Including Safety during Early Development Phases of Future ATM Concepts

Transcription

1 Including Safety during Early Development Phases of Future ATM Concepts Cody H. Fleming & Nancy G. Leveson 23 June th USA/EUROPE ATM R&D Seminar

2 Motivation Cost, Effectiveness 1 80% of Safety Decisions [Frola and Miller, 1984] Ability to impact cost and performance Cost of design changes 2 Concept Requirements Design Build Operate H Preliminary Hazard Analysis System & Sub-system Hazard Analysis Accident Analysis Fleming 15 1

3 General Challenges limited design information no specification informal documentation concept of operations ConOps Concept Requirements Design Build Operate H??? Preliminary Hazard Analysis System & Sub-system Hazard Analysis Accident Analysis Fleming 15 2

4 Goals 1. use rigorous, systematic tools for identifying hazardous scenarios and undocumented assumptions 2. supplement existing (early) SE activities such as requirements definition, architectural and design studies Especially when tradespace includes: human operation, automation or decision support tools, and the coordination of decision making agents Fleming 15 3

5 Table of Contents 1. Theory 2. STECA 3. Application-TBO 4. Early Eng Fleming 15

6 Table of Contents 1. Theory 2. STECA 3. Application-TBO 4. Early Eng Fleming 15

7 Current State of the Art Concept Requirements Design Build Operate H Preliminary Hazard Analysis System & Sub-system Hazard Analysis Accident Analysis Fleming 15 4

8 Current State of the Art PROGRAM: ENGINEER: ITEM Assigned number HAZARD COND List the nature of the condition Preliminary Hazard Analysis DATE: PAGE: Describe what is causing the stated condition to exist If allowed to go uncorrected, what will be the effect or effects of the hazardous condition Hazard Level assignment MENTS Probability, possibility of occurrence: -Likelihood -Exposure -Magnitude CAUSE EFFECTS RAC ASSESS- RECOMM- ENDATIONS Recommended actions to eliminate or control the hazard [Vincoli, 2005] Fleming 15 4

9 Limitations of PHA PHA tends to identify the following hazard causes: Causes Equipment Failure Causes Design error, coding error, insufficient software testing, software operating system problem Causes Human error [JPDO, 2012] This is true: ALL accidents are caused by hardware failure, software flaws, or human error But is the information coming from PHA useful for systems engineering? Fleming 15 5

10 Safety ) Control Problem Systems-Theoretic Accident Model and Process (STAMP) Accidents are more than a chain of events, they involve complex dynamic processes STAMP Treat accidents as a control problem, not a failure problem Prevent accidents by enforcing constraints on component behavior and interactions Fleming 15 6

11 Systems Theory Fleming 15 7

12 Emergence Organized complexity as a hierarchy of levels, each more complex than the one below, a level being characterized by emergent properties which do not exist at the lower level [Checkland, 1999] [Business Korea, 2014] Fleming 15 7

13 Hierarchy Input Input Intervention Level n Subsystem Level n 1 Subsystem Feedback Output Output Intervention Feedback Input Level 1 Subsystem Output [Mesarovic, 1970] Fleming 15 8

14 Process Control Four conditions are required for process control: 1. Goal condition: the controller must have a goal or goals 2. Action condition: the controller must be able to affect the state of the system, typically by means of an actuator or actuators 3. Model condition: the controller must contain a model of the system 4. Observability condition: the controller must be able to ascertain the state of the system, typically by feedback from a sensor [Ashby, 1957] Fleming 15 9

15 Table of Contents 1. Theory 2. STECA 3. Application-TBO 4. Early Eng Fleming 15

16 Approach Systems-theoretic Early Concept Analysis STECA Fleming 15 10

17 Concept Approach Unspecified assumptions Model Generation Model-based Analysis Missing, inconsistent, incomplete information Vulnerabilties, risks, tradeoffs System, software, human requirements Architectural and design analysis Fleming 15 10

18 Control Elements ConOps Unspecified assumptions Model Generation Model-based Analysis Missing, inconsistent, incomplete information Vulnerabilties, risks, tradeoffs System, software, human requirements Architectural and design analysis Fleming 15 11

