Fabien Belmonte, Walter Schön, Laurent Heurley, Robert Capel. HAL Id: hal

Transcription

1 Inedslnay safey analyss f mlex s-ehnlgal sysems based n he Funnal Resnane Aden Mdel: An alan alway aff suevsn Faben Belmne, Wale Shön, Lauen Heuley, Rbe Cael T e hs vesn: Faben Belmne, Wale Shön, Lauen Heuley, Rbe Cael. Inedslnay safey analyss f mlex s-ehnlgal sysems based n he Funnal Resnane Aden Mdel: An alan alway aff suevsn. Relably Engneeng and Sysem Safey, Elseve, 2011, 96, < /j.ess >. <hal > HAL Id: hal hs://hal.ahves-uvees.f/hal Submed n 8 O 2010 HAL s a mul-dslnay en aess ahve f he des and dssemnan f senf eseah dumens, whehe hey ae ublshed n. The dumens may me fm eahng and eseah nsuns n Fane abad, fm ubl vae eseah enes. L ahve uvee ludslnae HAL, es desnée au déô e à la dffusn de dumens senfques de nveau ehehe, ublés u nn, émanan des éablssemens d ensegnemen e de ehehe fanças u éanges, des labaes ubls u vés.

2

3 Inedslnay safey analyss f mlex s-ehnlgal sysems based n he Funnal Resnane Aden Mdel: an alan alway aff suevsn Faben Belmne a, Wale Shön b, Lauen Heuley, Rbe Cael a a Alsm Tans 48 ue Albe Dhalenne San-Ouen edex, Fane b Unvesé de Tehnlge de Cmègne Labae Heudasy Cene de Rehehes de Ryalleu BP Cmègne edex, Fane Unvesé de Pade Jules Vene Éque Cgnn, Langage, Émn e Aqusn (CLEA) EA 4296, UFR de Phlshe, Senes Humanes e Sales Chemn du Thl, Amens, Cedex 1. Absa Ths ae esens an alan f Funnal Resnane Aden Mdels (FRAM) f he safey analyss f mlex s-ehnlgal sysems,.e. sysems whh nlude n nly ehnlgal, bu als human and ganzanal mnens. The suevsn f ean ndusal dmans vdes a gd examle f suh sysems, beause alhugh me and me ans f lng nsallans ae nw aumazed, hee always emans a desn level (a leas n he managemen f degaded mdes) nvlvng human behav and ganzans. The feld f alan f he sudy esened hee s alway aff suevsn, usng mden Auma Tan Suevsn (ATS) sysems. Examles aken fm alway aff suevsn Pen submed Relably Engneeng and Sysem Safey Augus 27, 2010

4 llusae he nal advanage f FRAM n masn lassal safey analyss mdels,.e. he ably ake n aun ehnal as well as human and ganzanal ases whn a sngle mdel, hus allwng a ue muldslnay ean beween sealss fm he dffeen dmans nvlved. A FRAM analyss s used nee exemenal esuls baned fm a eal ATS sysem lnked a alway smula ha laes eas (exemenal subjes) n smulaed suans nvlvng ndens. The fs esuls shw a sgnfan dsesn n efmanes amng dffeen eas when deeng ndens. Sme subsequen wk n gess ams make hese efmane ndns me hmgeneus, manly by egnm mdfans. I s lea ha he uen Human-Mahne Inefae (HMI) n ATS sysems (a legay f as ehnlges ha used LED dslays) has eahed s lms and needs be mved, f examle, by hghlghng he ms enen nfman f a gven suan (and, nvesely, by emvng elevan nfman lkely dsa eas). Keywds: Auma Tan Suevsn (ATS), Human-Mahne Inefae (HMI), Human-Mahne Sysem (HMS), Human Relably, Funnal Resnane Aden Mdel (FRAM), Smulaed envnmen, Exemens. 1. Indun Indusal sk managemen has beme a maj hallenge f u sey. Bn u f he need nl new hazads ha have amaned ehnlgal advanes (eseally sne he send half f he 20 h enuy), 2

5 ndusal sk managemen was fs fmalzed n he nneeen-sxes wh he emegene f elably and mananably hey [1]. The desgnes f safey-al sysems subsequenly naed hs fmalsm n he sandad ehnques f sysems engneeng [2]. These ehnques have nw been nmalzed f aula dmans f avy. See f examle [3] f gammable elens, [4, 5, 6] f he sef dman f alway sgnalng. Suh develmens dd n, hweve, exlly nlude any efeene human fas. Neveheless, n he mlay dman he enal le f he human ea n he ean f safey-al sysems was qukly egnzed. Nbe Wene s Cybenes [7], f examle, dew n bsevans f an an-aaf defene ea and a eeved analgy beween he mehanal laws gvenng he hysal evlun f he sysem and he ea s behav. A numbe f sudes amng mve wkng ndns have been suessfully ndued and have nbued edung sks. Hweve, esablshng a de lnk beween sk managemen and he sal and human senes emans smewha elusve. The mehdlgal famewk f sk managemen nw nludes sef ls f evaluang human elably, and me eenly ganzanal elably. The fs mehds be develed used he fmal famewk f elably, whh mean axmang human behav mahne behav. Ths aah was sngly zed by he senf mmuny. Dughey [8] and Hllnagel [9] vde a summay f hs sm. Ths fs genean f mehds als naed a debae abu he naue f human e [10]. In he fllwng yeas a send genean f mehds emeged, akng n aun human and sal fas n a me dealed manne and dawng un develmens 3

6 n he human and sal senes [9, 11, 12, 13]; see [14] f a evew f he leaue. Ths ae deals wh ndusal sks assessmen n mlex s-ehnal sysems msng a ehnal level (hadwae and sfwae), a human level (manenane agens, eas, desgnes) and an ganzanal level (a se f ules and neans gvenng he dffeen ans ha an be efmed n he sysem). Eah ne f hese mnens uld be addessed seaaely by adng ehe a mahne-eneed aah ( ehnaleneed aah) a human-eneed aah. Insead, we se ad a Human-Mahne Sysem (HMS) aah ha nsdes hese seaae levels n a sysem way [15]. T llusae u aah we esen an nedslnay sudy we have ndued evaluae he ma f auman n a alway aff suevsn subsysem n he veall safey f he alway sysem. The mehdlgy used n hs sudy nvlves ayng u he sk analyss as emmended by eah famewk, and alyng a mlemenay analyss ake n aun he human and ganzanal levels n a me sasfay manne han he lassal aah he safey f ehnlgal sysems. Ths mlemenay aah mus esablsh a efeenal mmn he hee senf dmans nvlved n he mlex s-ehnal sysems. In he fs a f he ae, we esen befly he HMS aah we aded. The send a uses he hey f aden mdelng demnsae he need f a sysem aah n evaluang he human and ganzanal levels. The Funnal Resnane Aden Mdel (FRAM), develed by E. Hllnagel [16] analyze adens, uses hs aah, whee 4

7 he hee mnens (ehnal, human, ganzanal) ae esen smulaneusly and nea nnuusly. Ths mehd and s alan n he alway feld ae esened n he las w sens: we begn wh he dealed esenan f a safey edue f eng a zne f wk n a alway ak whee he dffeen levels f human avy ae sngly maed, afe whh we examne a fuhe ase sudy nvlvng aff mnng and nden deen by eas. In hs send ase he esndng FRAM newk s albaed usng exemenal esuls baned fm eal eas dung smulans. Used as a mlemen he lassal aah, he FRAM mehd an vde a me dealed nsgh n human and ganzanal evens, allwng qualave esuls be efned. We nlude he ae wh sme eseves f fuue wk: he man bjeves f fuhe wk wll be evaluae he lkely benefs f mvng Human-Mahne Inefaes (HMI) n ATS sysems as egads he deen f ndens by human eas, and ssbly seek deve quanave analyss fm qualave analyss usng belef funn aahes. Ths wk s sued by he Fenh Sae and he Pade Regn as a f he Human, Tehnlges and Cmlex Sysems eseah gamme. I was he subje f a PhD. hess defended n 2008 [17]. 2. Mahne-eneed vs. Human-Mahne Sysem aah The esen ae ads an HMS aah ahe han a mahneeneed aah. In ems f he dslne, he mahne-eneed aah esnds an engneeng aah, he nes and ls f ndusal sk manage- 5

