KR20200030990A - Method and apparatus for analyzing hazard of control system - Google Patents

Abstract

Disclosed is a hazard analysis device of a control system. The hazard analysis device comprises: a storage unit which stores a pre-defined first guide word and a pre-defined second guide word; and a processor which maps the pre-defined first guide word to a first use case in order to analyze hazard of the first use case of the control system, and based on the pre-defined first guide word, determines a hazard use case applied to the first use case as hazard, maps the pre-defined second guide word to at least one step in a sequence for the first use case in order to analyze hazard of the sequence for the first use case, and based on the pre-defined second guide word, determines a fail sequence applied to at least one operation of the sequence as hazard, and based on the determined hazard use case and the determined fail sequence, generates a second use case of the control system. Accordingly, the present invention provides a system development process based on SysML and a development process integrating analyzing activities of hazard such as PHL, PHA and the like.

Description

Method and apparatus for analyzing hazards of a control system {METHOD AND APPARATUS FOR ANALYZING HAZARD OF CONTROL SYSTEM}

The present invention relates to a method and apparatus for hazard analysis of a control system, and more particularly, to a method and apparatus for hazard analysis of a control system based on a system modeling language (SysML).

Safety critical systems are becoming larger. In particular, as the weight of electrical, electronic, and software begins to increase, the risk of accidents due to software defects and interaction errors between system components as well as mechanical failures increases.

In order to prevent fatal accidents, in safety-critical industries such as automotive, medical, and aviation, functional safety standards have been established based on the IEC 61508, a meta-model of functional safety, in accordance with the characteristics of each industry. These standards define strict safety activities that must be followed throughout the development life cycle to ensure system safety. Safety activities are centered on identifying potential hazards that cause accidents and deriving safety requirements to address them.

In general, modeling techniques recognized as standards have been used to systematically develop systems. In software development, a unified modeling language (UML) was adopted as a company standard, and in system development, an extended model of UML, SysML (system modeling language), has been recognized as a suitable modeling language.

Studies linking system modeling work and hazard analysis activities are mainly based on UML or SysML diagrams, preliminary hazard analysis (PHA), hazard & operability study (HAZOP), fault tree analysis (FTA), failure mode and effects analysis ) And others.

However, because the existing studies identify hazards based on certain or some aspects of the system, the overall judgment of hazards was not easy. In addition, existing studies have shown limitations in providing guide words that fit the characteristics of the diagram.

The present invention provides a system development process based on SysML and a development process in which hazard analysis activities such as PHL and PHA are integrated.

The present invention can more effectively integrate the system development process and hazard analysis activities by providing guide words suitable for the characteristics of SysML.

A hazard analysis apparatus of a control system according to various embodiments of the present invention includes a storage unit for storing a predefined first guideword and a predefined second guideword, and a first use case of the control system In order to analyze the hazard of), the predefined first guideword is mapped to the first use case, and a hazard use acting as a hazard in the first use case based on the predefined first guideword. In order to determine a case and analyze a hazard of a sequence for the first use case, the predefined second guideword is mapped to at least one step of the sequence for the first use case, Based on the predefined second guideword, a failure sequence serving as a hazard for at least one operation of the sequence is determined, and the determined hazard type Based on the determined case, and failure sequences, it may include a processor for generating a second use case of the control system.

In a method of analyzing hazards of a control system according to various embodiments of the present invention, in order to analyze a hazard of a first use case of the control system, a predefined first guideword is used as the first use case Mapping process, determining a hazard use case acting as a hazard to the first use case based on the predefined first guideword, and analyzing a sequence of hazards for the first use case In order to do so, mapping a predefined second guideword to at least one step of the sequence for the first use case, based on the predefined second guideword, to at least one operation of the sequence The process of determining a failure sequence acting as a hazard and based on the determined hazard use case and the determined failure sequence, the control The may include the step of generating a second use case of the system.

According to various embodiments of the present invention, a system development process based on SysML and a development process in which hazard analysis activities such as PHL and PHA are integrated may be provided.

According to various embodiments of the present invention, a system development process and a hazard analysis activity can be more effectively integrated by providing a guide word suitable for the characteristics of SysML.