19 Control Elements Control input or external information wrong or missing Inappropriate, ineffective or missing control action Actuator Inadequate Operation Inadequate Control Algorithm Controller (Flaws in creation, Process changes, Incorrect modification or adaptation) Process Model inconsistent, incomplete, or incorrect Sensor Inadequate Operation Inadequate or missing feedback Feedback delays Delayed operation Controller 2 Conflicting control actions Process input missing or wrong Controlled Process Component failures Changes over time Unidentified or out-of-range disturbance Incorrect or no information provided Measurement inaccuracies Feedback delays Process output contributes to hazard [Leveson, 2012] Fleming 15 11

20 Control Elements 9. Control input (setpoint) or other commands 11. External input 7. Control Action 1. Controller 6. Control Algorithm 8. Feedback to higher level controller 5. Process Model 10. Controller output 2. Actuator 4. Sensor Alt. 12. Alternate control actions 13. External process input 3. Controlled Process 14. Process Disturbance 15. Process Output Fleming 15 11

21 Roles in Control Loop What kinds of things can an entity do within a control structure, and more particularly within a control loop? Fleming 15 12

22 Roles in Control Loop What kinds of things can an entity do within a control structure, and more particularly within a control loop? Controller Enforces safety constraints Creates, generates, or modifies control actions based on algorithm or procedure and perceived model of system Processes inputs from sensors to form and update process model Processes inputs from external sources to form and update process model Transmits instructions or status to other controllers Fleming 15 12

23 Roles in Control Loop What kinds of things can an entity do within a control structure, and more particularly within a control loop? Actuator Translates controller-generated action into process-specific instruction, force, heat, etc Fleming 15 13

24 Roles in Control Loop What kinds of things can an entity do within a control structure, and more particularly within a control loop? Controlled Process Interacts with environment via forces, heat transfer, chemical reactions, etc Translates higher level control actions into control actions directed at lower level processes Fleming 15 14

25 Roles in Control Loop What kinds of things can an entity do within a control structure, and more particularly within a control loop? Sensor Transmits continuous dynamic state measurements to controller (i.e. measures the behavior of controlled process via continuous or semi-continuous [digital] data) Transmits binary or discretized state data to controller (i.e. measures behavior of process relative to thresholds; has algorithm built-in but no cntl authority) Sythesizes and integrates measurement data Fleming 15 15

26 Individual Control Loop 9. Control input (setpoint) or other commands 11. External input 7. Control Action 1. Controller 6. Control Algorithm 8. Feedback to higher level controller 5. Process Model 10. Controller output 2. Actuator 4. Sensor Alt. 12. Alternate control actions 13. External process input 3. Controlled Process 14. Process Disturbance 15. Process Output Fleming 15 16

27 Control Structure Input Output Controller n Control Action Feedback Input Output Controller n 1 Control Action Feedback Input Controller 1 Output Fleming 15 17

28 Analysis ConOps Unspecified assumptions Model Generation Model-based Analysis Missing, inconsistent, incomplete information Vulnerabilties, risks, tradeoffs System, software, human requirements Architectural and design analysis Fleming 15 18

29 Analysis Completeness Analyzing Safetyrelated Responsibilities Coordination &Consistency Fleming 15 18

30 Early Systems Engineering ConOps Unspecified assumptions Model Generation Model-based Analysis Missing, inconsistent, incomplete information Vulnerabilties, risks, tradeoffs System, software, human requirements Architectural and design analysis Fleming 15 19

31 Early Systems Engineering Constraints on control loop behavior 11. External input 9. Control input 8. Feedback to higher (setpoint) or other level controller commands 10. Controller output 1. Controller 7. Control Action 6. Control Algorithm 5. Process Model 2. Actuator 4. Sensor Model-Based Analysis Controller Alternate control actions 13. External process input 3. Controlled Process 14. Process disturbance 15. Process output Input Level n Subsystem Output Constraints Feedback Input Level n 1 Subsystem Output Change the control structure Constraints Input Level 1 Subsystem Feedback Output Fleming 15 19

32 Table of Contents 1. Theory 2. STECA 3. Application-TBO 4. Early Eng Fleming 15

33 Application TBO ConOps Unspecified assumptions Model Generation Model-based Analysis Missing, inconsistent, incomplete information Vulnerabilties, risks, tradeoffs System, software, human requirements Architectural and design analysis Fleming 15 20