8 men beng based n sandad ehnques f deendably, usng he mahemaal fmalsm f elably and mananably develed by Balw and Pshan [1]. Ths fmalsm nans a b-mdal mdel f he sysem s mnens wh nly w ssble saes (funnng / falue) f eah mnen. Ohe mehds, suh as Faul Tee Analyss, ae able deal wh mulmdal blems [18].e. akng me han ne falue mde n aun. In all ases he sysem s haaezed by a haaes ve gvng he sae f eah f s mnens. The aah nvlves deemnng he sysem s sae as a funn f hs haaes ve. Rgus mehds, usng nduve deduve easnng, ae emlyed hs end. The mehdlgy s based n a sysema exlan f hazadus evens mnens falue mdes. The mehds develed by deendably engnees vde he ls needed exlan he falues a he sysem s dffeen levels ha esul n adens (see [19] f a dealed esenan f hese mehds). Hweve, hs mahne-eneed aah aeaed be nsuffen mve he elably f mlex aumaed sysems suh as nulea eas ansan sysems. I beame lea ha human eas ae a key mnen n elably and safey f suh sysems. F examle, Rasmussen 1969 ed by Vene [20] ns u ha ne f he nlusns f an analyss f 129 ndusal adens n he nulea and a ansan dmans ndued by he ss-dslnay eseah eam f he RISØ gu was ha adens naed by human malean amun ughly hee quaes f he al numbe f eed ases [20] age 11. F hs easn, fm he begnnng f he 1960s sme eseahes began 6

9 shf fm a mahne-eneed aah an HMS aah [20, 21]. Fm he sa, ne f he man blems faed by eseahes and desgnes was analyzng and undesandng he ma f nefae desgn n eas gnve esses and efmanes when neang wh mlex sysems (e.g., n nulea nl ms) n de mve he way nfman was esened eas. Insead f fndng answes he quesns n he syhlgal leaue hey fund a ga, and n an aem fll hs ga wee led ay u eseah and devel new mdels and mehds adaed HMS. They used nes, axmae mdels f gnn [22] and mehds develed n gnve syhlgy and n gnve sene. Nwadays, he HMS aah s well eesened n hee felds whh emeged a he end f he 1970s and a he begnnng f he 1980s. These felds, whse fnes ae sll n lealy denfed, ae gnve engneeng, gnve sysems engneeng and gnve egnms [23, 15]. Cgnve engneeng an be defned as an aled gnve sene ha daws n he knwledge and ehnques f gnve syhlgy and elaed dslnes vde he fundan f nle-dven desgn f esn-mahne sysems. [23] Cgnve sysems engneeng s a vaan f gnve engneeng n whh wk, humans and ehnlgy ae nsdeed as a jn gnve sysem [24]. I has eenly been defned as an aah he desgn f ehnlgy, anng, and esses nended manage gnve mlexy n sehnal sysems. [25]. 3. Cgnve egnms ads a smla aah he w hes, bu havng emeged n he nex f human-mue neans gnve egnms fuses me lsely n he le f he human n HMS, wheeas gnve engneeng and gn- 7

10 ve sysems engneeng lae geae emhass n he le f he mahne [26, 15]. These felds bh nsde ha he syhlgal funnng f eas (mely efeed by he ems gnve gnn [21]) s a ual a f he veall elably and safey f he es f he sysem n/wh whh hey nea, and nsequenly mus be aken n aun and naed n he desgn ess f mlex sysems. Ths sn s well llusaed by Hllnagel and Wds wh nsde ha he ss and nsequenes f gnng he gnve funns f Man Mahne Sysems ae ned n ehnlgal falues daly (we need nly menn he Thee Mle Island aden) [21] Cean nes, as well as hees abu he aheue and funnng f human gnn ha wee nally elabaed n he nex f labay eseah (nally n an nfmanessng eseve), and als mehds aken fm gnve syhlgy and gnve sene, have been used and adaed f aal needs by hese hee felds [27, 28]. As wll aea n he fllwng sens, u eseah s suaed a he meeng n f hese dffeen felds. 3. Aden hey mdels The analyal mehd used n deendably analyss eesens adens as suessns f evens n whh safey aeas as a ey f he sysem. Reslene engneeng [29], n a sysem famewk, ges beynd hs and defnes safey as an emegen sysem henmenn, ahe han as a ey. 8

11 3.1. Aden mdels T falae hs aah a lassfan f adens n hee aeges has been sed [16]: sequenal, edemlgal and sysem. In he sequenal mdel, an aden s exlaned as a suessn f evens lnked gehe by a ause--effe elansh. In Reasn s [30] edemlgal mdel an aden s he esul f assve falues, ndued by laen ndns whse effe s n mmedae, bu bemes manfes when a aula funn sysem mnen s alled un. Fnally, he sysem mdel ndued by Wds [31], Levesn [19] and Hllnagel [16] desbes an aden as he esul f mlex neans beween he dffeen mnens f he sysem. An aden s he nsequene f a ndene f evens, ahe han f a deemns suessn f evens [16] Mehdlgal efeenal Deendably hees have n ye develed mehds f evaluang he dynams f adens elave all hee mdels lsed abve. Only he fs w mdels ae addessed n he mehdlgal famewk. The man mehds deve fm w aahes [2]: nduve aah (fm auses nsequenes: mehds nlude Even-Tees, Falue Mdes Effes and Caly Analyss); deduve aah (fm nsequenes auses: mehds nlude Faul Tees). Seveal mehds based n he same heeal bakgund have been develed n de addess human fas and/ ganzanal sk analyss; see [32] f a glbal vevew f hese mehds. 9

12 Cmnen 2 N OK OK 1 OK N OK Cmnen 1 Fgue 1: Examle f dsee sena sae All hese mehds ae wdely used n vaus ndusal dmans and emmended by he nmave efeenal. Eah f hem eaes a eesenan f he sysem usng he sae f s mnens, whh an be b-mdal (funnng / falue) mul-mdal (seveal degaded mdes and falue mdes). These mehds enable he sysem s sae be nfeed fm s sae ve (ha s say he values f he b-mdal mul-mdal vaables defnng he sae f sysem mnens), and make ssble l he evlun f sysem sae va a sae dagam. As an examle, Fgue 1 eesens a sysem msed f w mnens wh b-mdal saes, whh leads fu saes f he sysem. The ah llusaed n he fgue shws a sena f he evlun f sysem sae n fu ses. Ths eesenan f adens fulfls he equemen f he safey f a ehnal sysem be demnsable, vded ha an be shwn ha he se f e-esablshed falue senas s exhausve (n ems f he sevey f he nsequenes). I s, hweve, esve when dealng wh evens nvlvng humans and ganzans. Cnsdeng human bengs as b-mdal mnens ( as mnens wh nly a few lealy denfed falue mdes) s bvusly 10

13 esve and des n esnd he mdels be fund gnve syhlgy. In an aem g beynd hs vely smls eesenan, sysem mdels have fused n sysem funns nsead f n sysem mnens. The use s be able eesen s-ehnal sysem dynams, n a nnuum based n measuemens f he effeveness f funns efmed by he sysem. Fgue 2 esens a nnuus ah eesenng he sae f a sysem efmng hee funns. The dffuly s fnd an aae measuemen f he effeveness f eah funn. Measue f F2 Measue f F3 Measue f F1 Sysem efmng 3 funns: F1, F2 and F3 Fgue 2: Examle f nnuus sena sae 3.3. A mmn efeenal: sysems analyss The maj advanage f a sysem aah s a me mlee negan f human fa ened sudes n he ne hand, and ehnal safey ened sudes n he he. Ths s aheved lagely hugh he use f a mmn mehdlgal efeenal. Wds and Hllnagel [33, 34, 35] see s-ehnal sysems as gnve sysems, efeng hem as Jn Cgnve Sysems. These auhs have develed a new banh f engneeng 11

14 f human-mahne nean whh has beme knwn as Cgnve Sysems Engneeng (CSE) [36, 37]. Human-mahne sysems have adnally been analyzed usng seaae aahes f he human and ehnal mnens, fllwed by a mlemenay sudy f neans. F he eas f CSE, hs eduve aah s nadequae, and shuld be elaed by a eesenan f he mlee sysem nludng human eas and mahnes. The mmn denmna s gven by he gnve dmensn f hs veall sysem. Hweve, a eesenan f he mlee sysem wll n n self mve he sysem s safey. Inenal elanshs whn he sysem d n have denal wegh, n d hey have denal nsequenes f safey. F Bede [13], a sysem eesenan s n suffen by self yeld an negaed aah f he safey f mlex s-ehnal sysems. A jn endeav bdgng he dvde beween deendably engneeng and he human and sal senes s als needed. Hweve, efmng safey sudes by sysem mehds s, n u vew, a fundamenal mlemen lassal safey analyss. I s n hs eseve ha he Funnal Resnane Analyss Mehd was u fwad. 4. The Funnal Resnane Analyss Mehd The FRAM mehd, develed by E. Hllnagel [16], desbes he sehnal sysem n ems f s funns and s aves ahe han n ems f s suue. The am f he FRAM mehd s eesen he sysem s dynams by mdelng he nn-lnea neans ha ae a f he sysem, and hugh a nvel eesenan f he efmane f 12