1 shows a diagram of SysML according to an embodiment of the present invention.
2 is a block diagram of an electronic device according to an embodiment of the present invention.
3 illustrates a safety analysis based on multi-view modeling (SAMM) process according to an embodiment of the present invention.
4 is a diagram for a system requirements analysis and specification process according to an embodiment of the present invention.
5 shows a hazard identification diagram according to an embodiment of the present invention.
6 illustrates a requirements diagram of an object finding system according to an embodiment of the present invention.
7 is an H-use case identification process according to an embodiment of the present invention.
8 is a detailed diagram of a use case of an object finding system according to an embodiment of the present invention.
9 is a conceptual diagram for identifying a failure sequence according to an embodiment of the present invention.
10 is a sequence diagram of an object find use case according to an embodiment of the present invention.
11 illustrates risk assessment and cause analysis according to an embodiment of the present invention.
12 is a flowchart of a hazard analysis method according to an embodiment of the present invention.

Hereinafter, the operation principle of the preferred embodiment of the present invention will be described in detail with reference to the accompanying drawings. In addition, in describing embodiments of the present invention, when it is determined that detailed descriptions of related known functions or configurations may obscure the subject matter of the present disclosure, detailed descriptions thereof will be omitted. In addition, terms used in the following are terms defined in consideration of functions in the present invention, which may vary according to a user's or operator's intention or practice. Therefore, the definition of terms used should be interpreted based on the contents throughout the specification and corresponding functions.

The safety analysis identifies potential hazards of system components. Safety analysis is an activity to identify the effect of hazards on the system and the root cause. SysML methods can be used for safety analysis.

1 shows a diagram of SysML according to an embodiment of the present invention.

The system modeling language (SysML) 101 includes a behavior diagram 102, a reqirement diagram 103, and a structure diagram 104 as a lower layer.

The behavior diagram 102 is a lower layer, an activity diagram 105, a sequence diagram 106, a state machine diagram 107, and a use case diagram 108 ).

The structure diagram 104 includes a block definition diagram 109, an internal block diagram 110, and a package diagram 111 as a lower layer. Here, the inner block diagram 110 includes a parametric diagram 112 as a lower layer.

Here, the behavior diagram 102, the structure diagram 104, the sequence diagram 106, the state machine diagram 107, and the use case diagram 108 May be the same diagram as UML 2 (unified modeling language 2). In addition, the activity diagram 105, the block definition diagram 109, and the internal block diagram 110 may be diagrams in which UML 2 is modified. In addition, the requirement diagram 103 and the parametric diagram 112 may be new block diagrams for UML 2.

The SysML diagram 101 described above can be used in a system (eg, control system) development process. The development of such a system requires the incorporation of safety analysis to identify hazards. As an example, an analysis method for effectively identifying a hazard by grafting a hazard & operability study (HAZOP) on a SysML diagram 101 may be presented.

Hereinafter, various embodiments for integrating a process for developing a system based on SysML and safety activities will be described in detail. Hereinafter, a process for performing a method of hazard analysis and deriving safety requirements is defined as safety analysis based on multi-view modeling (SAMM).

2 is a block diagram of an electronic device according to an embodiment of the present invention.

The electronic device 200 includes a storage unit 210 and a processor 220. Here, the electronic device 200 may be an electronic device capable of computing, such as a computer, a server, a smartphone, and a tablet PC. For example, the electronic device 200 may be defined as a hazard analysis device having a hazard analysis function.

The storage unit 210 may store guide words. Here, the guide word may be a word that can provide an interpretation direction of hazard analysis.

An example of a guide word is the HAZOP guide word shown in Table 1 below.

Here, HAZOP is one of the methods used for hazard analysis, and it is a method of analyzing deviations that deviate from the intended design function or condition of the system. By systematically reviewing all parts of the system, HAZOP identifies how anomalies (accidents, failures, defects, etc.) arise from design intent, and determines whether these anomalies can lead to functional, interface, or operational problems.

The storage unit 210 may store a predefined first guide word or a predefined fourth guide word.

The first guideword can be used to determine a hazard use case acting as a hazard to the use case. Here, the use case refers to service / function requirements provided by the target system identified from the user's point of view. The use case will be described in detail with reference to FIGS. 3 to 10.

An example of the first guide word is the first guide word shown in Table 2 below.

