Introducing RiskSOAP to communicate the distributed situation awareness of a system about safety issues: an application to a robotic system

Abstract

This paper introduces the RiskSOAP (‘RiskSOAP’ is the abbreviation for Risk SituatiOn Awareness Provision.) indicator to measure the capability of a complex socio-technical system to provide its agents with situation awareness (SA) about the presence of its threats and vulnerabilities and enables analysts to assess distributed SA. The RiskSOAP methodology adopts a comparative approach between two design versions of a system differing in the elements and characteristics that can enhance or cause the degradation of the awareness provision capability. The methodology uniquely combines three methods: (1) the STPA hazard analysis, (2) the EWaSAP early warning sign identification approach, and (3) a dissimilarity measure for calculating the distance between binary sets. In this paper, the RiskSOAP methodology was applied to a robotic system and the findings show that the indicator is an objective measure for the system’s capability to provide its agents with SA about its threats and vulnerabilities.

Practitioner Summary: This paper suggests a novel methodology for assessing distributed situation awareness (DSA) regarding safety issues. Given that systems consist of specifications and components possible to be mapped, the risk SA provision capability (RiskSOAP) methodology demonstrates the feasibility of measuring to what extent systems’ elements contribute to the emergence of DSA.

Keywords:

• Distributed situation awareness
• safety
• STPA
• EWaSAP
• risk SA provision capability indicator

Acknowledgements

The authors would like to thank Dr Rigas Kouskouridas and Dr Dimitris Chrysostomou for their assistance in creating the safety control structure of ACROBOTER and recording data regarding the structure, as well as the composition of the original system. During all eight official meetings, and in cases of occasional communication for follow-up reasons, their personal experience as designers working on ACROBOTER, along with their very own point of view led to creative disagreements and finally to a shared position about ACROBOTER in terms of its risk SA provision capability and its risk DSA as well. Acknowledgement should also be made to the two anonymous reviewers, who provided valuable comments on various sections of the manuscript and enabled us to consider some issues raised and further develop the text and our reasoning.

Notes

1. This paper is accepted upon revision, however, under circumstances, the manuscript can be provided to the reviewers.

2. So far, no methodology can perfectly fit all purposes or cover all aspects of a complex, multifaceted and dynamic socio-technical system. It is possible, however, to approximate its behaviour and components by adopting system theoretic models (see Assumption 2), thus in this paper, the adjective ‘ideal’ is used to describe a ‘to-be’ system version against its corresponding ‘as-is’ system version. The ‘to-be’ version incorporates preferable additions, based on hazard analysis techniques and early warning sign identification approaches.

3. In this paper, the ‘image’ of a system is regarded as a composition of discrete elementary units, i.e. system elements, that, if combined together, form system parts. The word ‘image’ was intentionally chosen, since the methodology is inspired by the classic pattern matching process; it is based on a comparison between a target image template and a query image.

4. RFID tags are used in radio-frequency identification systems and are uniquely attached to the objects to be identified. For this reason, there is a two-way radio transmitter-receiver, i.e. the RFID reader, that sends a signal to the tag and reads its response. When a tag responds to the reader, the object on which the tag is attached is identified and tracked.

5. In [CA3] as well as in [UCA7], the numbers denote the enumeration of all 12 control actions and 27 unsafe control actions, respectively, for all three controllers (see Figure 4) and both hazards identified for ACROBOTER.

6. Due to space-saving reasons and for better understanding, the example shown above is concise yet appropriately well detailed to illustrate how system design improvements affect the risk SA provision capability and risk DSA.