15 funns and aves. The deendeny mdel s based n he ne f funnal esnane, whh mes fm undulay hyss and an be seen as a meah f shas esnane. The shas esnane nle nvlves suemsng nse, n nn-lnea sysems, n a lw amlude sgnal ha s hadly deeable. Addng he nse eaes a esnane wh he lw amlude sgnal ha makes deeable. Hllnagel hee makes use f he ne f shas esnane (me fen used exlan he aeaane f de n a sysem) n de exlan he uene f adens. He aes u hs ansfe fm hyss safey analyss by usng he vaably f efmane f eanal uns whn a s-ehnal sysem. Tadnally, funns eesen ehnal sysem eans and aves eesen human/ganzanal eans; hee he w nes ae meged n he ne f eans. Whn a s-ehnal sysem eanal uns mgh be ehnal sysems, humans ganzans. In he vew f [16], vaably f efmane n a ehnal sysem s elaed mefens asng u f he esses f desgn and dun, and nn-exhausve sefans f wkng ndns (effes due he envnmen and nn-exeed nus). Vaably f efmane n humans and ganzans mes fm he aay ada hemselves wkng ndns and fm he egulay n aves (een, gnn, an and mmunan). The aallel wh shas esnane an be exlaned by he shas naue f he vaably f efmane f eanal uns whn he s-ehnal sysem, nsdeed as a nnlnea sysem. In addn, Hllnagel uses he suesn f he sgnal as a funnal deendeny mdel beween sysem s eanal uns. The lw 13

16 amlude sgnal esnds he vaably f efmane f a aula eanal un. Ths vaably s a lw amlude sgnal nsfa as devans n efmanes (nsdeed ndvdually and n n he glbal sysem nex) have lle n ma n he glbal sysem efmane and n safey. The nse sgnal eang he esnane esnds he vaably f efmane f he es f he sysem. The lw amlude sgnal may heefe be he vaably f efmane f any eanal un n he sysem, and nsequenly he nse esnds he aggegan f he vaably f efmane f all he eanal uns (nludng he envnmen). Hllnagel alls hs henmenn funnal esnane. Examnng he enaly f adens usng he FRAM mehd means examnng he ean f a aula sysem n hee seaae ses ha we ulne belw. Oeanal Un Inus () Ouus () Ressues () Cnls/nsans () Pendn () me () Fgue 3: Hexagam The fs se s a fmal beakdwn f sysem ean n elemenay eanal uns, eah f whh has sx abues (see Fgue 3). These abues seve as nnes beween elemenay eanal uns: Inus (): nu(s) f he eanal un; Ouus (): uu(s) f he eanal un; 14

17 Resue (): esue(s) equed f he essng efmed by he eanal un; Tmes (): me equed f he essng efmed by he eanal un; Cnl (): nl(s) and nsan(s) gvenng essng by he eanal un (exens, edues, mehds, e.); Pendn (): ndns ha mus be sasfed f he eanal un funn ely. Wkng Blk lan eques f Swh feld's ID. H - T T eques f en F 1 H - T T eae HILC F 3 msg. eaan HMI ATS Swh ATS's ID. sn n MMI CRC nl T T valdae he eaan F 4 msg. nfman msg. 15s - (-) aknwledge eaan H - T T T mmand swh blkng F 6 msg. md T T T blk swh F 7 Swh blked Swh blked Wkng lan H T wk n aks F 10 Sgns n aks Cmmunan Swh feld's ID. H - T T denfy, memse Swh ID. F 2 Swh ATS's ID. T nfm HILC F 5 HMI ATS T Aknwledge swh blked F 8 Swh's sae udaed n HMI Wkng lan H - T T Auhse wk n ak F 9 Wk auhsan HMI ATS Swh ATS'S ID. sn n HMI Fgue 4: FRAM newk mdel The send se s deemnng he enal vaably f eah eanal un. FRAM lassfes eanal uns n hee aeges: Human (H), Tehnal (T) and Oganzanal (O). The eanal un s enal vaably s deemned by he eseve weghs f eleven mmn 15

18 efmane ndns (CPC), ang as nex fas n he eanal un, adng s aegy. The CPC used n FRAM ae based n Hllnagel s CREAM (Cgnve Relably and E Analyss Mehd) mehd f sudyng human elably; see [9] f a dealed esenan. The CPC ae shwn n Table 1, adng eanal un aegy. These nex fas an have sve negave mas n efmane. CPC Resue avalably Tanng and exeene Qualy f mmunans Qualy f human-mahne nefaes Aessbly and avalably f mehds and edues Wkng ndns Numbe f smulaneus bjeves Tme avalable Cadan hyhm Qualy f eam llaban Qualy f ganzanal su Caegy H - T H H - T T H H - T H - O H H H O Table 1: Cmmn Pefmane Cndns (CPC) The qualy f eah CPC akes ne f hee ssble values: (1) sable vaable bu adequae, (2) sable vaable bu nadequae, (3) unedable. The am s deemne he se f alable CPCs f eah eanal un and evaluae he qualy. As a geneal ule, whee a CPC s sable vaable bu adequae he esndng vaably f efmane s lw, and whee he CPC s sable vaable bu nadequae, vaably f efmane s hgh. Fnally, f a CPC s unedable, he esndng 16

19 vaably f efmane s vey hgh. The hd se esablshes deendenes beween eanal uns. Ths s easly efmed by nseng esndene abues assgned n he fs se. Gahally, hs means nneng he nus and uus f eah un, eesened by s hexagn, he uus and nus f he uns, hus nsung wha s emed a FRAM newk : Fgue 4 shws an examle f a FRAM newk nsued n hs way (hs newk eesens he alway ase sudy esened n he fllwng sen, f eng manenane eams n aks, n s nmnal mde). Ths newk enables nfman flws dung he nmal exeun f an ean be eesened fmally. The labels H, T and O n he heade a f a un s hexagn ndae he aegy f enes aang n he eanal un. The newk s hen used seah f negave funnal esnanes whh may affe he e sequene f eanal uns and dee he agan f suh esnanes hugh he sysem. The fllwng sen esens a ase sudy f he use f FRAM n he dman f alway safey. 5. Alan alway aff suevsn 5.1. Ralway suevsn nex In he as, he safey f alway aff was alms enely deenden n ans by humans (mehanal sgnals wee manually manulaed by agens). Nw alway sysems ae wdely aumaed: On ms lnes, ans ae aumaally and safely deeed nsde fxed znes knwn as blks (vey few lnes uenly use mvng blks 17

20 whse sns deend n he mvemens f ans). Safe deen means ha n sngle falue lausble mbnan f falues an lead he nn-deen f a an (nsequenly falues usually lead false deens); Ths auma an deen s used eae sgnals whh ensue ha ans nly ene blks ha ae n aleady ued. Ths funn s alled blk lg blk sysem ; T ammdae ans gng n seveal dens, a alway newk nludes banh lnes and junns ha ely n swhes ns. The sae f he swhes s safely nlled; Auma an deen, swh nl and sgnals ae used allw a an avel n a ue (a sen f ak beween w swhes) nly f n ans ae smulaneusly allwed avel n a nflng (.e. se den, nvegen, sequen, e.) ue. Ths funn s alled nelkng ; If a dve fals ese a sgnal, hs wll be deeed and esul n he an beng sed. Ths funn s knwn as Auma Tan Pen (ATP); On sme uban lnes ans ae dven aumaally, and n ean ases n dve s esen n he ab. Ths funn, knwn as Auma Tan Oean (ATO) s n nsdeed safey al (sne safey s ensued by ATP funn); 18

