https://www.mdu.se/

Many safety-relevant vehicle functions, both ADAS (Advanced Driver Assistance Systems) and non-ADAS, depend on timely and correct driver responses to system information or warnings. When Human Machine Interface (HMI) assumptions are underspecified, Safety Of The Intended Functionality (SOTIF) may be undermined by delayed reactions, nuisance-driven, mistrust, or misuse. We use the Moving Off Information System (MOIS, UN R159) as a case study and we propose a guardrailed HMI personalisation concept that adapts presentation, not function, to driver variability across users and over time. We define a practical, measurable notion of non-intrusive optical information and map it to evaluation hooks and evidence artifacts. The concept is coupled with attention-aware safeguards and functional safety timing budgets consistent with ISO 26262:2018 and ISO 21448:2022. We outline evaluation hooks and evidence mapping that link SOTIF claims to measurable HMI outcomes without processing personal data. Although developed for MOIS, the concept is intended to extend to other driver-in-the-loop functions beyond ADAS.

Command and Control Systems (CCS) are dependability-critical socio-technical systems, which encompass organizations, trained operator(s), and interactive technology designed to support the operator(s) in command and monitoring tasks. For instance, the CCS for Flight Safety Operations at the Europe’s Spaceport in Kourou supports the operator(s) in the monitoring of the trajectory and flight parameters of a launcher, and in commanding the eventual destruction of the launcher if the trajectory deviates outside of the pre-defined safety envelope. To ensure dependability, the congruence between the interactive technology and the operator is key. Indeed, the interactive technology must tolerate human-variability in terms of faults which may occur at perceptive, motor, and cognitive levels and which may lead to human errors. To assess dependability of new interaction technologies, we propose a systematic human-variability-aware safety analysis framework, called P-VASA. The framework takes into account the input and output devices, their associated interaction techniques and the operator’s task and is applicable to any CCS involving interactive technologies.

Cyber-physical systems (CPSs) in critical domains such as self-driven cars and unmanned aerial vehicles involve complex interactions between safety and security concerns. Failures in CPSs such as self-driven cars are caused either by hardware/software component faults or attacks. The identification of hazards, their risks, and root causes is addressed by Safety Engineering, e.g., using Fault Tree Analysis. On the other hand, Security Engineering addresses the identification of asset vulnerabilities, their associated external threats, risks, and causes, using Attack Tree Analysis. Although both disciplines use separate terminology, processes, and tools, they rely on a common system architecture and in the use models such as Component Fault Trees and Attack Trees to support their analyses. In the automotive domain, such analyses should be performed in alignment with guidance defined in assurance standards, e.g., ISO 26262 for functional safety, and ISO 21434 for cybersecurity. However, existing techniques that integrate safety and security models are not fully aligned with the ISO 21434. In this paper, we introduce a novel Component Attack Fault Trees (CAFT) modelling language, built upon Component Fault Trees and ISO 21434 concepts, for integrating safety and security analysis models. Since CAFT was built in alignment with traditional safety and security analysis formalisms and standards, it has the potential to guide engineers in the development of multi-concern analysis model-driven engineering tools. We illustrate the use of our CAFT language to support safety and security co-analysis of an automotive headlamp system. 

A Software Bill of Materials (SBOM) has become mandatory in different jurisdictions. If well-conceived and understood, an SBOM is a starting point for risk identification and assessment. In various jurisdictions, the provision of an SBOM is mandatory. The format for SBOM creation and the process for its generation and maintenance are jurisdiction-dependent. Hence, to ensure cross-jurisdiction compliance, vendors selling their products to different jurisdictions need to systematize and manage the SBOM commonalities and variabilities. As far as the literature reveals, no automatable methodological approach guides SBOM cross-jurisdiction compliance. In this paper, we focus on the SBOM format, and we reuse and customize our previously proposed ontology-based methodological approach. First, we represent the systematization of the existing commonality and variability among a subset of relevant SBOM formats adopted by different jurisdictions. Then, we reuse the reusable constraints for checking instance-validity. Finally, we provide an argumentation pattern for SBOM-cross-jurisdiction compliance.

To nearly achieve vision zero, the United Nations have intro-duced the safe system approach. This approach aims at accom-modating human factors by incorporating redundancy withinthe different identified safety pillars (safe speed linked to reg-ulations, safe vehicles, safe roads, safe emergency care). Tocontribute to vision zero, ADSs (Automated Driving Systems)need to contribute to road safety, in addition to ensuring safetyof the intended functionality. Achieving safe and harmoniousADSs necessitates a comprehensive safety approach beyondthe vehicle-centric / ADS-centric perspective. It also calls forroadmanship which is a concept that centers on whether thevehicle plays well with others.System Theoretic Process Analysis (STPA) is a process forconducting hazards analysis. STPA has been recently includedwithin the automotive safety standards and regulations as sug-gested process to be adopted. However, its application has beenconsidered challenging and proposals for adaptations have beenprovided. In this paper, we provide yet another novel adaptation,called STPA-WA1, which embraces roadmanship and the differ-ent perspectives represented by the different pillars. STPA-WAdeepens safety/dependability understanding.

Integrating safety and security in automotive cyber-physical systems (CPS) domains (e.g. autonomous vehicles), is challenging for two main reasons. First, it is still difficult to represent the potential consequences of system failures or malicious attacks. Secondly, these systems must ensure safety and security despite unknowns and uncertainties. A Digital Dependability Identity (DDI) can facilitate this by encapsulating all dependability characteristics (e.g., design, requirements, safety, and security analysis models) of CPS's components. The Open Dependability Exchange (ODE) metamodel is an implementation of the DDI concept, but has limitations in the interplay between safety and security. ODE is aligned with with ISO 26262 but lacks certain security concepts to be aligned with ISO 21434. Also, ODE supports modeling fault trees, but modeling attack trees and attack-fault trees still not. This paper proposes an extension to the ODE metamodel, aiming to increase coverage of ISO 21434 concepts and allowing the modeling of attack-fault trees. We built these metamodel extensions based on an analysis of the ODE metamodel, industry standards, Microsoft STRIDE model, and HEAVENS security analysis methodologies. We evaluated the proposed extensions in an illustrative example of an autonomous vehicle.