is adapted in response to dynamism in aspects such as the environment, connectivity, and configuration. Machine Learning and Deep Learning technologies are facilitating such behaviour by processing large amounts of data in order to ‘reason’ about how a system should adapt itself during operation. This presents a challenge from a safety perspective; no longer will systems be ‘deterministic’, as the focus shifts from “preventing bad things from happening” to one of “adapting and dealing with the bad thing that has just happened”. This is the move from a Safety-I to a Safety-II approach, and one which is at the heart of dynamic systems. In this research we look at the different types of, what we refer to as, “Intelligent and Self-Adaptive Systems”; identifying the attributes of each, and how they relate to each other. We also consider the issues associated with these systems and how they might be argued to be ‘safe’ throughout their operational life, as well as postulating on where the future lies with such systems.  
Poster: Increasing dependability in CPSs using Reflective Statecharts based SW Components - Miren Illarramendi Rezabal
Proceedings of the Twenty-sixth Safety-Critical Systems Symposium, Bristol, UK.

Dependability is crucial in Safety Critical Cyber-Physical Systems (CPS). In spite of the research carried out in recent years, implementation  …   

Dependability is crucial in Safety Critical Cyber-Physical Systems (CPS). In spite of the research carried out in recent years, implementation of such systems remains costly, complex and time-consuming. Traditionally, three main techniques are used for system verification: theorem-proving, model checking, and testing. Runtime verification (RV) is a more lightweight method aimed at verifying that a specific execution of a system satisfies or violates a given critical property. RV techniques complement traditional methods by checking that the system satisfies a proven formal model’s assumptions and abstractions at runtime. Runtime verification can improve dependability by detecting faults early, preventing errors and failures. Monitoring the internal status of the software besides outputs can anticipate fault detection.

In this research work, we present a model-driven approach for designing statecharts with observation information. The approach is based on the CRESCO (C++ REflective StateCharts based Observable SW components developer) framework that provides the reflection capability to C++ statecharts. The solution separates the logic of the software from the observation at runtime that enables to monitor the internal status of the software. It uses reflection to make the model available at runtime. Thus, the SW components can be monitored at runtime in terms of model elements. The framework helps the developer separate monitoring from functionality.

M2T transformations generate automatically C++ code with instrumentation to monitor the internal status of the software at runtime. Observation profile has been defined and designers can define the observation level of each controller state at design phase adding observability stereotypes. As this observability capability affects the timing response of the system, adding high observability levels to the critical states and not observing the non-critical states could be the right strategy.

The framework and the Fault Detection mechanism were implemented in C++ due to two main reasons: this programming language, together with the statechart formalism constitute widely used choices for the Safety Critical CPS domain and we need a platform where real-time constraints can be granted. Industry 4.0 domain has been selected as demonstrator scenario and a controller that controls a Burner has been developed.

  
Poster: Complex Adaptive Technologies: Ensuring Safe Behaviours - Alastair Faulkner and Mark Nicholson
Proceedings of the Twenty-sixth Safety-Critical Systems Symposium, Bristol, UK.

In an era where systems are soon to be adaptive (learning and decision- making) within much more open environments, multi-dimensional  …   

In an era where systems are soon to be adaptive (learning and decision- making) within much more open environments, multi-dimensional threats arise through unseen communications between systems and (active) components. Physical implementations mask the aggregation of interrelated and interdependent functions and services. They are complex, complicated, time-dependent, stateful and, at least in part safety-related. In parallel, through their evolving implementation, they change their operational context.

One clear example are autonomous systems that require elements to join and leave the operational domain. The overall system becomes dynamic. Logical representations reveal ragged boundaries open to a wide range of vulnerabilities and (cyber) threats. As a result, a supporting ecosystem that has both internal and external elements is required.

The confidence we have in the safety characteristics of a system is falling, and uncertainty is rising. Current models of a system and system safety need to be adapted. Decision models need to be extended to address confidence and uncertainty to ensure and assure safe behaviours. Decision support is likely to encompass machine perception to address hazards arising from changes in the physical world and system context. Further, the next generation of CBTs will be able to parse, understand and make decisions on responsive actions to take based on the content of records and independently of humans. The influence of CBTs moves yet further up the baseline model hierarchy.