21 Fnally, he nl and mnng f aff s me and me enalzed n Oeang and Cnl Cenes (OCC). Ths funn, knwn Auma Tan Suevsn (ATS) s he famewk f he esen ae. The ATS funn has evlved nsdeably n een yeas: nw makes wde use f mue sysems efm funns lke auma ue seng (ues ae aumaally se f ans usng edefned meables me shedules whee eah an s mssn s defned). Theefe, n a mleely nmnal suan he human ea s le s esed mnng (see [38] f a dealed desn f nes f auman ). Hweve, human nevenns eman neessay eve fm unavdable ndens whh make sme ans lae, make sme sens f ak unavalable, and s n. In suh ases, human eas wll use ATS mdfy he shedule, manually se ues, e. Alhugh hs mgh seem susng a fs sgh, he ATS funn s n nsdeed safey al, gven ha safey s bul n a he level f he nelkng and ATP funns. Hweve, he ATS funn s a neve ene beause f s enal sn n elan eas desns and ans, eseally n degaded suans whee ea nevenn s equed. Indeed, he analyss f sme alway adens has shwn ha nsequenes wuld have been fa less sevee f eas had efmed aae las hane evey ans (bu hey dd n d s hugh lak f nfman, lak f me, e.) F hs easn, a een endeny has been assgn mden ATS subsysems a nn-ze Safey Inegy Level (SIL s a measue f he degee f nfdene n he safey f a funn, level 0 ndang n safey nsan a all, and 19

22 level 4 beng he maxmum value). In hs eseve, he am f u aah s evaluae he ma f he ATS subsysem n he glbal safey f a alway sysem. Tehnal mnens havng aaned a hgh safey level, aenn shuld nw be fused n he evaluan f human-mahne neans and he ma n safey. Ths aah eques ean beween alway engnees (f he ehnal mnen), human and sal senss (f he human and ganzanal mnen) and safey engnees (f he synhess and he glbal evaluan f he safey level.) T llusae he nees f a sysem aah n hs nedslnay nex, we nw esen a ase sudy usng FRAM as a mlemen lassal safey analyss f a sena nvlvng he lkng f a swh f he en f manenane agens n he ak. In hs examle neans beween eas, as well as neans beween eas and mahnes, have a sgnfan ma n safey Case sudy The en f manenane eams n sens f ak eques he lkng f swhes ha hewse mgh de ans wads he wkng zne. Any falue f he lkng ean uld be faal f he wkes nvlved. The lkng ean s efmed n llaban beween he head f manenane eam and he ATS ea. I eques a de nl f he nelkng funn (he ula safe funn makng mssble se nflng ues), whh s n sak nas he usual mde f ean, gven ha ms exeuable nls ae nmally fleed by he nelkng and ATP funns (an unsafe mmand ssued by an ATS funn wll smly n be exeued). Hee he mmand s dely ansmed 20

23 safey nsallans, whu valdan by anhe ula safe funn. F hs easn safey engnees have u n lae a safey edue alled Hgh Inegy Level Cmmands (HILC). Ths edue s a sequene f safey elaed mmunans beween ATS mue sysems n OCCs and he en sysem whh nls he swhes (nelkng). An e deen de based n a Cyl Redundany Chek (CRC) ensues he negy f dgal daa exhanges beween mues. The ea s blged use a duble mmand mehansm whh es agans unnennal mmands. The HILC sequene f lkng a swh akes lae as fllws (see Fgue 5): Sequene Dagam: Hgh Inegy Level Cnl Manenane O. ATS ea Inelkng & ATP Swh Reques f en (swh ID) Peaan eques Pe. aknwledgmen { < 15s} Cnfman eques Cnl Saus wk aea auhsan Fgue 5: Hgh Inegy Level Cmmands 1. The manenane ea n he ak lks f he denfan numbe f he swh lk and asks f en fm he ATS ea; 21

24 2. The ATS ea sends a eaay eques he en sysem; 3. The en sysem (nl / mnng f he nelkng funn) sends an aknwledgemen f hs eaay eques ATS; 4. Afe makng sue ha he eeved aknwledgemen esnds he eques, he ATS ea valdaes he eques by sendng a nfman eques; 5. The en sysem ensues he valdy f he message by hekng he heene beween he CRCs f he w messages eeved fm ATS, efms he lkng f he e swh, and hen sends an aknwledgemen ATS ndang he saus f he swh ean; 6. Fnally, he ATS ea heks va a vsual dslay ha he swh s lked, and nfms hs fa he manenane ea n he feld Safey Analyss Classal safey analyss The enal f adens s lnked he delay ndued by he ATS ea when seekng dee unmleed eneus HILCs. Safey engnees buld faul ees based n funnal analyss f eah enal aden, havng evusly denfed enal hazads. Ths analyal ehnque s based n a lnea aden mdel n a dsee sae sae f he sysem. The faul ee analyss f a enal falue f swh lkng aden s shwn n Fgue 6. Reangles eesen funn falue evens. Lgal gaes ndae he njunn dsjunn f lwe level falues esulng n a gven ue level falue. Cles ndae ha he even wll n be fuhe demsed and ha a gven uene ae an be abued 22

25 Penal aden: "wkes n eed by lked swh" Swh n lked Wng swh lked Unned undne HILC FH Pedue n bseved by ATS ea FH Unned wng HILC FH Wng denfan f swh n ATS FH Pedue n bseved by ea n ak Swh mvemen bably FH Swh mvemen bably Fgue 6: Faul Tee f Penal aden by falue f swh lkng. Inveed angles, n he he hand, mean ha he even s demsed n he elemenay evens shwn n anhe faul ee. F a bee eadably, he label FH denfes evens ha ae due human fas. Pbably values f ees f ehnal hadwae ae deemned based n sudes f he behav f sef mnens, n exeene feedbak usng daa fm sules. Pbables f falue f ans by eas ae geneally aken fm he human elably leaue, f examle, wk by Swan [39] and Rasmussen [40]. The lkelhd ha an ea des n ese a edue wll deend n nexual fas nludng exeene and anng, and hese ae aken n aun. Tyally, f an adequaely aned ea efmng a habual avy, a falue bably f

26 wll be used. The esul f hs mehd aled he ase f an HILC swh lkng a manenane zne shws ha a enal f aden uld ase fm he jn falue f a leas hee eans, wh a falue bably f less han 10 3 f eah ean. Wkng Blk lan eques f Swh feld's ID. H - T T eques f en F 1 >> H - T T eae HILC F 3 X msg. eaan HMI ATS Swh ATS's ID. sn n MMI T T valdae he eaan msg. F 4 aknwledge eaan 15s - (-) >> H - T CRC nl msg. nfman T mmand swh blkng T F 6 msg. md T T T blk swh F 7 Swh blked Swh blked Wkng lan H T wk n aks F 10 Sgns n aks Cmmunan Swh feld's ID. >> H - T T denfy, memse Swh ID. F 2 X HMI ATS Swh ATS's ID. X Wng HMI sn Swh feld's ID. Swh ATS's ID. T nfm HILC F 5 HMI ATS Swh ATS'S ID. sn n HMI T Aknwledge swh blked F 8 Swh's sae udaed n HMI Wkng lan >> H - T T Auhse wk n ak F 9 X Wk auhsan Fgue 7: Degaded FRAM newk Cmlemenay aah usng FRAM The FRAM newk f an HILC swh lkng a manenane zne s shwn n Fgue 4. The manenane ea, equesng en f a aula wkng sen, naes he edue. Tw ees f daa ae used by hs edue: he lkng eques and he denfan numbe f he nened swh. These w daa ae sen he ATS ea. In he fgue, hs s exessed by w funnal elans beween he manenane ea s avy and he ATS ea s avy, fs n denfyng he 24

27 e swh va he ATS nefae, and sendly n eang he HILC en. The edue manly equess ans by human eas. I s heefe ssble vsualze many senas, smly by mdfyng he vaably f efmane f he eanal uns efmed by he ATS ea. As an examle, Fgue 7 shws a sena n whh he ATS ea s efmane ndn, n elan he avalable me, s unsuable unedable. In he dagam hs me essue s eesened by he symbl (» ) nex he me abue f ans efmed by hs ea (he nan used n he examle desbed n [16]). Ths essue an be exlaned by he ugeny f he suan by an exessve numbe f bjeves ha he ea s aemng mee. Thus, he ea des n ely denfy he swh lk, he me essue beng gea ely exeue nl eans equesed f denfan va he ATS human-mahne nefae. Ths s eesened by he ss nex he nnes f he funn, whh s deenden n he swh denfan avy. The negave ma assaed wh he me essue ess he endn f he ea s nex avy, whh means ha he w aknwledgemens sen by he nl-mmand en sysem ae n heked, and he swh lkng s n nfmed he manenane ea. The ume s ha an HILC f lkng a swh has been exeued, bu f he wng swh, and s he manenane eas ae n eed. FRAM enables faul ee evens be analyzed vey hughly. The examle jus desbed allwed a deee analyss f he human auses f he wng swh lked even han s ssble n lassal faul ee analyss 25

