The eITUS Safety View is part of the Papyrus4Robotics toolchain and organised as follows:

• Failure Modes and Effects Analysis View (FMEA)
• Safety Requirements Table View
• Fault Injection View (specification of the fault injection experiments and a separate view to show simulation results/traces).

Authors	The eITUS consortium and coaching team. Tecnalia, Akeo, CEA
Website	Part of the Papyrus4Robotics Toolchain
License	https://projects.eclipse.org/license/epl-2.0
Screenshot

The fault injection view can be used together with the FMEA, FTA and safety requirements view to complement or verify those analyses. Regarding the fault injection view, the eITUS framework sets up, configures, executes and analyses the simulation results. Model-based design combined with a simulation-based fault injection technique and a virtual robot poses as a promising solution for an early safety assessment of robotics systems.

The safety engineer extends the nominal or fault free behaviour of the controller by introducing saboteurs in inputs/output ports of the design. This configuration process includes the definition of fault locations (Where to inject the fault?), fault injection times (When to trigger the fault?), fault durations (For how long the fault is present in the system?) and the fault model (How does the component fail?). The original system model is modified though the fault injector script according to the fault list.

The fault list is used to produce a faulty model only in terms of reproducible and prearranged fault models. All this allows to:

• exhaustively explore all possible behaviours of a system architecture with respect to some safety property of interest (e.g. the pre-defined safety requirement “The velocity of the Robot arm must not be greater than 0,25 m/s.”)
• simulate the behaviour of system architectures early in the development process to explore potential hazards.

Specification of the safety requirements and link to the addressed failure mode

Fault Injection View: Creation of the Fault List

Fault Injection View: List of Fault Models

Fault Injection View: configuration of a fault

The safety view can be used to:

• Create modular FMEAs, link them to the system model and define traceable safety requirements.
• Specify the fault-injection experiments
• Generate a Faulty version of the controller and run it in simulation.
• Visualize and analyse the resulting simulation traces to refine and validate the safety of the system.

Related to the Fault Tree Analysis View (FTA) available in the Papyrus4Robotics toolchain.

• eITUS Integrated Technical Project
• Showcase: https://robmosys.eu/wiki/community:safety-analysis:start