Search

Professionalization of safety is gaining some interest in international safety literature, including (post)graduate training and education of safety experts. Different from research, there are hardly any publications and discussions on the quality of (post) graduate safety education in the academic safety literature. This article starts with a short historical picture of safety education. After this picture, a description of the ten (post) graduate safety courses involved is presented with a special reference to the assessment of the quality of these courses. It shows that an internal evaluation of quality, like reactions from trainees, and results from examinations, and tests are presently the main quality indicators. Discussions on how quality assessment can be performed has led to an overview of literature on educational objectives and educational models, and possible options for this assessment. The article concludes that the transfer of safety knowledge and skills to companies and organizations is a highly desirable elaboration of the quality concept. But it is also clear that traditional safety indicators can provide no, or only unreliable, information about the degree of this transfer. An overview of possible minor and major accident scenarios of the company or organisation concerned might be a better option, combined with the activities of the trainee to influence and prevent activation of these scenarios., (undefined)

Research into professionalization in health and safety has recently gained in interest. Graduate training is one of the factors that determines or conditions the role of the safety professional, thus intervene in the professionalization process. This article is the result of a workshop and the discussions of nine academic directors of safety education programs about quality evaluation. This article introduces the issue with a historic overview of safety education, presents a synthesis of nine selected education programs, discusses quality evaluation of health and safety education programs, propose a quality evaluation frame and finally, proposes a process for designing a quality safety education program with an associated model of the learning objectives. The outcomes are interesting for everyone who is interested in health and safety education and quality evaluation and will give insights into how safety professionals are educated.

International audience; Safety arguments, also called safety cases, are commonly used to demonstrate that adequate efforts have been made to achieve safety goals. Assessing the confidence of such arguments and decision-making is usually done manually and is heavily dependent on subjective expertise. Therefore, there is an urgent need for an approach that can assess confidence in the arguments in order to support decision-making. We therefore propose a quantitative approach, based on Dempster-Shafer (D-S) theory, to formalize and propagate confidence in safety cases. Goal Structuring Notation is adopted. The proposed approach focuses on the following issues regarding argu-mentation assessment: 1) formal definitions of confidence measures based on belief functions from D-S theory; and 2) the development of confidence aggregation rules for structured safety arguments with the help of Dempster's rule. Definitions of confidence measures and aggregation rules are deduced for single, double, and n-node arguments. Finally, a sensitivity analysis of aggregation rules is used to preliminarily validate this approach.

International audience; Railway standard EN50129 clarifies the safety acceptance conditions of safety-related electronic systems for signalling. It requires using a structured argumentation, named Safety Case, to present the fulfilment of these conditions. As guidance for building the Safety Case, this standard provides the structure of high-level safety objectives and the recommendations of development techniques according to different Safety Integrity Levels (SIL). Nevertheless, the rationale connecting these techniques to the high-level safety objectives is not explicit. The proposed techniques stem from experts belief in the effectiveness and efficiency of these techniques to achieve the underlying safety objectives. So, how should one formalize and assess this belief? And as a result how much confidence can we have in the safety of railway systems when these standards are used? To deal with these questions, the paper successively addresses two aspects: 1) making explicit the safety assurance rationale by modelling the Safety Case with GSN (Goal Structuring Notation) according to EN5012x standards ; 2) proposing a quantitative framework based on Dempster-Shafer theory to formalize and assessing the confidence in the Safety Case. A survey amongst safety experts is carried out to estimate the confidence parameters. With these results, an application guidance of this framework is provided based on the Wheel Slide Protection (WSP) system.

International audience; Confidence in safety critical systems is often justified by safety arguments. The excessive complexity of systems nowadays introduces more uncertainties for the arguments reviewing. This paper proposes a framework to support the argumentation assessment based on experts' decision and confidence in the decision for the lowest level claims of the arguments. Expert opinion is extracted and converted in a quantitative model based on Dempster-Shafer theory. Several types of argument and associated formulas are proposed. A preliminary validation of this framework is realized through a survey for safety experts.

Safety is ensured when hazardous circumstances, their consequences and their controls are known. How then, in uncertain contexts can safety be defined and achieved? Uncertainty raises new questions and needs new approaches for dealing with safety. These are introduced in the first chapter and developed throughout the book.