28 (see Fgue 6). The man nbun f FRAM s ha hghlghs mlex neans ha ase n he s-ehnal sysem and whh vde he bgges lues n denfyng he enene f he senas Inedslnay Sudy Ohe senas an be desbed usng a smla mdel. Ths knd f mdel s uenly used as a mmn su beween safey sealss and human and sal senss sealzng n gnve egnms. T albae he mdel (.e. denfy he enal vaably f eah funnal un) s ssble use feedbak daa fm aual exeene, as well as he esuls f exemens efmed n he labay. Ths aah wll be llusaed by a send ase sudy nenng alway aff suevsn f an OCC s ATS funns. The am f hs avy s mn aff usng nfman vded by he ATS human-mahne nefae, dee any ndens (eseally hse wh an ma n safey), dagnse hem and efm aae evey ans. The FRAM newk sed f hs avy s shwn n Fgue 8. The dffeen eanal uns ae he mnng saegy f he Shema Cnl Panel (SCP) whh vdes he glbal vevew f he aff, aff mnng, nden deen, nden dagnss, seleng a evey an, and fnally he an self. The FRAM newk hghlghs he lnks beween hese funnal uns whh an geneae he Funnal Resnanes. Fgue 8 shws he nmal suan whee bas nu-uu deendenes beween funnal uns ae bvus. Ne he me deendeny f he deen avy n he mnng saegy. Ths lnk ndaes ha he me needed dee an nden deends n he saegy hsen f mnng. T 26

29 albae hs mdel, an exemenal ATS lafm alled Sa-al was nsalled n he Heudasy Labay a Cmègne Unvesy f Tehnlgy [41]. Ths lafm s used as a su f sudyng he behav f ATS eas. Usng smulaed alway aff, he lafm an edue he man ases f OCC aves. On he ne hand he FRAM analyss les eseahes nsde vaus hyheses egadng eas efmane ndns and hw hese mgh ma safey, and n he he hand an synhesze esuls n senas f use n lassal safey analyss. These senas may hen be valdaed by exemens efmed usng he Sa-al lafm. A fs sees f exemens was ndued, amng valdae an exemenal l and albae he FRAM analyss. H Mnng Saegy f he Shema Cnl Panel H Che f a evey an H, T H H Inden Deen Inden deeed Inden Dagns H, T, O Taff Mnng An HMI Fgue 8: FRAM newk f nden deen and evey 27

30 5.5. Exemens sa-al lafm Sa-al s based n a eal Auma Tan Suevsn (as) du develed by Alsm Tans. The ATS sysem s nneed he nelkng sysem and he Auma Tan Cnl (ATC) sysem (ha nludes Auma Tan Oean and Auma Tan Pen; see [42] f dealed desns f hese sysems). The ATS efms a bad ange f aff suevsy funns, fm saff and llng sk managemen he mnng and nl f sgnalng and ue seng. Sgnalng and ue seng, nensvely aumaed ve he las deade, eman safey al eans when degaded umsanes u [43]. Inelkng and ATC ae smulaed n sa-al by he aff smula sysem develed by Alsm Tans f valdang and esng ATS jes. The aff smula smulaes alway aff eans hugh he use f a sng language. The ATS nfguan delveed by Alsm f he Sa-al lafm s he lne f a een je. The lne suevsed s weny-ne klmees lng, wh w aks (ne f eah den f avel n nmnal ean) and a sububan aff fle. I nludes a banhng lne, mmeal sans and seveal ses f nelne ns (allwng emay sngle-ak ean n ase f falue, whh nludes falues affeng a aula zne n ne ak). Ths ak lan s a yal sububan alway lne eang hmgeneus ans (same seed, same sze, same wegh). Ths knd f aff s geneally egulaed by he fequeny neval beween ans (a egulan ly emed nsan headway amng manan as egula an neval 28

31 (same seed, same sze, same wegh). Ths knd f aff s geneally egulaed by he fequeny neval beween ans (named "nsan headway"). In de genealse u exemens man alway lnes, we ndued a new equmen allwng egulae he aff n me and n sae, ndeed seveal knds f ans (dffeen seed, sze and wegh) uld be egulaed. Ths equmen nludes w sulemenay aks ha allw lw seed ans be veaken by fas ans. We develed n llaban wh ALSTOM he neessay engneeng asks n he ATS and he aff smula ban hs equmen. The smlfed vew f he ak lan s esened n fgue 1. ~ 21 KM Tak 1 aks San San San San San Tak 2 Bfuan De Fgue 1: SPICA-RAIL ak lan Fgue 9: sa-al ak lan The Man Mahne Inefae s msed f w elemens. Thee s a geneal mms dslay alled Shema Cnl Dslay SCP ha an be seen fm evey as ssble beween suessve ans). In de genealze u exemens ea n OCC. The send elemen esnds he ea s mue ha esens seveal vews f he alway ak lan. Fgue 2 shws he SPICA-RAIL man alway lnes (eaed wh dffeen yes f ans wh dffeen lafm and he geneal MMI f he ak lan. seeds, szes and weghs, makng essenal f ans be able veake 3.2 Exemenal l ne anhe), he nal Sa-al newk nfguan was mdfed by Thee vlunay nves assmlaed ATS ea n fman aaed he addn he exemens. f assng Eahaks f hema was a fmed aula and aned san. hethe deen egulan f heely yes f ndens : f hs send knd f newk s emed me shedule (amng manan he shedule f eah an as lsely as ssble). A smlfed vew f he mdfed ak lan s vded n Fgue 9. The human-mahne nefae s msed f w elemens. The fs s a geneal MIMIC dslay knwn as he Shema Cnl Panel (SCP) ha an be seen by evey ea n he OCC. The send elemen esnds ea wksans ( suevsn mues ) whh gve dffeen vews f he alway ak lan. Fgue 10 shws he sa-al lafm and he geneal HMI f he ak vevew. Fgue 11 shws he sef sgnalng elemens f he SCP. 29

32 Fgue 5#" $%&'(%'&)" *)" +," +-./)" %)++)" 0'1)++)" )2%" &)3&42)/%4)" *,/2" +1-/%)&5,()"*167896$:#";)2"5+<(=)2"*)"(>'+)'&">/%"4%4"&,?>'%4)2"-(-" 3>'&" -/*-0')&" +)" 2)/2" *)" (-&('+,%->/" *)2" %&,-/2#";)2" 3,&%-)2".&-24)2" 3,&%-)2" *)" +," +-./)" 0'-" /1>/%" 3,2" 4%4" -A3+4A)/%4)2"2'&"+,"3+,%)5>&A)#" " HMI SCP Taff smulas Suevsn mues nn eanal zne dung exemen Fgue 2: SPICA-RAIL lafm Fgue 10: sa-al lafm Fgue 6#"B')"*)"+1-/%)&5,()"*167896$:",C)("&)3&42)/%,%->/"D3>'&" +)2" E)2>-/2" *)" *)2" G>/)2" />/" '%-+-24)2" 3)/*,/%" DG>/)2" =,(='&4)2F#" ;)2" G>/)2" =,(='&4)2" &>'.)2" G>/)2" />/" -A3+4A)/%4)2" 2'&" +," 3+,%)5>&A)"H" +," G>/)"=,(='&4)"E+)')"(>&&)23>/*"I"+,"5)/J%&)"*1,+,&A)2#" Swh n unnlled. Ths blem mes fm he sn sens ha Exemenal l ann ndae he eal sn f he n. Thus, he sgnal eng hs The n l ges was abslue defned s. Ths n de nden s n evaluae safey al he efmane bu, mles f he seus dsubanes n he aff and sesses he avy ; gahal Sgnal vewfaled ha en. exss Ths nden vde s n useful safeynfman al bu, as he he eeden human eas. Dung Sgnal faled evaluan lse. he Thsnegaed nden safey alamal, sysem has was hedsnneed same n- fm sesses seusly he aff ; sequenes ha a sgnal assed a dange. I s hus f me mane he ATS. dee hs defaul n de nsue safey. Fu vaables have been ndued n he l, n de evaluae he mnng Thee exemenal efmane nsubjes dffeen aff (s-dal suevsn nfguans. sudens n mue sene The ye f nden s he fs vaable, beause hee ae me ndes n he assumng he le f ATS eas undegng anng) aaed n he MMI f an unnlled swh n, we assume ha he me deen wuld be exemens. lwe f hs ye Ffaal nden han easns, he ase f sgnal was falue. n ssble efm exemens he sessns, wh me eah senas subjes was beause 30 mnues f lng. he nsdeable We assume haamun he deen f daa and The me f he nden uene s he send vaable. In de smlfy wuld be fase a he begnnng f he sessn. vdes Thehd ess. vaableths nens wll hebe esene dne n f subsequen a an aundwk. he nden. Hweve, We sgnfan f he esuls assume ha human ea fus hs aenn edally n dynam elemens MMI. Cnsequenly, wee baned. he deen P shuld he exemen, be lwe when ans eahulae f hemnea was aned he nden. suevse nmnal suans and dee hee eesenave yes f Rues ae ees f ak whee ans ae auhsed ulae. Thee s w ndens: way ae a ue fm ATS. The emanen way aes he ue nly ne, and ans d n lea he ue afe ssng. The auma desun way ae he Unnlled ns. Ths blem an ase fm a falue f he sn sens ha endes unable ndae he uen sn f he ns. The sgnal eng he ns heefe emans blked 30