34 Application TBO Trajectory-Based Operations (TBO) Operational Scenarios Trajectory-Based Operations (TBO) Operational Scenarios for NextGen Prepared by the Joint Planning and Development Office (JPDO) TBO Study Team December 4, 2011 Joint Planning and Development Office 1 Theory STECA Application-TBO Early Eng Fleming 15 20

35 Application TBO [JPDO, 2011] Fleming 15 20

36 Application TBO [JPDO, 2011] Fleming 15 20

37 System-Level Hazards [H-1] Aircraft violate minimum separation (LOS or loss of separation, NMAC or Near midair collision) [H-2] Aircraft enters uncontrolled state [H-3] Aircraft performs controlled maneuver into ground (CFIT, controlled flight into terrain) [SC-1] Aircraft must remain at least TBD nautical miles apart en route* "[H-1] [SC-2] Aircraft position, velocity must remain within airframe manufacturer defined flight envelope "[H-2] [SC-3] Aircraft must maintain positive clearance with all terrain (This constraint does not include runways and taxiways) "[H-3] Fleming 15 21

38 Identify Control Concepts ConOps Unspecified assumptions Model Generation Model-based Analysis Missing, inconsistent, incomplete information Vulnerabilties, risks, tradeoffs System, software, human requirements Architectural and design analysis Fleming 15 22

39 Identify Control Concepts TBO conformance is monitored both in the aircraft and on the ground against the agreed-upon 4DT. In the air, this monitoring (and alerting) includes lateral deviations based on RNP..., longitudinal..., vertical..., and time from the FMS or other time to go aids. [JPDO, 2011] Fleming 15 22

40 Identify Control Concepts TBO conformance is monitored both in the aircraft and on the ground against the agreed-upon 4DT. In the air, this monitoring (and alerting) includes lateral deviations based on RNP..., longitudinal..., vertical..., and time from the FMS or other time to go aids. [JPDO, 2011] Subject Role Behavior Type Context Fleming 15 22

41 Identify Control Concepts TBO conformance is monitored both in the aircraft and on the ground against the agreed-upon 4DT. In the air, this monitoring (and alerting) includes lateral deviations based on RNP..., longitudinal..., vertical..., and time from the FMS or other time to go aids. [JPDO, 2011] Subject Role Behavior Type Context Conformance monitoring, Air automation Sensor Transmits binary or discretized state data to controller (i.e. measures behavior of process relative to thresholds; has algorithm built-in but no cntl authority) Sythesizes and integrates measurement data This is a decision support tool that contains algorithms to synthesize information and provide alerting based on some criteria. Fleming 15 22

42 Identify Control Concepts TBO conformance is monitored both in the aircraft and on the ground against the agreed-upon 4DT. In the air, this monitoring (and alerting) includes lateral deviations based on RNP..., longitudinal..., vertical..., and time from the FMS or other time to go aids. [JPDO, 2011] 1. Controller -PilotingFunction (1.,5.) (4.) (3.) Process Model (x a, y a, h a, t a,...) 4. Sensor - Altimeter, FMS, aircraft conformance monitor Alt. 3. Controlled Process -Aircraft Fleming 15 23

43 Identify Control Concepts TBO conformance is monitored both in the aircraft and on the ground against the agreed-upon 4DT. In the air, this monitoring (and alerting) includes lateral deviations based on RNP..., longitudinal..., vertical..., and time from the FMS or other time to go aids. [JPDO, 2011] 1. Controller Piloting function 2. Actuator 3 Cntl d Process Aircraft 4. Sensor Altimeter, FMS, Aircraft conformance monitor 5. Process Model Intended latitude, longitude, altitude, time; Actual latitude, longitude, altitude, time 6. Cntl Algorithm 7. Control Actions 8. Controller Status 9. Control Input 10. Controller Output 11. External Input 12. Alt Controller 13. Process Input 14. Proc Disturbance 15. Process Output Fleming 15 23