As an example, the first guy word may be selected from the HAZOP guideword for deriving a hazard use case.

The second guideword can be defined to analyze the hazard of a sequence for a use case. The second guideword may be used to determine a failing sequence acting as a hazard for at least one operation of the sequence. The sequence for the use case will be described in detail with reference to FIG. 10.

The second guideword may be divided into a third guideword related to the message on the sequence and a fourth guideword related to the fragment on the sequence.

As an example of the third guide word, there is a third guide word shown in Table 3 below.

For example, the third guideword may be selected from the HAZOP guideword to derive a failure sequence for the message.

As an example of the fourth guide word, there is a fourth guide word shown in Table 4 below.

For example, the fourth guideword may be selected from the HAZOP guideword to derive a failure sequence for the fragment.

The processor 220 controls the electronic device 200 as a whole. In particular, the processor 220 may analyze the hazard.

The processor 220 may generate a diagram for the use case.

The use case diagram can be used to identify the attributes and service / functional requirements of the system under analysis. The use case diagram is one of the specification techniques for system requirements, and the service / functional requirements of the software control system identified from the user's point of view, that is, the use cases and associated attributes, such as user and / or external It is a diagram showing elements together. When using the use case diagram to express the requirements of the system, the user can more clearly identify what the service / function requirements of the target system are and what functions the user can perform through the target system.

The processor 220 may determine the hazard use case based on the use case diagram.

Specifically, the processor 220 may map a predefined first guide word to a use case in order to analyze a hazard of a use case of a control system (eg, robot, car, cleaner, military combat equipment, etc.). have. In addition, the processor 220 may determine a hazard use case that acts as a hazard to the use case based on the predefined first guide word. Here, at least one of the predefined first guidewords mapped to at least one of the use cases may be applied to at least one of the use cases.

For example, a hazard use case may be determined as a predefined hazard use case associated with a predefined first guideword. As another example, the hazard use case may be input based on the first guideword presented by the processor 220.

Also, the processor 220 may map a predefined second guideword to at least one step of the sequence for the use case in order to analyze the hazard of the sequence for the use case. In this case, the processor 220 may determine a failure sequence that acts as a hazard for at least one operation of the sequence based on the predefined second guideword. Here, the failure sequence may be that at least one of the predefined second guidewords mapped to at least one step of the sequence for the use case is applied to at least one step of the sequence for the first use case. In this case, the second guideword includes a third guideword for determining a failure sequence for a message among sequences for a use case and a fourth guideword for determining a failure sequence for fragments among sequences for a use case. It can contain.

For example, the failure sequence for the message may be determined as a predefined failure sequence associated with the predefined third guideword. As another example, a failure sequence for a message may be received based on a third guideword presented by the processor 220.

For example, the failure sequence for the fragment may be determined as a predefined failure sequence associated with the predefined fourth guideword. As another example, the failure sequence for the fragment may be received based on the fourth guideword presented by the processor 220.

The processor 220 may generate a use case in which a hazard element is updated based on the determined hazard use case and the determined failure sequence. By using the use case with the hazard element updated, system developers can consider the hazard use case and the failure sequence in an integrated manner at the system development stage, thus expecting high efficiency and completeness of system development.

3 shows a SAMM process according to an embodiment of the present invention.

SAMM is a multi-angle based safety analysis process using SysML diagrams.

The SAMM process includes the system requirements analysis and specification process (SysML modeling) (310, 311), hazard identification process (PHA) (320, 321), risk assessment and casual analysis process (FMEA, FTA) (330, 331) and safety It may proceed to the requirements specification (SysML modeling) (340, 341).

4 is a diagram for a system requirements analysis and specification process according to an embodiment of the present invention.

The system requirements analysis and specification process 310 includes a requirements diagram 410, a state machine diagram 420, a block definition diagram 430, and a use case diagram. ) 440. Here, the function diagram 440 may include an activity diagram 441 and a sequence diagram 442 as behaviors. The activity diagram 441 and the sequence diagram 442 describe the behavior of each function.

5 shows a hazard identification diagram according to an embodiment of the present invention.

The hazard identification diagram 500 may be referred to as negative view modeling.

The hazard identification process aims to identify potential hazards that may occur in the system without fail from various perspectives.