33 Sgnal s geen (en) Sgnal s ed (lsed) Befe nden (nmnal suan) Dung nden (swh n unnlled) Fgue 11: sa-al sgnalng elemens a abslue s. Ths nden s n safey al, bu enals seus dsubanes he aff, and hles avy as a esul f degaded eang mdes suh as emay sngle ak. Fgue 11 llusaes senas whee an unnlled ns nden us n he HMI; Sgnal faled en. Ths mgh be a nsequene f he evus ye f nden, bu an als ase u f falues f he sgnal self f deves nllng (n he lae ase hee ae fewe vsble symms hel dagnse he nal ause f he nden). Ths nden s n safey al, bu lke he evus ye f nden an seusly ma newk aff; Sgnal faled lse. Ths s f use a safey-al nden, whse nsequenes, nludng llsns and dealmens, ae enally aash. A ssble ause wuld be a falue n he nl-mmand deves whh, alhugh hghly mbable (beause f a fal safe desgn), s neveheless magnable. Gven he ease wh whh hs vey 31

34 exenal suan an be smulaed usng he exemenal lafm, was judged neesng nlude n he exemenal l (an adaed ean n he a f eas havng he enal edue damaally he sevey f nsequenes). Fu ndeenden vaables (.e., unde he exemene s nl) wee nluded n he l n de evaluae he mnng effeny f he exemenal subjes n dffeen aff suevsn nfguans. The deenden vaable (.e. he vaable vdng an assessmen f subjes efmane) was he nden deen me (n sends). Usng he FRAM analyss, hyheses wee fmulaed egadng he nfluene f eah f hese aamees, and he exemenal sessns amed valdae ( nvaldae) hese hyheses. The fs vaable was he ye f nden (unnlled ns vs. sgnal falue). Beause unnlled ns geneae me ndes n he HMI, he hyhess f hs vaable was ha deen me wuld be lwe f hs ye f nden han f he w ases f sgnal falue. I was als exeed ha a sgnal falng lse wuld be me effenly deeed han a sgnal falng en, beause f he seusness f enal nsequenes n he fme ase; The send vaable was he me a whh he nden ued n elan he duan f he suevsn sessn (.e. ealy lae n he sessn). F he uses f smlfan eah sena was 30 mnues lng. The hyhess egadng hs vaable was ha deen wuld be fase a he begnnng f he sessn, beause f he mnny 32

35 assaed wh a lng ed f nmnal ean; The hd vaable, deendeny, esnded he esene absene f a ausal elan beween he nden and subsequen an behav (n deendeny meanng ha he nden had n ma n ans, and deendeny ha he nden aused a an s). F hs vaable, he hyhess was ha human eas wuld edally fus he aenn n dynam elemens f he HMI. Cnsequenly, deen shuld be ease when ans wee ulang n he vny f he nden; The fuh vaable was he ye f seng f he ue affeed by he nden (emanen vs. nn emanen). Rues ae ak sens (geneally beween w ses f ns) whee ans ae auhzed ulae. Thee ae w ways f seng a ue n ATS: a emanen ue s se ne and n leaed by a an unnng alng hs ue (s emanng se f he nex an) wheeas an auma desun ue s sefally se f ne an and leaed afe he an has un alng he ue. Rues unnng hugh sans ae geneally se n emanen mde, whle he auma desun seng s used f ues gng assng aks (laes whee anhe an may veake). Beause hee ae me gahal ndes n ases f equmen falue n emanen ues, he hyhess f hs vaable was ha deen mes shuld be she f emanen ues. Amng he weny-fu ssble yes f sena (esndng he numbe f mbnans f values f he fu vaables) weny uld be 33

36 mlemened n he lafm. F eah ne, a sef sena was eaed. Ten dsan senas wee als ndued n de even subjes makng nfeenes abu sequenes f dffeen yes f ndens. The mlee sessn f 30 senas was efmed f eah f he hee exemenal subjes, wh wee asked ndae and exlan ally eah falue as sn as hey deeed. In addn he deen me and numbe f e/ne deens (.e., deenden vaables), subjes ans and vebalzans wee vde-eded Resuls Ten hus f eded vde e subje wee lleed. The gea majy f equmen falues wee deeed. The aes f nn-deen and false deen wee abu 1/30 f eah subje. Gven ha he subjes had nly jus been naed n alway suevsn, hese esuls shw ha he anng eeved was effeve. Beause f hgh ne- and na-subje vaably and he esene f exeme values, means and vaanes uld n be used. A sasal analyss was heefe efmed usng medans and anges. The medan deen me (T D ) was 11, 94s wh a ange f 299s. Analyss f deen mes based n es senas eveal a hgh vaably beween subjes. Medans and anges f he hee subjes ae esened n Table 2. I mgh fs be emaked ha deen mes ae elavely hgh, nsdeng he favable exemenal envnmen maed he eal envnmen: Subjes knw ha hee s ne falue be deeed n eah sena (hs s n he ase n eal suans); 34

37 Subje T D medan (se.) Range 1 5, ,42 160,9 3 11,57 298,96 Table 2: Deen mes: Medans and anges Thee ae nly hee ssble yes f falue. In eal suans hee wll be a geae vaey f ssble evens; The duan f senas was vey sh (30 mn) maed he 6-hu shfs undeaken by eal OCC eas; Falue deen was he nly ask be efmed, wheeas n ATS seveal aves may be efmed n aallel (f examle, he manual seng f sme ues); The ak lan was edued a sh zne wh a sngle banhng. Sendly, wll be bseved ha subje numbe w aeas neably less effen (n ems f he deen me f ndens) han he w he subjes. 60% f subje numbe w s deen mes exeed 20 s. The ae s nly 20% f subjes ne and hee. Ths esuls suggess ha deen me s hghly deenden n he saegy used by eas exle he hm and ha hs saegy s n he same fm ne ndvdual anhe. Meve, he falue nfman gven by hm ae n suffenly skng be eeved n he same manne by all subjes. In de nfm he sgnfane f hs dffeene, sasal ess wee efmed n he ugh esuls. 35

38 The daa lleed des n sasfy nmaly and hmgeney ndns, and nsequenly he sasal sgnfane f evey masn beween mdales f subjes and vaables was evaluaed usng nn-aame esndeenden bsevans. The sgnfane heshld was fxed a α = 0, 05 f eah masn. The Mann-Wney es f ndeenden gus was used mae subjes. Ths sas akes aun f he al numbe f bsevans made by he fs subje ha ae geae han bsevans made by he send. Table 3 shws he -values, ha eesen he bables f false ejens n he null hyhess ha he w samles ae denal. Subjes H 0 : TD 1 = T D 2 Subje 1 - Subje 2 0,00041 Sgnfan Subje 1 - Subje 3 0,21 Nn sgnfan Subje 2 - Subje 3 0,03 Sgnfan Table 3: Cmasn beween subjes: Mann-Wney, α = 0.05 Ths esul nfms ha deen mes f subje numbe 2 ae ndeed sgnfanly dffeen fm he w hes. In de evaluae he ma f he aff nfguan vaables n he deen mes, he Wlxn sgned-ank es f aed masns was used. Ths es s usually used f w elaed samles eeaed measuemens n a sngle samle. I nvlves masns f dffeenes beween measuemens. Unexeedly, nly ne masn eahed sgnfane. Samle sze seems be esnsble f hs lak f sgnfane. Neveheless, a nnaame aed ank es suh as he Wlxn es may be aled 36

