联系我们： 手动添加方式: 微信>添加朋友>企业微信联系人>13262280223 或者 QQ: 1483266981

Module Code
COM00017M
MSc in Safety Critical Systems Engineering
Diploma in Safety Critical Systems Engineering
Certificate in System Safety
MSc in Railway Safety and Control Systems
DEPARTMENT OF COMPUTER SCIENCE
COMPUTERS AND SAFETY (CASA)
Open Individual Assessment
Issued: Thursday, 6th March 2025, 17:00
Submission due: Tuesday, 22nd April 2025, 12:00 noon
Feedback and Marks due: Tuesday, 20th May 2025, 12:00 noon
All students should submit their answers by 12:00 noon, Tuesday 22nd April 2025. An assessment
that has been submitted after this deadline will be marked initially as if it had been handed in on
time, but the Board of Examiners will normally apply a lateness penalty. All answers should be
submitted through the dedicated “submission point” that can be found under the “assessment”
section of the Virtual Learning Environment’s site for Computers and Safety (CASA) module.
Your attention is drawn to the section about Academic Misconduct in your Departmental Handbook:
https://www.cs.york.ac.uk/student/handbook/.
Any queries on this assessment should be posted to the Discussion Board on the VLE site for CASA.
Answers will be posted on the VLE. No questions about the assessment will be answered after
Friday, 28th March 2025.
Rubric:
Answer all parts of all questions. Answers must not exceed 7 sides of A4 in total. This limit includes
any tables, diagrams, etc.; it does not include a bibliography. Consider the allocation of marks to
gauge how much content is required to be produced per question. This restrictive page limit is to
Page 2 of 7
encourage concise and precise answers to questions. Pages in excess of this limit will not be marked.
There is no need to provide a title page, table of contents, table of figures, or similar.
Your exam number should be on the front cover of your assessment. You should not be otherwise
identified anywhere on your submission.
Please note that we estimate that you should spend approximately 50 hours completing this
assessment; this will be split between additional private study and writing your response to
questions.
Remember to justify and explain your answers: a significant proportion of the marks are reserved for
explanations and critical discussion.
To answer the questions fully, you will need to undertake some additional reading. It is essential to
include with your answer a bibliography listing your sources and, when quoting, to make clear what
is being quoted and cite the source.
Note on Academic Integrity
This is an open assessment, and you are permitted to refer to written and online materials to aid you
in your answers. However, you must ensure that the work you submit is entirely your own, and for
the whole time the assessment is live, you must not:
● communicate with other students on the topic of this assessment.
● seek advice or contribution from any other third party, including proofreaders, friends, or
family members.
● use generative artificial intelligence tools to generate any part of your answer.
We expect, and trust, that all our students will seek to maintain the integrity of the assessment, and
of their award, by ensuring that these instructions are strictly followed. Where evidence of academic
misconduct is evident, this will be addressed in line with the University’s Academic Misconduct
Policy.
QUESTION 1 [60 marks]
In answering this question, you are expected to carry out your own independent reading around
the topic. Your discussions and arguments should be supported by relevant literature, indicated
clearly by citations.
This question refers to an automated warehouse vehicle system which is described in the following
brief. Beyond the information given in this brief, you are free to make any reasonable assumptions
about the system, to answer the question. All assumptions should be stated and justified in responses
to the question.
Please note that Topsborough Industries and the circumstances in which it operates are purely
fictitious, devised for the purposes of this examination. Any similarity to any existing systems or any
systems currently under development is accidental.
Sales of Topsborough Industries products are soaring, so much so, that they need a bigger
warehouse and regular restocking of the components for their smart agriculture range of equipment
and supplies that include drums of highly concentrated pesticides and heavy machinery parts. Due
to workers council concerns about the safe handling of such material and to keep up with the need
for 24-hour operations, Topsborough industries has decided to apply its engineering capabilities to
develop an Automated Warehouse Vehicle (AWV) system. This system is designed to collect supplies
and parts from lorries in parking bays, identify the parts based on bar codes and move these to the
appropriate parts of the warehouse. The parts and supplies are delivered in packages that are
stacked in shelves up to 3 metres high. There are strict regulations in place for storing certain
chemicals in different parts of the warehouse, due to fire and explosion hazards.
The AWV consists of a wheeled base with forklift mechanism capable of following guidance strips on
the floor of the warehouse along fixed routes. It has a bar code scanner to identify material to be
moved, the ability to communicate wirelessly with a central database of where the material should
be stored, a lidar-based system to detect obstacles within the path and a camera for identifying
empty space on the shelves for stacking material.
The operation of the system is envisaged as follows. When a new delivery arrives, a number of AWVs
are deployed to unload the delivery and store in the appropriate places in the warehouse. Each of
the vehicles approaches the delivery truck and identifies the next object to be stored based on a bar
code that is printed on all sides of the packages. The object is then picked up, and based on the bar
code, the appropriate shelf is located. The AWV then navigates through the warehouse by following
guidance strips on the floor to the target shelf. The guidance strips also serve to locate the position
of the automated warehouse vehicle within the warehouse. The AWV will need to traverse areas
where both other vehicles and warehouse workers are present. Depending on the free space in the
shelf, the forklift mechanism is used to move the package to the appropriate height and unload the
package onto the shelf. After which, the AWV returns to the delivery truck to collect the next
package. The system is battery operated and, upon detecting low battery, automatically returns to a
docking and charging station.