The processor 220 may derive the hazard identification diagram 500 by applying a guideword suitable for SysML diagrams (for example, the first to fourth guidewords described above).

For example, the processor 220 may apply a guide word to the multi-view modeling 510 to generate a result according to the negative view 520.

For example, an actor (factor related to a risk factor such as a person, a vehicle, a system) 510, a hazard actor (H-Actor), a use case 512, an H-Use Case 522, and a Sequence ( Failure Sequence 523 from 513, Abnormal State 524 from State 514, and Exceptional Scenario 525 from Activity 515 may be derived.

For example, the above-described negative view modeling can be applied to an object finding system.

6 illustrates a requirements diagram of an object finding system according to an embodiment of the present invention.

In the object search system 600, a function item 610, a performance item 620, a quality item 630, and a design and implementation constraint item 640 may be considered.

Here, the function item 610 may include a user authentication 611 function, an object search function 612, a robot control function 613, an automatic charging function 614, and a forced termination function 615.

The object finder function 612 includes state machine diagrams 612-1, 612-2, structure diagrams 612-3, and use case diagrams 612-4, 612-5, 612-6. can do. Here, the state machine diagrams 612-1 and 612-2 include an object finding block 612-1 and an autonomous driving block 612-2. Further, the structure diagram 612-3 includes a robot block (eg, turtlebot) 612-3. In addition, the use case diagrams 612-4, 612-5, and 612-6 may include an object finding block 612-4, a map generating block 612-5, and an autonomous driving block 612-6. .

The attributes of the diagram relationship included in the object finding function 612 diagram are shown in Table 5 below.

The use case diagrams 612-4, 612-5, and 612-6 will be described in detail with reference to FIGS. 7 to 10 below.

7 is an H-use case identification process according to an embodiment of the present invention.

A use case is a set of functions that the system must provide to the Actor. An H-use case is a use case that can harm the system in an unintentional way.

Referring to FIG. 7, the H-use case 730 may be identified based on the H-Actor 720 and the use case 720 already identified.

8 is a detailed diagram of a use case of an object finding system according to an embodiment of the present invention.

The functions of the use case 800 of the object finding system include a login function 801, object registration 802, object deletion 803, robot control 804, object finding 805, forced termination 806, object learning There are 807, map generation 808, autonomous driving 809, and moving to a waiting position 810.

The description of the use case based on the use case diagram of the object finding system of FIG. 8 is shown in Table 6 below.

When the guide word suitable for Table 6 is applied, for example, the first guide word described above, the H-use case of Table 7 below can be derived.

9 is a conceptual diagram for identifying a failure sequence according to an embodiment of the present invention.

Sequences can be defined as interactions between components that occur over time. The failure sequence can be defined as the possible failures and the consequences of the interactions between system components.

Referring to FIG. 9, the processor 220 may express a basic flow and an alternative flow 901 of the description of the use case in the sequence diagram 902. In addition, the processor 220 may apply the guideword, for example, the second guideword described above, to the sequence diagram 902 to derive the failure sequence 903 and analyze and evaluate it (904).

10 is a sequence diagram of an object find use case according to an embodiment of the present invention.

The processor 220 applies a guide word (eg, the second guide word to the fourth guide word described above) to each message and fragment of the sequence diagram 1000 to derive a failure sequence that may occur between components. can do.

Hereinafter, Table 8 is an example of a failure sequence for a 1.2 message. For example, the third guideword described above may be applied to Table 8.

Hereinafter, Table 9 is an example of a failure sequence for fragments 1.1.1, 1.1.1.1, 1.1.1.2, 1.1.2, and 1.1.3. For example, the fourth guideword described above may be applied to Table 9.

Hereinafter, Table 10 is an example of a failure sequence for a fragment break [OR (recog_state == TRUE, map_end == TRUE)]. For example, the fourth guideword described above may be applied to Table 10.

Hereinafter, Table 11 shows a part of the hazard list of the object search use case derived from Tables 7 to 10.

11 illustrates risk assessment and cause analysis according to an embodiment of the present invention.

FIG. 11 is a specific example of the risk assessment and casual analysis process 330 of FIG. 3.