44 Conf Monitoring Control Loops Air AIR (Flight Crew) CAA 4DT PMA Alert parameter (A) Manual FMS Conformance Monitor [Air] CDTI Aircraft ADS-B {x,y,h,t} {x,y,h,t}all GNSS Fleming 15 24

45 Conf Monitoring Control Loops Air Ground 1 AIR (Flight Crew) GROUND (ANSP / ATC) CAG PMG TBO Strategic Evalutation Manual CAA 4DT FMS PMA Alert parameter (A) Conformance Monitor [Air] CDTI Voice Data Link Alert parameter (G) Conformance Monitor [Gnd] TBO Automation Data Link Altitude Report Aircraft ADS-B {x,y,h,t} {x,y,h,t}all Clearancei {4DT}i AIRSPACE {x,y,h,t}i {4DT}i (Intent) {h}i GNSS GNSS 1 Examples of model development for ground component included in backup slides Fleming 15 24

46 Hierarchical Control Structure How to Establish Hierarchy? Higher level of systems:. Decision Making Priority. Decision Complexity, ". Time Scale between decisions, ". Dynamics of controlled system, # A + PROCESS 4 Fleming 15 25

47 Hierarchical Control Structure Function Route Planning* Safety-Related Responsibilities Provide conflict-free clearances & trajectories Merge, sequence, space the flow of aircraft Piloting* Navigate the aircraft Provide aircraft state information to rte planner Avoid conflicts with other aircraft, terrain, weather Ensure that trajectory is within aircraft flight envelope Aircraft Provide lift Provide propulsion (thrust) Orient and maintain control surfaces Environment Fleming 15 26

48 Hierarchical Control Structure Function Route Planning* Route, Trajectory Management Function GROUND (ANSP / ATC) CAG PMG Alert parameter (G) Data Link Conformance Monitor [Gnd] Altitude Report Piloting* Piloting Function AIR (Flight Crew) {4DT} (Intent) CAA PMA Aircraft FMS; Manual Alert parameter (A) Conformance Monitor [Air] CDTI Aircraft ADS-B {x,y,h,t} {x,y,h,t} {h} Environment GNSS Fleming 15 26

49 Hierarchical Control Structure Function Route Planning* Route, Trajectory Management Function GROUND (ANSP / ATC) CAG PMG Alert parameter (G) 4DT; Clearance Data Link Conformance Monitor [Gnd] Altitude Report Piloting* Piloting Function AIR (Flight Crew) {4DT} (Intent) CAA PMA Aircraft FMS; Manual Alert parameter (A) Conformance Monitor [Air] CDTI Aircraft ADS-B {x,y,h,t} {x,y,h,t} {h} Environment GNSS Fleming 15 26

50 ConOps Unspecified assumptions Model Generation Model-based Analysis Missing, inconsistent, incomplete information Vulnerabilties, risks, tradeoffs System, software, human requirements Architectural and design analysis Fleming 15 27

51 Analysis 1. Are the control loops complete? 2. Are the system-level safety responsibilities accounted for? 3. Do control agent responsibilities conflict with safety responsibilities? 4. Do multiple control agents have the same safety responsibility(ies)? 5. Do multiple control agents have or require process model(s) of the same process(es)? 6. Is a control agent responsible for multiple processes? If so, how are the process dynamics (de)coupled? Completeness Analyzing Safetyrelated Responsibilities 2 Coordination & Consistency Fleming 15 27

52 Coordination & Consistency 2 4. Do multiple control agents have the same safety responsibility(ies)? 5. Do multiple control agents have or require process model(s) of the same process(es)? 6. Is a control agent responsible for multiple processes? If so, how are the process dynamics (de)coupled? 2 Example of Analyzing Safety-related Responsibilities included in Backup Slides on page 43 Fleming 15 28

53 Coordination & Consistency 2 Coordination Principle (4) Consistency Principle (5) (8c 2 C i )(8d 2 C j ) 9 (P (c, d) _ P (d, c)) [A (c, V p ) ^ A (d, V p )], (4) (8v 2V, 8c 2 C i, 8d 2 C j A (c, v) ^ A (d, v)) [ i (a, v) j (a, v) ^ G i G j ] (5) Fleming 15 28

