Executable Digital Dependability Identities (EDDIs)
Cooperative Runtime Safety Assurance
Modern autonomous systems increasingly operate as part of open, cooperative Systems of Systems (SoS). Robots, vehicles, vessels and other intelligent components may join or leave a mission, cooperate in combinations that were not fully known at design time, experience failures, and adapt their behaviour as circumstances change.
This creates a fundamental assurance challenge. Traditional safety engineering is largely performed offline: engineers analyse a predefined system, identify hazards, construct safety models and demonstrate that the design is acceptably safe before deployment. But when the system itself, its environment and its partners can change during operation, not every relevant situation can be completely anticipated and assessed in advance.
Executable Digital Dependability Identities (EDDIs) are both a concept and a technology developed to address this problem. The central idea is simple: instead of leaving safety knowledge behind in engineering documents and models, we make selected parts of that knowledge executable and available to the system at runtime.
An EDDI can monitor events from the operating system, reason about failures and changing system states, reassess whether required safety properties can still be provided, and communicate this information to other members of a cooperative system. EDDIs therefore create a bridge between design-time safety engineering and runtime assurance.
The SESAME project identified complexity, intelligence and openness as major challenges for dependable multi-robot systems. The EDDI concept brought together model-based safety analysis, monitoring of intelligent components and cooperative runtime assurance to help address these challenges. In open systems in particular, EDDIs can exchange dependability information and guarantees so that safety can be considered at the level of the changing overall system, rather than only at the level of individual components.
EDDIs in the SESAME Project
SESAME developed both the engineering concepts behind EDDIs and a collection of tools showing how conventional safety models can be transformed into information that remains useful during operation.
The project developed an Open Dependability Exchange (ODE) representation, tools for producing EDDIs, mechanisms for generating runtime EDDIs, and software for deploying them as cooperating agents.
An important feature of the approach is that engineers do not have to abandon established safety-engineering methods. In SESAME, tools such as HiP-HOPS could be used to model system architectures and automatically generate analyses such as fault trees and FMEAs. Other tools could contribute behavioural models such as state machines. Converters then brought these different forms of engineering knowledge into a common ODE representation.
The EDDI Editor was developed as an integration layer between these engineering tools. It can import and combine models originating from different sources. For example, a system architecture and fault-tree/FMEA information generated by HiP-HOPS can be combined with state-machine information describing dynamic system behaviour.
The editor also supports runtime-specific concepts such as Events and Actions, helping connect conditions observed in the real system with the dependability model and the responses that may follow.
The EDDI Editor therefore provides a practical bridge between safety-analysis models and runtime EDDI generation. It supports the import of HiP-HOPS architectures and FTA/FMEA results, ODE models and DDI files, while allowing these elements to be merged, inspected and prepared for runtime use.
SESAME also demonstrated the next step: generating executable runtime components from these engineering models.
Its runtime toolchain included generators that could produce EDDI monitors and software wrappers connecting those monitors to ROS-based robotic systems. Different forms of runtime assurance could therefore be incorporated into the EDDI framework, including dependability guarantees, SafeML monitoring and Bayesian-network-based monitoring.
This represents an important change in how safety models are used:
Safety model → executable monitor → operational evidence → runtime assessment → adaptation
Rather than being something consulted only by engineers during design, selected parts of the safety model become an active part of the operating system.
The value of this becomes particularly clear when several autonomous systems work together.
An EDDI can assess the dependability and capability of its own system and communicate that information to other EDDIs or to a mission-level coordinator. The overall system can then respond when circumstances change.
SESAME demonstrated this through a simple example involving cooperating drones. If one drone develops a fault and can no longer provide the dependability guarantees required for its mission, its EDDI can identify the changed condition. The mission can then be reassessed and another available drone redeployed to take over the affected task.
This illustrates the wider purpose of EDDIs: not simply to detect failures, but to use explicit dependability knowledge to support safe runtime reconfiguration in an open, cooperative system.
See EDDIs in action, detecting failures and redeploying drones in this simple video example.
EDDIs in the NYK Lines project - Safety monitoring on an autonomous ship
We have subsequently developed the EDDI technology further in our work with NYK Lines on autonomous shipping.
The NYK implementation takes the concept beyond the SESAME demonstrators towards a more integrated environment in which engineers can both create dependability models and execute them at runtime.
The toolchain supports the construction and integration of models such as fault trees and connected state machines. Engineers can then augment these models with monitoring expressions that define how events and conditions observed in the real operating system relate to the engineering model.
This creates an end-to-end process in which engineers can:
-
model the system and its potential failures;
-
describe dynamic behaviour using connected state machines;
-
connect those models to operational data through monitoring expressions;
-
make the resulting models executable;
-
monitor the evolving state of the real system; and
-
use the resulting dependability information to support runtime assurance and operational decisions.
The important point is that this is not fundamentally a shipping technology. Autonomous ships provide a demanding and realistic application, but the underlying approach is much more general.
The tools can be adapted to robotics, autonomous vehicles, industrial automation, energy systems, defence applications and other cooperative Systems of Systems in which system composition, operating conditions or behaviour may change after deployment.
To see these tools in action in the following video:
Turning safety models into live assurance
For organisations developing autonomous or cooperative Systems of Systems, EDDIs offer a way to turn safety engineering from a predominantly static activity into a live runtime capability.
The aim is not to replace design-time safety assurance. It is to carry that assurance knowledge forward into operation, where it can continue to monitor, interpret and respond to the behaviour of the real system as conditions change.
If you are developing autonomous or cooperative systems and need runtime assurance, or are interested in adapting the EDDI technology and tools to your application, contact us.