International audience; Structured arguments are commonly used to communicate to stakeholders that safety, security or other attributes of a system are achieved. Due to the growing complexity of systems, more uncertainties appear and the confidence in arguments tends to be less justifiable by reviewing. In this paper, we propose a quantitative method to assess the confidence in structured arguments, like safety cases. We adopt the Goal Structuring Notation (GSN) to model the safety case and propose to add annotations to identify uncertainties in this model. Three inference types of arguments are proposed according to their impact on confidence. Definition and quantification assessment of confidence are based on the belief function theory. The proposed approach is illustrated with several GSN examples.

International audience; Software applications dependability is frequently assessed through degrees of constraints imposed on development activities. The statement of achieving these constraints are documented in safety arguments , often known as safety cases. However, such approach raises several questions. How ensuring that these objectives are actually effective and meet dependability expectations? How these objectives can be adapted or extended to a given development context preserving the expected safety level? In this paper, we investigate these issues and propose a quantitative approach to assess the confidence in assurance case. The features of this work are: 1) fully consistent with the Dempster Shafer theory; 2) considering different types of arguments when aggregating confidence; 3) a complete set of parameters with intuitive interpretations. This paper highlights the contribution of this approach by an experiment application on an extract of the avionics DO-178C standard.

A lot of products embed software applications carrying out complex functions (e.g. cars, aircrafts, and medical equipments). More and more authority for control is placed on these applications whose failures may lead to accidental loss. Numerous methods have been developed to prevent these failures. These methods apply either to the programs developed or to the design activities. However, the programming or modelling languages used to operationalise the solutions as software applications are rarely questioned. These languages constitute the technology of realization of the program. On one hand, the language features are selected to increase the development performance and to decrease the software application costs. On the other hand, these features may be at the origin of specific types of faults which constitute the intrinsic risks of these languages. Therefore, the choice of a language or of a subset of a language, leads to a decision-making issue of how to deal making safety and performance trade-offs. The first part of the paper analyzes the evolution of the programming languages. We show that these changes were aimed at the convergence of design performance improvement with designed application safety. The introduction of the object-oriented technologies breaks this commonality. They cut the development expenditures but introduce new types of faults. The decision-makers such as the critical software application producers (e.g. the aircraft manufacturers) and the authorities (e.g. the avionics certification authorities) have to deal with this trade-off. These new technologies cannot be just rejected as they are more and more often used in certain domains (e.g. mobile phones, internet applications). The proposed constraint on using them seem to be too restrictive and are not justified. In particular, the safety levels of software programs developed applying these constraints are not assessed. The second part of the paper addresses these questions. It specifies the problem and it proposes a method to estimate the risk of faults in object-oriented programs. Thus, the decision-makers can elaborate rules for using object-oriented languages establishing a trade-off between the wished-for development performance and the required safety levels.

This paper is motivated by the challenge to traditional development process of embedded systems from the evolution of dependability requirements, which leads to manual analysis and revision of system designs at design-time or post-implementation at a high cost, especially when the target system is complex or large. This paper proposes a complementary methodology, namely the model monitoring approach, to fill in the gap between the evolution of dependability requirements and traditional development process. The novel approach models functional and dependability requirements separately, and contains two alternative implementation techniques: model monitoring and model generating. The paper illustrates the methodology with examples and comparison with the model checking approach, to show better support of the evolution throughout the life-cycle at a lower cost.

The research is motivated by the challenge from the evolution of safety requirements, which leads to revision of system designs at design-time or post-implementation at a high cost. This paper proposes a complementary methodology, namely the model monitoring approach, to better support the evolution throughout the life-cycle at a lower cost.

We propose the nevertrace claim, which is a new construct for specifying the correctness properties that either finite or infinite execution traces (i.e., sequences of transitions) that should never occur. In semantics, it is neither similar to never claim and trace assertion, nor a simple combination of them. Furthermore, the theoretical foundation for checking nevertrace claims, namely the Asynchronous-Composition Buchi Automaton Control System (AC-BAC System), is proposed. The major contributions of the nevertrace claim include: a powerful construct for formalizing properties related to transitions and their labels, and a way for reducing the state space at the design stage.

