In-flight upset - 154 km west of Learmonth, WA, 7 October 2008,

One type of automated safety assessment involves fully defining the failure logic ofeach component’s inputs and outputs, and then integrating the components into afull system model. The system model can then be used to automatically generatefault trees of the system (Papadopoulos et al. 2001).A second type of automated safety analysis involves using static analysis tools suchas ‘model checkers’ and ‘theorem provers’. This approach involves building amodel of the system with various failure modes included, and then applying thetools to the model to automatically generate a list of the failure modes which violatea specific, formally-defined requirement.In 2001 to 2003, a group of European aircraft manufacturers and researchinstitutions, including Airbus, conducted a project titled ‘Enhanced SafetyAssessment of Complex Systems’ (ESACS) to examine the utility of model-basedsafety analysis activities (Bozanno et al. 2003). ESACS was followed by anotherproject conducted by the same organisations, titled ‘Improvement of SafetyActivities on Aeronautical Complex Systems’ (ISAAC), to further expand the scopeand maturity of the methodology developed by ESACS (Akerland et al. 2006).Similar projects have also been facilitated by NASA (Joshi et al. 2006, Tribble et al.2004). 119Automated safety analysis projects have reported some promising results, and theyhave started being accepted as part of the basis for the certification of new systems(Akerland et al. 2006). However, there are still limitations with the approach. Forexample, it relies heavily on having an accurate model of the system and theenvironment in which it operates, and uses this model for all the associatedanalyses. As it is not computationally possible to fully model a complex system,analysts therefore need to make assumptions and decisions about what to include inthe model. Any limitations in the model will have an influence on all the derivedsafety analyses, and there is limited guidance available to date to best determinehow to ensure the system model is adequate (Lisagor et al. 2010).Lisagor et al. (2010) also noted that the outputs of some automated analyses can be‘unmanageably’ large and difficult to interpret, and that there are inherent dangerswith trying to understand the results as being equivalent to those from traditionalanalysis methods when they are actually based on quite different processes. Inaddition, the projects to date have focused on simpler types of failure modes, suchas discrete and permanent faults rather than transient or intermittent faults or thetiming-related aspects of faults (Lisagor et al. 2006; Tribble et al. 2004).Alternative methods of safety assessmentLeveson has proposed that traditional safety assessment techniques can be adaptedto some extent to handle new technology, they are not that well suited for thispurpose as they are based on an inappropriate model of accident causation whichfocuses primarily on hardware faults and failures. She has proposed a different typeof model derived from systems theory called ‘system-theoretic accident modellingand processes’ (STAMP) (Leveson 2004a, 2009a).119The NASA request for industry responses on the topic of ‘verification and validation offlight-critical systems’ (Graves and Jacobsen, 2010) contained many responses advocatingmodelling and formal methods.- 106 -