Safety Assessment of Autonomous Systems

在项目的第一阶段，键合图的方法是获得系统故障的原因，在自动控制的工厂。由于键合图显示了它们的元件和物理现象之间的直接对应关系，因此不仅容易获得系统模型，而且容易获得元件失效表示。使用键合图的逐步细化，可以根据系统上的可用信息定性或定量地分析因果关系。系统故障可以定义为一个特定的过程变量的偏差，其原因可以通过追溯的因果关系得到的正式因果关系分配过程中的键合图。在项目的第二阶段，我们考虑如何获得自治系统中的系统故障原因。由于自治系统的软件和硬件组件可以以if-then规则的形式表示，因此可以通过跟踪它们的因果关系来识别可能的原因。然而，它们的效果可能会被系统中采取的保护性行动所抵消。必须评估可能的系统故障原因的影响。由于有关的控制回路的评估几乎是不可能的所有干扰情况下事先，该方法要求系统分析师关于必要的故障条件，其发生时，每次获得一个可能的系统故障原因。通过这种方式，开发了一种交互式方法来获取系统故障原因。进一步，基于获得的可能的系统故障原因和它们的相关的检查变量之间的关系，自治系统的诊断规则的开发。提出了一种基于风险的故障诊断方法，不仅适用于可能存在多个异常事件的不确定条件下的故障诊断，而且适用于诊断树的构造。

At the first stage of the project, a bond graph approach is developed for obtaining system failure causes in automatically-ontrolled plants. Since bond graphs show a direct correspondence between their component and physicai phenomenon, it is easy to obtain not only a system model, but also component failure representations. Using the stepwise refinement of the bond graph, the causal relations can be analyzed qualitatively or quantitatively depending on the available information on the system. The system failure can be defined as a deviation of a specific process variable, and its causes can be derived by tracing back the causal relations obtained by the formal causality assignment procedure in the bond graph. The effect of a component failure can be also analyzed.At the second stage of the project, we consider how to obtain the system failure causes in autonomous systems. Since software and hardware components of the autonomous system can be represented in the form of if-then rules, the possible causes can be identified by tracing their causality. However, their effect may be nullifiled by the protective action taken in the system. The effect of a possible system failure cause must be evaluated. Since the evaluation of the related control loops is almost impossible for all disturbance situations beforehand, the method ask the system analyst about necessary malfunction conditions for its occurrence every time when a possible system failure cause is obtained. In this way, an interactive method is developed to obtain system failure causes. Further, based on the obtained relations between possible system failure causes and their related inspection variables, diagnosis rules of autonomous systems are developed. A risk-based approach is proposed not only in the failure diagnosis under uncertain conditions where several abnormal events are possible, but also in construction of a diagnosis tree.