Realisation and management of confidence and uncertainty drive distinct strategies, based on the relative position of the system elements within the Reference Model. Macro strategies encompass the overall system and its context. Individual elements (a CBT) and their neighbours use Micro-strategies. Therefore, different levels of confidence and uncertainty will exist across a system comprising many instances of identical system elements. Each autonomous Vehicle in a transport system will calculate uncertainty within its local area, yet uncertainty will have regional variation based on environmental conditions and road incidents.

This poster introduces a model of systems and the characteristics associated with them. It identifies where current practices are deficient and discusses issues associated with ensuring the safety of complex adaptive technologies based on a data-centric view of the world.

  
Poster: Certification Route for Pre-existing Complex Software Elements - Nicholas McGuire, Andreas Platschek
Proceedings of the Twenty-sixth Safety-Critical Systems Symposium, Bristol, UK.

The use of Free/Libre Open Source Software has significantly increased in industrial applications over the past decade. Much of this success  …   

The use of Free/Libre Open Source Software has significantly increased in industrial applications over the past decade. Much of this success can be attributed to flagship projects like GCC and GNU/Linux. This success was driven not only by the versatility and breadth of deployment but also to a significant extent by the security capabilities of the GNU project and specifically Linux. One aspect that was neglected by the FLOSS community though is the issue of safety certification of these software elements. The safety community on the other hand, considered it in a different context.

Traditional safety related system software is built on the traceable reliability of the development process along with the competency of the developers. This changes with pre-existing complex software elements, as such software element never would be compliant to the requirements set forth in key functional safety standards such as IEC 61508.

IEC 61508 authors were aware of the changing requirements and technological advances. They responded with a dedicated compliance route providing guidance on "assessment of non-compliant development": some process must be in place if the result is a suitable candidate for a system. If this process can be assessed, gaps identified and mitigated, then it may reach the same integrity as bespoke software development.

This poster outlines our interpretation and derived mapping of the process for assessment of non-compliant development along with the process overview. The goal is to allow the re-use of complex software elements like the GNU/Linux kernel and GNU glibc. While there are some weak points, the big picture of one possible solution how assessment of pre-existing software for mid-integrity levels could be tackled has emerged over the course of a related OSADL project that was dubbed SIL2LinuxMP.

This work was conducted in the context of OSADLs SIL2LinuxMP project striving to develop a GNU/Linux qualification route suitable for up to SC2/SIL2.

  
Poster: Model-Connected Safety Cases - Athanasios Retouniotis
Proceedings of the Twenty-sixth Safety-Critical Systems Symposium, Bristol, UK.

Electronic and computer-based systems have an integral role in our daily life. It is essential to provide confidence that such systems and  …   

Electronic and computer-based systems have an integral role in our daily life. It is essential to provide confidence that such systems and particularly those in safety-critical industries will operate acceptably safe. Safety cases have gained ground as the appropriate means to communicate the argument of safety throughout a system’s lifecycle. However, the increasing complexity and integration of modern systems render manual approaches impractical.

We propose the concept of a model-connected safety case that could simplify certification of complex systems. System design models support the synthesis of both the structure of the safety case and the appropriate evidence that supports it. The resultant safety case argues that all hazards are adequately addressed through meeting the system safety requirements. This overarching claim is demonstrated via satisfaction of the integrity requirements that are assigned to subsystems and components of the system through a sound process of modelbased allocation that respects the system design and follows industry standards. The safety evidence that substantiates claims is also supported by auto-constructed evidence. System changes are automatically reassessed and reflected on the safety case. The approach is underpinned by a data model that connects safety argumentation and safety analysis artefacts, and is supported by a software tool.

  
Jan 2018
Version 2 of the Goal Structuring Notation (GSN) Standard.
This resource is superseded by: [SCSC-141C]