The processor 220 may register the identified hazards as a hazard and failure mode in the FMEA sheet and perform risk assessment. In this case, the processor 220 may identify the cause by using an FTA for hazards higher than a predetermined level. As a result, a recommended action can be derived to eliminate and mitigate risks based on the identified causes.

For example, the processor 220 may generate a hazard list by combining at least one of the determined hazard use case and at least one of the determined failure sequence. Also, the processor 220 may register the hazard list on the FMEA sheet. Also, the processor 220 may register the hazard list on the FMEA sheet. In this case, the hazard list may be mapped to a failure mode of the FMEA field. In addition, the processor 220 may analyze the risk of hazards registered in the FMEA sheet, and apply the FTA to hazards determined to be fatal, to identify the cause of the hazard. In addition, the processor 220 may specify a recommended action to improve or mitigate it based on the cause identified by applying the FTA.

In addition, the processor 220 may apply the FTA to at least one of the hazard lists registered in the FMEA sheet, and update the first use case based on the result of applying the FTA to generate the second use case.

The processor 220 may perform the safety requirement specification process 340 of FIG. 3. Specifically, the processor 220 may extract safety requirements based on a mitigation method derived through hazard analysis. The processor 220 may reflect the extracted safety requirements in the requirements diagram. In this case, the relationship attributes and rationality of the requirements diagram can be of great help in the comprehensive analysis, understanding and verification of the requirements.

12 is a flowchart of a hazard analysis method according to an embodiment of the present invention.

First, in the hazard analysis method, in order to analyze a hazard of a first use case of a control system, a process of mapping a predefined first guideword to a first use case (1210), a predefined first Based on the guide word, a process of determining a hazard use case acting as a hazard in the first use case (1220), a second guide word defined in order to analyze a hazard of a sequence for the first use case Mapping 1 2 to at least one step of the sequence for the first use case, based on a predefined second guideword, determining a failed sequence acting as a hazard for at least one operation of the sequence Based on the process 1240 and the determined hazard use case and the determined failure sequence, a process 1250 of generating a second use case of the control system may be included.

Here, the hazard analysis method may further include a process of creating a diagram for the first use case based on a system modeling language (SysML) that is an extension of the unified modeling language (UML).

Here, at least one of the predefined first guidewords mapped to at least one of the first use cases may be applied to at least one of the first use cases.

In this case, the failure sequence may be that at least one of the predefined second guidewords mapped to at least one step of the sequence for the first use case is applied to at least one step of the sequence for the first use case. .

The process of generating the second use case described above is a process of generating a hazard list by combining at least one of the determined hazard use cases and at least one of the determined failure sequences, and registering the hazard list in a failure mode and effects analysis (FMEA) sheet. The process, the process of applying a fault tree analysis (FTA) to at least one of the hazard lists registered in the FMEA sheet, and the process of determining a mitigated action to remove or mitigate the hazard based on the result of applying the FTA It may include the process of specifying safety requirements based on mitigation measures.

And updating the first use case to generate a second use case.

In the above example, the first use case and the second use case may be a set of functions provided by the control system.

Here, the first guide word and the second guide word may be selected from guide words of a hazard and operability study (HAZOP).

In the above examples, selection and determination of guide words, generation of various diagrams such as use case diagrams, determination and specification of safety requirements and updated requirements, etc. are performed by processor 220 or stored input data. The processor 220 may be loaded through the unit 210 or may be input from a user (eg, a safety expert) of the electronic device 220, but is not limited thereto.

On the other hand, the image signal transmission method according to various embodiments of the present disclosure described above is implemented by computer-executable program code to be executed by the processor in a state stored in various non-transitory computer readable medium It can be provided to a server or devices.

For example, in the hazard analysis method, in order to analyze a hazard of a first use case of a control system, a process of mapping a predefined first guideword to a first use case, a predefined first guideword Based on the process of determining a hazard use case acting as a hazard in a first use case, and analyzing a hazard of a sequence for the first use case, a predefined second guideword is used as the first use case. Mapping to at least one step of the sequence for the case, determining a failed sequence acting as a hazard for at least one operation of the sequence, based on a predefined second guideword, and a determined hazard use case and determined Based on the failure sequence, a non-transitory readable medium storing a program performing a process of generating a second use case of the control system (non-transitory computer readable medium) may be provided.