39 hese daa. In evey ase he numbe f as s geae han 8. Ths knd f es uld, meve, gve esuls f fewe as [44]. Hweve, he effe f he deendeny vaable denng he esene f ans n he vny f he nden dued a sgnfan esul. I was assumed ha he deen me wuld be lwe when a an was neaby. In fa, he Wlxn sas eveals he se effe, and wh sgnfane. Ths esul s que susng. I seems easnable suse ha he saegy used by he human ea wuld be fllw edally he mvemens f ans. Cmlemenay nvesgans shuld be efmed shed fuhe lgh n hs effe Analyss The efmane ndns nvesgaed n hs fs sees f exemens nened me essue. The me aken by eas dee abnmal evens was measued. The fs esuls sugges ha n a smlfed smulan envnmen whee he deen f abnmal suans aguably esens fewe hallenges han n he eal wld, sme subjes neveheless fal dee hese abnmal suans a all qukly. Plaed n he famewk f FRAM, hese fs elemens enable an de f magnude be assgned eas efmane n a aula nex. Exemenal esuls als nfm dffeenes beween saeges emlyed by human eas, usng he human-mahne nefae unde nvesgan, dee equmen falues mang aff safey. Clealy, n all eas use he same saegy, whh eaes a wde sead f vayng efmanes. The easns f hese dffeenes need be exled hugh a me dealed analyss f eas behav. 37

40 Hweve, meely knwng ha hee s a dsesn f mnng saeges whh mas nden deen enables us denfy a enal sena f nadequae desn as a nsequene f a funnal esnane henmenn. Fgue 12 llusaes suh a sena, and shw hw hgh vaably agaes whn he FRAM newk mdelng ea s avy. An nadequae mnng saegy leads lae nden deen, whh n un leads me essue n he dagns eanal un. In nmnal suans hs eanal un makes adequae desns (n blems f dagnss ame lgh dung u exemenal sessns) bu n he suans me essue uld lead ne hes f evey ans, eseally whee a suan s safey-al and whee hee s lle me avalable ave an mendng aden. An naae evey an means ha he ATS ea mgh n sueed n edung he gavy f an aden. Mnng Saegy f he Shema Cnl Panel H X nadequae saegy H, T Tme deen hgh >> H Gea huy Sgnal faled lse >> H Che f a evey an X Revey nmable H Inden Deen Inden deeed Inden Dagns Gea huy >> H, T, O N evey Taff Mnng An X HMI Fgue 12: FRAM sena mdel f nden deen and evey 38

41 Ohe exemenal sees wll heefe be efmed usng he Saal lafm and he sandad mdel esened n hs ae, usng als ulmees ed eas eye mvemens. Resuls baned shuld hel lafy he easns f he dsesn f efmanes, and ssbly denfy new adenal senas Psals f egnm enhanemens The exemenal esuls esened abve hghlgh he mane f ATS nefaes n he effen deen f ndens and, lke ean evus sudes [45, 46, 47], sugges ha ATS nefaes uld be bee adaed ea s needs han hey uenly ae. Amed wh he esuls f he esen sudy and wh eseah fndngs n he leaue, a sef wkng gu was heefe nsued by Alsm daw whaeve nlusns may be dawn and ugh u sme sals f egnm equemens f ATS HMI ha mgh enhane he efmane f he jn ATS-ea sysem [34]. These sals ae lsed belw: T edue he numbe f gahal elemens wha s eally needed by he eas: F any safey-elaed eanal suan, he HMI shuld dslay jus enugh (.e. neessay and suffen [48]) nfman enable a safe suan be mananed eveed. T muh nfman makes he man nfman less salen and neases he ea s gnve lad [46]; 39

42 F he eans, he HMI shuld shw nly nfman equed anae fuue evens: In nmnal suans (auma mde), he ATS HMI shuld allw he ea anae degaded mdes (n eals suans eas efe ad an anave han a eave mde [46]); In degaded suans (manual mde: eans ae efmed by he ea): The ATS HMI shuld allw he ea ed wha mgh haen f n an s efmed; The ATS HMI shuld allw he ea anae he esul f any an (f examle, he esul f a "anel ue an wll s a sef an a a sgnal whn x sends and begn dsu egula aff whn y sends); Analgue eesenans shuld be efeed dgal dslays: dgal nfman need be mued/neeed by he ATS ea, wheeas analgue nfman vdes a me nuve eesenan. Meve, analgue eesenans enable he use f vaus eeved affdanes [49]; The HMI dynams shuld be adaed n eal me menal avy equed by he eas (he desn ess s nnuus and needs be lnked he dynam suan [48]); The esnse me f he suevsed equmen n he feld shuld be 40

43 eal-me nsaned and efed (esnse me s a ual aamee n dynam suan suevsn [50, 51]); Oeas shuld a all mes knw whh nl sysems ae aang he Safey Inegy Level. In aula, eas shall n have ve-nfdene n sysem safey; In ase f smulaneus ndens, he HMI shuld fus he aenn f he eas n he ms sevee safey-al even, suh as sgnal faled lse sgnal assed a dange. The eas aenn shuld be dawn he sef a f he nefae whee he even has ued hugh he ad f a sef vsual alam, nsead f va a exual alam n he geneal nefae whu a ese lan. These sals need be esed n exemenal, smulaed eals suans befe beng aded as gudelnes f fuue ATS sysems. 6. Cnlusn The nees f a sysem aah s ffe a mlemenay exhange su beween sk managemen and human and ganzanal fas. Indeed, analyss f adens nvlvng human and ganzanal fas lealy demnsae ha mehds usng a sequenal aden mdel ae n suffen. In hs eseve, he FRAM mehd enables exemenal esuls fm gnve syhlgy and fm lassal safey analyss be negaed usng he same fmalsm. Used as a mlemen lassal safey analyss, he FRAM mehd exles he ma f human and ganzanal fas me hughly han a smle allan f e bables s able 41

44 aheve. Meve, a dynam eesenan f he sysem usng qualave abues an denfy new senas f ndens adens, and hese an be analyzed va new hyheses ha an be esed n he feld n a smulaed envnmen. Wheeas lassal safey analyss mehds shw elemens ha ae gng wng, FRAM als allw he exeun f funns aves ha ae efmng ely [16]. T hs exen, lassal mehds and FRAM analyss ae mlemenay, and he mbned use n a sysem aah s a se wads a bee undesandng he avy f eal eas, akng n aun syhlgal and egnm fas. In hs eseve, a fuful mvemen f FRAM mehd wuld be nlude quanave ases allwng he elave lkelhd f he dffeen senas be esmaed usng belef funns. Ths s he subje f subsequen wk amng a assgnng lkelhds eah funnal un nu and agang hem n he FRAM newk. The sysem aah used n hs esen sudy has aleady vded fuful esuls n aenau and ndusal suevsn suans, and me eenly n alway aff nl [46]. The esuls esened n he esen ae nfm he enene f hs aah f a bee undesandng f he deemnng aamees f a mlex s-ehnal sysem suh a alway Oeang and Cnl Cene. They shw ha even when gven denal anng, dffeen eas d n use he same mnng saegy, and he nsequene s a vey hgh vaably n he me aken dee ndens (vaably n saeges used by eas nl alway aff has aleady been bseved n nauals and smulan-based sudes; see f nsane [52] and [47]). These saeges shuld be desbed n me 42

45 deals, and hs s he subje f a sudy n gess, bu f he mmen he key n s mve he egnms f he ATS nefae n de edue hs vaably. Sme sals by a sef wkng gu have been esened n hs ae, and he effeny wll be esed n fuue exemenal sessns. The deemnng fa s vde he ea wh jus enugh nfman f a lea undesandng he esen suan and f anang he mmedae fuue. Ths ges hugh an adaed e-dagns efmed by auma sysems, he fnal dagns always emanng, a leas n degaded suans, a human egave. In a bade eseve, wll be neessay n he fuue defne and desgn he gh level f ean beween me and me aumaed mahnes and human eas [53, 54]. Refeenes [1] R. E. Balw, F. Pshan, Mahemaal hey f elably, Wley, New Yk, [2] A. Vllemeu, Relably, avalably, mananably, and safey assessmen, J. Wley, Chhese, [3] IEC, 61508:1998 and 2000, a 1 7. Funnal Safey f Eleal, Elen and Pgammable Elen Sysems., [4] CENELEC, EN-50126: Alan fevaes - Séfan e démnsan de Fablé, Dsnblé, Manenablé e Séué (FMDS), Nme, CENELEC,