54 Coordination & Consistency 2 Route, Trajectory Management Function GROUND (ANSP / ATC) CAG PMG Alert parameter (G) 4DT; Clearance Data Link Conformance Monitor [Gnd] Altitude Report Piloting Function AIR (Flight Crew) {4DT} (Intent) CAA PMA FMS; Manual Alert parameter (A) Conformance Monitor [Air] CDTI Aircraft ADS-B {x,y,h,t} {x,y,h,t} {h} GNSS Fleming 15 29

55 Coordination & Consistency 2 B cm := L cm D cm!i cm, (6) L cm is a model of the airspace state and D cm is the decision criteria regarding conformance. Fleming 15 30

56 Coordination & Consistency 2 L cm := {z int, z act,, T, P r, W, E cm, F D } (7) z int := {G, C, t} int z act := {G, C, t} act := Traffic density := Operation type P r := {RNP, RTP} W := Wake turbulence model E cm := Elliptical conformance model F D := {F, z int } D cm = {z act z act /2 z (z int, E cm, a cm )}, (8) Fleming 15 31

57 Coordination & Consistency 2 Route, Trajectory Management Function GROUND (ANSP / ATC) CAG PMG Alert parameter (G) 4DT; Clearance Data Link Conformance Monitor [Gnd] Altitude Report Piloting Function AIR (Flight Crew) {4DT} (Intent) CAA PMA FMS; Manual Alert parameter (A) Conformance Monitor [Air] CDTI Aircraft ADS-B {x,y,h,t} {x,y,h,t} {h} GNSS Fleming 15 32

58 Coordination & Consistency 2 Route, Trajectory Management Function GROUND (ANSP / ATC) CAG PMG Alert parameter (G) 4DT; Clearance Data Link Conformance Monitor [Gnd] Altitude Report Piloting Function AIR (Flight Crew) {4DT} (Intent) CAA PMA FMS; Manual Alert parameter (A) Conformance Monitor [Air] CDTI Independent alert parameter Aircraft ADS-B {x,y,h,t} {x,y,h,t} {h} GNSS Fleming 15 32

59 Coordination & Consistency 2 Route, Trajectory Management Function GROUND (ANSP / ATC) CAG PMG Alert parameter (G) 4DT; Clearance Data Link Conformance Monitor [Gnd] Altitude Report Piloting Function FMS; Manual AIR (Flight Crew) CAA PMA Alert parameter (A) {4DT} (Intent) Conformance Monitor [Air] CDTI Independent conformance monitors Independent alert parameter Aircraft ADS-B {x,y,h,t} {x,y,h,t} {h} GNSS Fleming 15 32

60 Table of Contents 1. Theory 2. STECA 3. Application-TBO 4. Early Eng Fleming 15

61 Application of Results What does an engineer need to develop the system?? Concept Requirements Design Build Operate H Preliminary Hazard Analysis System & Sub-system Hazard Analysis Accident Analysis Fleming 15 33

62 Architecture Studies ConOps Unspecified assumptions Model Generation Model-based Analysis Missing, inconsistent, incomplete information Vulnerabilties, risks, tradeoffs System, software, human requirements 3 Architectural and design analysis 3 Examples of reqs identification included in backup slides on page 47 Fleming 15 34

63 Architecture Studies Negotiation [JPDO, 2011] Fleming 15 34

64 TBO Negotiation ANSP CAA PMA K A F L A F K A F L A F K A F L A F K A O L A O K A O LA O FOC i K A F LA F FOC j Flight Deck 1 Flight Deck m CAO PMO CAO PMO K A L A F F CAF PMF CAF PMF K A F LA F K O F L O F K O F L O F K A L A F F L O F K O F K A F L A F L O F K O F LO F K O F L O F KO F Aircraft i1 Aircraft i2 Aircraft ik Aircraft j1 Aircraft j2 Aircraft jl Fleming 15 35

65 Modified Structure ANSP CAA PMA K A O K A F L A O L A F K A O L A O K A F L A F FOC i FOC j Flight Deck 1 Flight Deck m CAO PMO CAO PMO CAF PMF CAF PMF K O F L O F K O F L O F K O F L O F K O F L O F K O F L O F K O F L O F Aircraft i1 Aircraft i2 Aircraft ik Aircraft j1 Aircraft j2 Aircraft jl Additional Requirement: KF A and KO F occur simultaneously. shall not Fleming 15 36