Ce document retranscrit les grandes lignes de trois des interventions suivies de tables rondes organisées lors de la première édition du International Forum on Industrial Safety, qui s’est tenu à Toulouse en 2008: (1) «Quel équilibre entre sécurité contrainte et sécurité gérée?», animée par René Amalberti; (2) «Introduction à l’incertitude», animée par Laurent Magne; (3) «Introduction aux notions de risque au travers d’un conte de fées», animée par Gilles Motet.

Guidelines and consistency rules of UML are used to control the degrees of freedom provided by the language to prevent faults. Guidelines are used in specific domains (e.g., avionics) to recommend the proper use of technologies. Consistency rules are used to deal with inconsistencies in models. However, guidelines and consistency rules use informal restrictions on the uses of languages, which makes checking difficult. In this paper, we consider these problems from a language-theoretic view. We propose the formalism of C-Systems, short for "formal language control systems". A C-System consists of a controlled grammar and a controlling grammar. Guidelines and consistency rules are formalized as controlling grammars that control the uses of UML, i.e. the derivations using the grammar of UML. This approach can be implemented as a parser, which can automatically verify the rules on a UML user model in XMI format. A comparison to related work shows our contribution: a generic top-down and syntax-based approach that checks language level constraints at compile-time.

Safety is an important element of dependability. It is defined as the absence of accidents. Most accidents involving software-intensive systems have been system accidents, which are caused by unsafe inter-system or inter-component interactions. To validate the absence of system hazards concerning dysfunctional interactions, industrials call for approaches of modeling system safety requirements and interaction constraints among components. This paper proposes such a formalism, namely interface control systems (or shortly C-Systems). An interface C-System is composed of an interface automaton and a controlling automaton, which formalizes safe interactions and restricts system behavior at the meta level. This framework differs from the framework of traditional model checking. It explicitly separates the tasks of product engineers and safety engineers, and provides a top-down technique for modeling a system with safety constraints, and for automatically composing a safe system that conforms to safety requirements. The contributions of this work include formalizing safety requirements and a way of automatically ensuring system safety., Comment: 6 pages. In Proceedings of the 2nd International Conference on Dependability (DEPEND 2009), Athens, Greece. IEEE Computer Society, 2009

Most recent software related accidents have been system accidents. To validate the absence of system hazards concerning dysfunctional interactions, industrials call for approaches of modeling system safety requirements and interaction constraints among components and with environments (e.g., between humans and machines). This paper proposes a framework based on input/output constraint meta-automata, which restricts system behavior at the meta level. This approach can formally model safe interactions between a system and its environment or among its components. This framework differs from the framework of the traditional model checking. It explicitly separates the tasks of product engineers and safety engineers, and provides a top-down technique for modeling a system with safety constraints, and for automatically composing a safe system that conforms to safety requirements. The contributions of this work include formalizing system safety requirements and a way of automatically ensuring system safety., Comment: 6 pages. In Proceedings of the 4th International Conference on Systems (ICONS 2009), Gosier, Guadeloupe, France, pp. 228-233. IEEE Computer Society, 2009

Along with the popularity of software-intensive systems, the interactions between system components and between humans and software applications are becoming more and more complex. This results in system accidents related to system safety issues. System accidents are different to failures related to component reliability. System safety is not well addressed, because functional requirements and safety requirements are separately handled in practice. In this paper, we consider safety requirements as control structures that restrict system behaviors at meta-model level. We propose the formalism of interface C-Systems, short for "interface control systems''. In this framework, functional requirements and safety requirements are separately formalized as interface automata and controlling automata respectively, as what we are doing in practice. The controlling automaton may guarantee safety requirements at design-time or runtime. Then the global system is a safe specification. The underlying mechanism differs from that of model checking. It explicitly separates the tasks of product engineers and safety engineers, and provides a new top-down methodology for designing and modeling a system with safety constraints, and for automatically composing a safe system that conforms to safety requirements. In practice, this methodology may be also used for safety checking, incident reporting and service restoration.

International audience; Safety is now a major concern in many complex systems such as medical robots. A way to control the complexity of such systems is to manage risk. The first and important step of this activity is risk analysis. During risk analysis, two main studies concerning human factors must be integrated: task analysis and human error analysis. This multidisciplinary analysis often leads to a work sharing between several stakeholders who use their own languages and techniques. This often produces consistency errors and understanding difficulties between them. Hence, this paper proposes to treat the risk analysis on the common expression language UML (Unified Modeling Language) and to handle human factors concepts for task analysis and human error analysis based on the features of this language. The approach is applied to the development of a medical robot for teleechography.