The non-transitory readable medium means a medium that stores data semi-permanently and that can be read by a device, rather than a medium that stores data for a short time, such as registers, caches, and memory. Specifically, the various applications or programs described above may be stored and provided in a non-transitory readable medium such as a CD, DVD, hard disk, Blu-ray disk, USB, memory card, ROM, and the like.

In addition, although the preferred embodiments of the present disclosure have been illustrated and described above, the present disclosure is not limited to the specific embodiments described above, and the technical field to which the present invention pertains without departing from the gist of the present disclosure claimed in the claims. In addition, various modifications can be made by those skilled in the art, and these modifications should not be individually understood from the technical idea or prospect of the present disclosure.

Electronic Devices: 200 Storage: 210
Processor: 220

Claims (14)

In the hazard analysis device of the control system,
A storage unit that stores a first predefined guide word and a second predefined guide word; And
To analyze the hazard of the first use case of the control system, the predefined first guideword is mapped to the first use case,
Based on the predefined first guide word, a hazard use case acting as a hazard to the first use case is determined,
To analyze the hazard of a sequence for the first use case, the predefined second guideword is mapped to at least one step of the sequence for the first use case,
Based on the predefined second guideword, a failure sequence serving as a hazard for at least one operation of the sequence is determined,
And a processor that generates a second use case of the control system based on the determined hazard use case and the determined failure sequence.
According to claim 1,
The processor,
The hazard analysis apparatus further creates a diagram for the first use case based on a system modeling language (SysML) that is an extension of a unified modeling language (UML).
According to claim 1,
The hazard use case,
A hazard analysis apparatus, wherein at least one of the predefined first guide words mapped to at least one of the first use cases is applied to at least one of the first use cases.
According to claim 1,
The failure sequence,
A hazard analysis device in which at least one of the predefined second guidewords mapped to at least one step of the sequence for the first use case is applied to at least one step of the sequence for the first use case. .
According to claim 1,
The processor,
A hazard list is generated based on the second use case,
Register the hazard list on the FMEA (failure mode and effects analysis) sheet,
FTA (fault tree analysis) is applied to at least one of the hazard lists registered in the FMEA sheet,
Based on the result of applying the FTA, a recommended action to remove or mitigate the hazard is determined,
A hazard analysis device specifying safety requirements based on the determined mitigation measures.
According to claim 1,
The first use case and the and the second use case,
A hazard analysis device, which is a set of functions provided by the control system.
According to claim 1,
The first guide word and the second guide word,
Hazard analysis device selected from guide words of hazard and operability study (HAZOP).
In the hazard analysis method of the control system,
Mapping a predefined first guideword to the first use case in order to analyze a hazard of the first use case of the control system;
Determining a hazard use case acting as a hazard to the first use case based on the predefined first guide word;
Mapping a predefined second guideword to at least one step of the sequence for the first use case, in order to analyze the hazard of the sequence for the first use case;
Determining a failure sequence acting as a hazard for at least one operation of the sequence, based on the predefined second guideword; And
And generating a second use case of the control system based on the determined hazard use case and the determined failure sequence.
The method of claim 8,
A process of creating a diagram for the first use case based on a system modeling language (SysML) that is an extension of a unified modeling language (UML).
The method of claim 8,
The hazard use case,
A hazard analysis method in which at least one of the predefined first guide words mapped to at least one of the first use cases is applied to at least one of the first use cases.
The method of claim 8,
The failure sequence,
A hazard analysis method wherein at least one of the predefined second guidewords mapped to at least one step of the sequence for the first use case is applied to at least one step of the sequence for the first use case. .
The method of claim 8,
Generating a hazard list based on the second use case;
Registering the hazard list in a failure mode and effects analysis (FMEA) sheet;
Applying a fault tree analysis (FTA) to at least one of the hazard lists registered in the FMEA sheet;
Determining a recommended action for removing or alleviating hazards based on the result of applying the FTA; And
And specifying safety requirements based on the determined mitigation measures.
The method of claim 8,
The first use case and the and the second use case,
A hazard analysis method, which is a set of functions provided by the control system.
The method of claim 8,
The first guide word and the second guide word,
A hazard analysis method selected from guide words of hazard and operability study (HAZOP).

Images