66 Modified Structure CAO FOC i PMO ANSP FOC j CAA PMA CAO PMO I O F I O F I O F K A F L A F K A F L A F Flight Deck 1 Flight Deck 2 K A F L A F K A F L A F K A F L A F Flight Deck 3 Flight Deck 4 Flight Deck m CAF PMF CAF PMF CAF PMF CAF PMF CAF PMF Additional Requirement: Thisbecomestheactivecontrol structure within TBD minutes of gate departure. Fleming 15 37

67 Conclusion Systems Engineering Phases Concept Requirements Design Build Operate H STECA Preliminary Hazard Analysis PHA System & Sub-system Hazard Analysis Accident Analysis Safety Activities Fleming 15 38

68 References Ashby, W. R. (1957). An Introduction to Cybernetics. Chapman & Hall Ltd. Business Korea (2014). Auto parts manufacturers concerned over new ordinary wage standards. Checkland, P. (1999). Systems thinking, systems practice: includes a 30-year retrospective. John Wiley & Sons, Inc. Frola, F. and Miller, C. (1984). System safety in aircraft management. Logistics Management Institute, Washington DC. JPDO (2011). JPDO Trajectory-Based Operations (TBO) study team report. Technical report, Joint Planning and Development Office. JPDO (2012). Capability safety assessment of trajectory based operations v1.1. Technical report, Joint Planning and Development Office Capability Safety Assessment Team. Leveson, N. G. (2012). Engineering a Safer World. MIT Press. Mesarovic, M. D. (1970). Multilevel systems and concepts in process control. Proceedings of the IEEE, 58(1): Strafaci, A. (2008). What does BIM mean for civil engineers? CE News, Tranportation. Vincoli, J. W. (2005). Basic Guide to System Safety, Second Edition. John Wiley & Sons, Inc., Hoboken, NJ, USA. References TBO Analysis Early Eng STAMP Fleming 15 39

69 Backup Slides References TBO Analysis Early Eng STAMP Fleming 15 40

70 Table of Contents 5. TBO Analysis 6. Early Eng 7. STAMP References TBO Analysis Early Eng STAMP Fleming 15

71 Ground Independent of the aircraft, the ANSP uses ADS-B position reporting for lateral and longitudinal progress, altitude reporting for vertical, and tools that measure the time progression for the flight track. Data link provides aircraft intent information. Combined, this position and timing information is then compared to a performance requirement for the airspace and the operation....precision needed...will vary based on the density of traffic and the nature of the operation. [JPDO, 2011] References TBO Analysis Early Eng STAMP Fleming 15 41

72 Ground Independent of the aircraft, the ANSP uses ADS-B position reporting for lateral and longitudinal progress, altitude reporting for vertical, and tools that measure the time progression for the flight track. Data link provides aircraft intent information. Combined, this position and timing information is then compared to a performance requirement for the airspace and the operation....precision needed...will vary based on the density of traffic and the nature of the operation. [JPDO, 2011] Subject Role Behavior Type Context References TBO Analysis Early Eng STAMP Fleming 15 41

73 Ground Independent of the aircraft, the ANSP uses ADS-B position reporting for lateral and longitudinal progress, altitude reporting for vertical, and tools that measure the time progression for the flight track. Data link provides aircraft intent information. Combined, this position and timing information is then compared to a performance requirement for the airspace and the operation....precision needed...will vary based on the density of traffic and the nature of the operation. [JPDO, 2011] Subject Role Behavior Type Context Conformance monitoring, Ground automation Sensor Transmits binary or discretized state data to controller (i.e. measures behavior of process relative to thresholds; has algorithm built-in but no cntl authority) Sythesizes and integrates measurement data This is a decision support tool that contains algorithms to synthesize information and provide alerting based on some criteria. References TBO Analysis Early Eng STAMP Fleming 15 41