Page 3 of 7
Although there is substantial engineering work required to manufacture the devices themselves,
much of the functionality of the AWV is enabled by software. Software controls the following
functionality:
● Accepting notifications from a central warehouse controller to unload a delivery from a
parking bay
● Self-driving functionality including following fixed paths around the warehouse
● Identification of delivery packages based on bar codes
● Loading a package onto the forklift mechanism
● Querying a database to identify the destination shelf for a package
● Identification of empty space on a shelf
● Unloading a package onto a shelf
● Monitoring battery charge
● Returning to charging station
A high-level overview of the functional elements of the Automated Warehouse Vehicle is shown in
the Figure 1. The shaded blocks represent functionality implemented in software. The white blocks
represent hardware sensors and actuators.
Figure 1: Functional architecture of the AWV
A preliminary hazard analysis has identified the following hazards that should be considered during
system design:
Page 4 of 7
High risk (direct risk of uncontrollable harm to workers):
● H1: Collisions with shopfloor workers
● H2: Dropping of heavy packages
● H3: Spilling of dangerous liquids
Medium risk (risk might be mitigated by external measures or operator intervention):
● H4: Blocking of routes through the warehouse
● H5: Collisions with warehouse infrastructure and other vehicles
● H6: Placement of packages in the wrong shelves
Question 1.1 [20 marks]
a) Using a suitable method, identify 5 contributions of software to the hazard H2: Dropping of
heavy packages.
b) Using a suitable method, derive high-level software requirements for the Automated
Warehouse Vehicle that would be sufficient to address these and potentially other
hazardous contributions of the software and allocate these requirements to the functions
described in the figure above. You should identify 10 high-level software requirements (a
complete list of requirements is not expected)
In your answer, explain how the software contributions and safety requirements were identified and
justify the method used. Define the requirements as precisely and concisely as possible, without
using formal a specification language.
If your requirements need to reference physical values (e.g. distances, weights, speeds, etc.) use
placeholders to real value rather than exact values (e.g. x m/s and not 20 m/s).
Question 1.2 [15 marks]
Figure 2 summarises the organisation of the software architecture of the Automated Warehouse
Vehicle into software components.
Figure 2: Layered Software Architecture of the AWV
Using a suitable software safety analysis approach, identify potentially failure modes of the forklift
horizontal actuator abstraction component that could lead to the violation of the requirements you
identified in Question 1.1.
In your answer, explain the method you applied, define any guide words you may have used to guide
your analysis, data flows you examined and provide 10 examples of the most critical failure modes.
Page 5 of 7
Page 6 of 7
Question 1.3 [10 marks]
Identify and justify 8 development-time measures, appropriate to the criticality of the function that
will have the greatest impact in avoiding or mitigating the types of failure modes you described in
Question 1.2. Your aim is to identify measures to ensure that the system is “safe-by-design”. Assume
that the software is hand-coded in the “C” programming language.
Recommendations from safety standards can be used as inspiration, but their effectiveness within
the system context must be justified. Include a mixture of process-oriented and functional measures
but do not include verification or validation measures within your answer (See Question 1.4).
Question 1.4 [15 marks]
Develop an appropriate verification and validation strategy for the forklift control functionality and
the associated software components. Define and justify the objectives of the strategy, the methods
used and associated acceptance criteria. Define in which phases of the development and
implementation process the methods would be applied.
In your answer you should include up to 5 objectives for the V&V strategy and 8 effective verification
and validation methods for confirming these objectives (a complete list of methods is not expected).
Each V&V method must be described in terms of its underlying approach, which V&V objectives it is
contributing to and appropriate acceptance criteria.
Page 7 of 7
QUESTION 2 [40 marks]
In answering this question, you are expected to carry out your own independent reading around
the topic. Your discussions and arguments should be supported by relevant literature, indicated
clearly by citations.
Read the following paper: Using an IEC 61508-Certified RTOS Kernel (Available on the VLE site for
CASA). The purchasing department of Topsborough Industries has recommended you look into using
this operating system for your automated warehouse vehicle, as QNX is a highly regarded company
with IEC 61508 certified safety products.
Question 2.1 [10 marks]
a) Based on the information in the paper, identify and briefly describe the safety features that
the QNX RTOS kernel offers.
b) To what extent would these features mitigate the types of software failures you identified in
Question 1
Question 2.2 [10 marks]
a) Describe how the Safety Element out of Context approach applies to the integration of the
QNX RTOS Kernel.
b) Identify 5 measures that would need to be implemented in the systems and software
engineering processes within Topsborough Industries to safely integrate the QNX product.
Question 2.3 [20 marks]
QNX are about to release a new version of the product better suited to the hardware you will use in
the Automated Warehouse Vehicle. However, this version has not yet been certified. Before you
decide on the use of the QNX RTOS kernel, your quality department has recommended that you
perform a safety assessment of the development project and organisation to increase your
confidence in this new product. Your task now is to plan an onsite visit to perform the assessment.
An agenda should be shared with QNX beforehand so that they can prepare which experts, and
information should be made available during the visit.
a) Create a list of 8 questions that you would ask of the QNX organisation and the RTOS kernel
development team. Use these questions to try to get as broad as possible a picture of the extent to
which appropriate safety management and engineering principles are being applied during the
development of the QNX product.
b) Identify which roles within the QNX organisation you would need to interview to get answers to
each of these questions.
c) For each question in your list define the criteria against which each question would be judged and
examples of the evidence with which you would expect to be provided to assess if the criteria are
met. As an assessor, you would be expected to perform some spot checks on the evidence being
provided.
END OF PAPER