In the previous chapter we carried out a general presentation of the various methods, which allow the suppression of technological faults during the manufacturing and the operation stages of the lifecycle of the product. We will now magnify some of the technical aspects of structural testing, focusing on hardware and software technologies.

In this chapter we examine the techniques allowing the integration of error detection operations into the active life of the product, disturbing in the least possible way the operation of this product.

The use of a product is fundamentally justified by the user’s needs. The user possesses the initial motivation to buy or develop a product. In certain cases, this motivation corresponds to a necessity. For example, the fact that society does not accept accidents caused by the simultaneous presence of a train and a vehicle on a railroad crossing, justifies the creation of a system that avoids such accidents. Therefore, a product’s life has to naturally start with the client’s or future user’s requirements (also called needs).

We continue our exploration of the principal groups of protection methods by now considering dynamic analysis techniques, called here offline testing techniques. Test sequences are applied to an executable product during the production and operation stages. This chapter dealing with the removal of technological faults extends Chapter 11 dedicated to prevention of technological faults. However, the techniques presented here also allow the detection of certain functional faults stemming from previous specification and design stages, faults which occurred despite the protection means used during these stages. We note that these residual faults should have been detected earlier, as their detection in the production, or, even worse, in the operation phase, may question the design and technology choices. This chapter is principally concerned with hardware products. In Chapter 13, we will complete this presentation of on-line testing with the study of several simple structural test methods for hardware and software systems.

Stemming from the design stage, the model called system has to be transformed into a final product with the aid of technological means which permit its execution in the context of its environment. Two technologies are used in the products studied here, hardware technology and software technology. In the majority of cases, these two technologies cohabit, their respective weight being dependent on criteria which are often nonfunctional, such as their speed performance (which favors electronic hardware) or adaptability (more easily obtained by software). We do not discuss these choices, but we focus only on the problems of dependability induced by the use of these two technologies.

Faced with the ever-increasing complexity of testing, scientists have developed several methods and techniques to make test pattern generation easier, as well as to decrease the length of these sequences in order to reduce the testing duration, by acting on the product design.

The growth of the technical and scientific knowledge in our society stimulates the growth of new manufactured products, reducing the costs and delays of design and production, and improving the global quality of our life. Moreover, the consumers who demand more and more services encourage this innovation. The sophistication of automobiles is a good example of this evolution: assisted braking and grip, reduced gas consumption by a better optimization of engine performance, road navigation and choice of optimal routes, etc. What is more, the knowledge and behavior of consumers is becoming increasingly demanding about prices, of course, but equally regarding the quality of services provided by the chosen products. This notion of quality associated with manufacturing goods is progressively becoming more refined and standardized. It is now imposed on all designers and manufacturers as an essential factor in the success of their products. Therefore, the ISO 8402 standard defines quality as: The totality of characteristics of an entity that bear on its ability to satisfy stated and implied needs.

In this chapter, we begin the study of impairments to the dependability of a product with the analysis of failures and faults From the observation of anomalies in the behavior of a product during its use, we define in section 3.1 the notion of failure relative to changes in the delivered service. In section 3.2, we identify and classify the various causes of failures, known as faults, according to several criteria. In section 3.3 we then explore the life cycle of hardware and software products, looking for the diverse faults which can appear. Some faults will be analyzed using the example of a drinks distributor in section 3.4. We conclude in section 3.5, providing a classification of faults, and assessing its interests and its limitations.

Design is a complex stage of the creation of a product. It is potentially at the origin of numerous functional faults whose prevention and removal are quite difficult. The company IBM was the first industrial to publicly recognize the difficult nature of design faults. A fault analysis carried out on large operating systems of the 1970’s revealed that not only did a small number of non-eliminated design faults exist, but also that the efforts made to totally eliminate them did not necessarily converge: eliminating a fault meant the appearance of other faults. This knowledge encouraged people to study and to use new methods and techniques, providing an important improvement of the product’s dependability. As an example of the result of these efforts, the company Fujitsu announced in the 1990’s that their software did not possess more than 10 faults on average per million program lines at the end of the first design. Even if these figures do not come from an independent organism, they are significant and should encourage the learning and use of the techniques introduced here.