74 Ground Independent of the aircraft, the ANSP uses ADS-B position reporting for lateral and longitudinal progress, altitude reporting for vertical, and tools that measure the time progression for the flight track. Data link provides aircraft intent information. Combined, this position and timing information is then compared to a performance requirement for the airspace and the operation....precision needed...will vary based on the density of traffic and the nature of the operation. [JPDO, 2011] (3.) Alt. (11.) 11. Datalink Controller - ANSP/Ground 5. Process Model (x a, y a, h a, t a,...,, ) 3. Controlled Process -Piloting Function & Aircraft (1.,5.) (4.) 4. Sensor - ADS-B, Alt Rep, time, grd conformance monitor References TBO Analysis Early Eng STAMP Fleming 15 42

75 Analysis 1. Are the control loops complete? 2. Are the system-level safety responsibilities accounted for? 3. Do control agent responsibilities conflict with safety responsibilities? 4. Do multiple control agents have the same safety responsibility(ies)? 5. Do multiple control agents have or require process model(s) of the same process(es)? 6. Is a control agent responsible for multiple processes? If so, how are the process dynamics (de)coupled? Completeness Analyzing Safetyrelated Responsibilities Coordination & Consistency References TBO Analysis Early Eng STAMP Fleming 15 43

76 Safety-Related Responsibilities 2. Are the system-level safety responsibilities accounted for? 3. Do control agent responsibilities conflict with safety responsibilities? References TBO Analysis Early Eng STAMP Fleming 15 44

77 Safety-Related Responsibilities Gaps in Responsibility (2) Conflicts in Responsibility (3) (8 i 2 ) (9c 2 C )[P (c, i)], (2) (8H i 2H)( 9c 2 C )[P (c, H i ) ^ P (c, G)] (3) References TBO Analysis Early Eng STAMP Fleming 15 44

78 Safety-Related Responsibilities Potential conflict between goal condition, safety responsibilities??? [JPDO, 2011] The pilot must also work to close the trajectory. Pilots will need to update waypoints leading to a closed trajectory in the FMS, and work to follow the timing constraints by flying speed controls. References TBO Analysis Early Eng STAMP Fleming 15 45

79 Safety-Related Responsibilities References TBO Analysis Early Eng STAMP Fleming 15 46

80 Safety-Related Responsibilities References TBO Analysis Early Eng STAMP Fleming 15 46

81 Table of Contents 5. TBO Analysis 6. Early Eng 7. STAMP References TBO Analysis Early Eng STAMP Fleming 15

82 ConOps Approach Unspecified assumptions Model Generation Model-based Analysis Missing, inconsistent, incomplete information Vulnerabilties, risks, tradeoffs System, software, human requirements Architectural and design analysis References TBO Analysis Early Eng STAMP Fleming 15 47

83 Deriving Requirements Scenario 2: ANSP issues command that results in aircraft closing (or maintaining) a 4DT, but that 4DT has a conflict. Causal Factors: This scenario arises because the ANSP has been assigned the responsibility to assure that aircraft conform to 4D trajectories as well as to prevent loss of separation.. A conflict in these responsibilities occurs when any 4D trajectory has a loss of separation (LOS could be with another aircraft that is conforming or is non-conforming). [Goal Condition] References TBO Analysis Early Eng STAMP Fleming 15 48

84 Deriving Requirements Scenario 2: ANSP issues command that results in aircraft closing (or maintaining) a 4DT, but that 4DT has a conflict. Causal Factors: Additional hazards occur when the 4DT encounters inclement weather, exceeds aircraft flight envelope, or aircraft has emergency ANSP and crew have inconsistent perception of conformance due to independent monitor, different alert parameter setting... References TBO Analysis Early Eng STAMP Fleming 15 48

85 Scenario 2: Deriving Requirements ANSP issues command that results in aircraft closing (or maintaining) a 4DT, but that 4DT has a conflict. Requirements: S2.1 Loss of separation takes precedence over conformance in all TBO procedures, algorithms, and human interfaces [Goal Condition]... S2.3 Loss of separation alert should be displayed more prominently when conformance alert and loss of separation alert occur simultaneously. [Observability Condition] This requirement could be implemented in the form of aural, visual, or other format(s). S2.4 Flight crew must inform air traffic controller of intent to deviate from 4DT and provide rationale [Model Condition]... Human factors-related requirements References TBO Analysis Early Eng STAMP Fleming 15 49

