CEA LIST Expression of interest: dt-fof-02-2018 Juan Cadavid CEA LIST, Software and Systems Engineering department Juan.Cadavid@cea.fr

Software and systems engineering department CEA TECH: Overview CEA TECH: A many domains RTO: LIST-LETI-LITEN, a go-between research and innovation Software and systems engineering department 15+ years in model-driven design, formal techniques, proof, safety & security of systems Expertise and commitment to standards Large world-wide engineering tools development Papyrus, Frama-C

Expression of interest: dt-fof-02-2018 “Past research to implement HRC in an industrial setting concentrated largely on safety of humans… This has already led to production environments with safe interaction between humans and robots… However more attention has to be paid to develop novel inherently-safe robotic concepts where collaboration with humans is taken up already in the design phase… Proposals should cover development of methods for robotic hazard assessment and risk management to clarify trade-offs between productivity and safety for mixed human-robot smart devices environments… and reduction in product reconfiguration time and cost”

Eclipse Safety Framework Eclipse Safety Framework provides a set of tools for integrating safety techniques within a model driven engineering process based on both modelling standards, SysML and MARTE. Model-Based Safety Analysis relies on the idea that safety analysis activities can follow the design process in a parallel flow using the system functional and physical architectures as a common basis. The system model is used to capture the overall architectures and the interactions between their components. Models may be enriched with dedicated annotations in order to describe possible dysfunctional behaviours.

Eclipse Safety Framework ESF allows better interactivity between design and safety assessment activities. A dysfunctional model is built from the system model. It is used to specify possible failure-modes, mitigation barriers and propagation behaviour at components level. From the specification of feared events (expressed in safety requirements), it can then with an automatic global analysis produce propagation paths and corresponding fault trees. The dysfunctional model can be improved in an iterative way, until the safety requirements are fully satisfied. Finally, reports can be exported in different formats (e.g. HTML and PDF) to document the analyses hypothesis and results.

Eclipse safety framework A complete toolset: FMEA and FMECA FTA, fault tree generation, minimal cut sets, probabilistic calculations Safety Requirements derivation Automatic report generation We show how to simulate the dysfunctional behavior of the system and Fault Circumvention Process Visualization (through animation) of the faulty module Identification of the fault circumvention process Execution of the model to apply the circumvention procedure directly on the factory Safety Analysis Simulation of dysfunctional behaviour Fault Circumvention Process

Inherently-safe system design: Hazard assessment Safety Requirements Specification and Derivation

Inherently-safe system design: Hazard assessment Hazard criticality assessment over system architecture

Eclipse Robotml: model-based design of robotics systems Standard RAMI 4.0 On utilise RobotML pour modéliser les composants de chacun des modules de l’usine MANUFLEX Carnot Project| 9

Thanks! Juan Cadavid CEA LIST, Software and Systems Engineering department Juan.Cadavid@cea.fr