46 [5] CENELEC, EN-50128: Alans fevaes - Sysème de sgnalsan, de élémmunan e de aemen - Lgels u sysèmes de mmande e de en fevae, Nme, CENELEC, [6] CENELEC, EN-50129: Alan fevaes - Sysème de sgnalsan, de élémmunan e de aemen - Sysèmes élenques elafs à la séué u la sgnalsan, Nme, CENELEC, [7] N. Wene, Cybenes, Send Edn: he Cnl and Cmmunan n he Anmal and he Mahne, The MIT Pess, [8] E. M. Dughey, Human elably analyss - whee shulds hu un?, Relably Engneeng & Sysem Safey 29 (1990) [9] E. Hllnagel, Cgnve elably and e analyss mehd, Elseve Sene Ld, Oxfd, [10] E. M. Dughey, Is human falue a shas ess?, Relably Engneeng & Sysem Safey 55 (1997) [11] P. Le B, Human elably daa, human e and aden mdels llusan hugh he hee mle sland aden analyss, Relably Engneeng & Sysem Safey 83 (2004) [12] A. Isaa, S. T. Shk, B. Kwan, Human e n euean a aff managemen: he hea je, Relably Engneeng & Sysem Safey 75 (2002) [13] C. Bede, Les faeus humans dans la gesn des sques, évlun de la ensée e des uls, Hemès, Pas,

47 [14] I. S. Km, Human elably analyss n he man-mahne nefae desgn evew, Annals f Nulea Enegy 28 (2001) [15] J.-M. H, Human and auman: A mae f ean, n: HUMAN 07, Tmmun, Algea. [16] E. Hllnagel, Bae analyss and aden evenn, Aldesh, UK: Ashgae, [17] F. Belmne, Ima des ses enaux de suevsn de af fevae su la séué, Ph.D. hess, Unvesé de Tehnlge de Cmègne, [18] N. Lmns, Abes de défallanes, deuxème édn evue e augmenée, Hemès Sene, Lavse, [19] N. Levesn, A new aden mdel f engneeng safe sysems, Safey Sene 42 (2004) [20] K. Vene, Cgnve engneeng eseah a s fm , n: E. Salas (Ed.), Advanes n Human Pefmane and Cgnve Engneeng Reseah, vlume 1, Elseve, New Yk, 2001, [21] E. Hllnagel, D. Wds, Cgnve sysems engneeng: New wne n new bles, Inenanal Junal f Man-Mahne Sudes 18 (1983) [22] D. A. Nman, Cgnve engneeng, n: D. A. Nman, S. W.Dae (Eds.), Use eneed desgn: New eseves n Human-Cmue 45

48 Inean, Lawene Elbaum Assaes, Hllsdale, NJ, USA, 1986, [23] D. D. Wds, E. M. Rh, Cgnve engneeng: Human blem slvng wh ls, Human Fas 30 (1988) [24] M. R. Endsley, R. Hffman, D. Kabe, E. Rh, Cgnve engneeng and desn makng: An vevew and fuue use, Junal f Cgnve Engneeng and Desn Makng 1 (2007) [25] L. G. Mlell, C. O. Dmngez, G. Lnen, G. Klen, The le f gnve sysems engneeng n he sysems engneeng desgn ess, Sysems Engneeng (2009) [26] J.-M. H, F. Dases, Indun, n: J.-M. H, F. Dases (Eds.), Psyhlge egnmque : endanes auelles, Pesses Unvesaes de Fane, Pas, 2004, [27] M. D. Byne, Cgnve aheue, n: A. Seas, J. Jak (Eds.), The human mue nean handbk: Fundamenals evlvng ehnlges and emegng alans (2nd ed), CRC Pess, Ba Ran, FL, USA, 2008, [28] R. W. P, K.-P. L. Vu, Human nfman essng: An vevew f human-mue nean, n: A. Seas, J. Jak (Eds.), The human mue nean handbk: Fundamenals evlvng ehnlges and emegng alans (2nd ed), CRC Pess, Ba Ran, FL, USA, 2008,

49 [29] E. Hllnagel, D. Wds, N. Levesn, Reslene Engneeng: Cnes and ees, Ashgae, Aldesh, [30] J. Reasn, Human E, Cambdge Unvesy Pess, [31] D. D. Wds, On akng human efmane seusly n sk analyss: Cmmens n dughey, Relably Engneeng & Sysem Safey 29 (1990) [32] C. W. Jhnsn, Falue n safey-al sysems: A handbk f aden and nden eng, Unvesy f Glasgw Pess, Glasgw, Sland, [33] D. D. Wds, E. M. Rh, K. B. Benne, Exlans n jn humanmahne gnve sysems, n: S. P. Rbesn, W. W. Zahay, J. B. Blak (Eds.), Cgnn, mung, and ean, Ablex Publshng C., Nwd, NJ, USA, 1990, [34] D. Wds, E. Hllnagel, Jn Cgnve Sysems, CRC Pess, In., Ba Ran, FL, USA, [35] E. Hllnagel, Deendably f jn human-mue sysems, n: SAFECOMP 02: Peedngs f he 21s Inenanal Cnfeene n Cmue Safey, Relably and Seuy, Snge-Velag, Lndn, UK, 2002, [36] E. Hllnagel, D. Wds, Jn Cgnve Sysems: Fundans f Cgnve Sysems Engneeng, CRC Pess,

50 [37] B. Jhanssn, Jn nl n dynam suans, Ph.D. hess, Lnköngs unvese, Insue f Tehnly, [38] L. Banbdge, Ines f auman, Aumaa vl. 19 (1983) [39] A.-D. Swan, G. H-E., Handbk n Human Relably Analyss wh Emhass n Nulea Pwe Plan Alan, Tehnal Re NUREG/CR-1278, USNRC, [40] J. Rasmussen, Sklls, ules, knwledge; sgnals, sgns, and symbls, and he dsnns n human efmane mdels, IEEE Tansans n Sysems, Man and Cybenes 13 (1983) [41] F. Belmne, W. Shön, J. Bulange, K. Bekan, Ralway aff suevsn eseah gam : Sa al lafm, n: EURNEX-ZEL, 14h nenanal symsum "Twad he meve al sysems n eue", Zlna, Re. Slvaque (EU). [42] F. Belmne, K. Bekan, J. Bulange, W. Shön, Safey enhanemen f alway aff by mden suevsn sysems, n: WCRR (Ed.), Sevenh Wld Cngess n Ralway Reseah., Mneal (Canada). [43] F. Belmne, K. Bekan, J. Bulange, W. Shön, Takng n aun human fas n alway suevsn, n: I. S. S. A. (ISSA) (Ed.), Nnh Inenanal Symsum f he ISSA Reseah Sen: Desgn ess and human fas negan: msng magny efmane, Ne (Fane). 48

51 [44] S. Segel, N. Casellan, Nnaame sass f he behaval senes, MGaw-Hll, New Yk, [45] S. Djb, Analyse egnmque e gansannelle de la hage de aval des agens des ses de mmandes enalsés (PCC) à la RATP, Tehnal Re, Re Fenh PREDIT II eseah gam, [46] A. Kau, A human-mue nean aah an aff nl, Dssean f he degee f lenae f ehnlgy n mue sene, Usala Unvesy, Sueden, [47] C. Zanaell, Caaésan des saéges nsumenales de gesn d envnnemens dynamques : analyse de l avé de égulan du mé, Ph.D. hess, Thèse de da d egnme nn ublée. Pas : Unvesé Pas 8, [48] R. Amalbe, La ndue des sysèmes à sques, Pesses Unvesaes de Fane, Pas, [49] D. Nman, Affdanes, nvenns and desgn, Inean VI.3 (1999) [50] J.-M. H, Suevsn e nôle de essus : la gnn en suan dynamque, Pesses Unvesaes de Genble, Genble, [51] J.-M. H, R. Amalbe, J.-M. Celle, V. Gsjean, Adaan e gesn des sques en suan dynamque, n: Psyhlge egnmque : endanes auelles, Pesses Unvesaes de Fane, Pas, 2004,

52 [52] T. M. J. Len, Analyses f gnve esses n an aff nl, Egnms 36 (1993) [53] D. Len, W. Janssen, M. Neenx, K. Shebes, Human-fas engneeng f sma ans: Desn su f a dves and an aff nlles, Aled Egnms 37 (2006) [54] J. Wlsn, B. J. Ns, Ral human fas: Pas, esen and fuue, Aled Egnms 36 (2005)