86 Scenario 2: Deriving Requirements ANSP issues command that results in aircraft closing (or maintaining) a 4DT, but that 4DT has a conflict. Requirements: S2.8 4D Trajectories must remain conflict-free, to the extent possible... S2.10 Conformance volume must be updated within TBD seconds of change in separation minima S2.11 Conformance monitoring software must be provided with separation minima information Software-related requirements References TBO Analysis Early Eng STAMP Fleming 15 49

87 Scenario 2: Deriving Requirements ANSP issues command that results in aircraft closing (or maintaining) a 4DT, but that 4DT has a conflict. Requirements: S2.14 ANSP must be provided information to monitor the aircraft progress relative to its own Close Conformance change of clearance... S3.2 ANSP must be able to generate aircraft velocity changes that close the trajectory within TBD minutes (or TBD nmi). Rationale: TBO ConOps is unclear about how ANSP will help the aircraft work to close trajectory. Refined requirements will deal with providing the ANSP feedback about the extent to which the aircraft does not conform, the direction and time, which can be used to calculate necessary changes. Component Interaction Constraints References TBO Analysis Early Eng STAMP Fleming 15 49

88 Table of Contents 5. TBO Analysis 6. Early Eng 7. STAMP References TBO Analysis Early Eng STAMP Fleming 15

89 STAMP Controllers use a process model to determine control actions Accidents often occur when the process model is incorrect Four types of unsafe control actions: 1. Not providing the control action causes the hazard 2. Providing the control action causes the hazard 3. The timing or sequencing of control actions leads to the hazard 4. The duration of a continuous control action, i.e., too short or too long, leads to the hazard. Control Actions Controller Process Model Feedback Controlled Process Better model of both software and human behavior Explains software errors, human errors, interaction accidents,... References TBO Analysis Early Eng STAMP Fleming 15 50

90 STAMP Controllers use a process model to determine control actions Accidents often occur when the process model is incorrect Four types of unsafe control actions: 1. Not providing the control action causes the hazard 2. Providing the control action causes the hazard 3. The timing or sequencing of control actions leads to the hazard 4. The duration of a continuous control action, i.e., too short or too long, leads to the hazard. Control Actions Controller Process Model Feedback Controlled Process Better model of both software and human behavior Explains software errors, human errors, interaction accidents,... References TBO Analysis Early Eng STAMP Fleming 15 50

91 STAMP Controller Process Model Control Actions Feedback Controlled Process References TBO Analysis Early Eng STAMP Fleming 15 51

92 STAMP Controller Process Model Control Actions Feedback Controlled Process References TBO Analysis Early Eng STAMP Fleming 15 51

93 STAMP Controller Process Model Control Actions Feedback Controlled Process References TBO Analysis Early Eng STAMP Fleming 15 51

94 STAMP Controller Process Model Control Actions Feedback Controlled Process References TBO Analysis Early Eng STAMP Fleming 15 51

95 Unsafe Control Actions Control Action Execute ITP Abnormal Termination of ITP Not Providing Causes Hazard FC continues with maneuver in dangerous situation Providing Causes Hazard ITP executed when not approved ITP executed when ITP criteria are not satisfied ITP executed with incorrect climb rate, final altitude, etc FC aborts unnecessarily FC does not follow regional procedures while aborting Wrong Timing/Order Causes Hazard ITP executed too soon before approval ITP executed too late Stopped Too Soon/Applied Too Long References TBO Analysis Early Eng STAMP Four inadequate control actions of the ITP flight crew are identified as potentially unsafe Fleming 15 52

96 Control Flaws Control input or external information wrong or missing Inappropriate, ineffective or missing control action Actuator Inadequate Operation Inadequate Control Algorithm Controller (Flaws in creation, Process changes, Incorrect modification or adaptation) Process Model inconsistent, incomplete, or incorrect Sensor Inadequate Operation Inadequate or missing feedback Feedback delays Delayed operation Controller 2 Conflicting control actions Process input missing or wrong Controlled Process Component failures Changes over time Unidentified or out-of-range disturbance References TBO Analysis Early Eng STAMP Incorrect or no information provided Measurement inaccuracies Feedback delays Process output contributes to hazard [Leveson, 2012] Fleming 15 53