Keywords

1 Introduction

Future production in the automotive industry needs to be adapted more frequently and in an efficient manner to fulfill rapidly-changing product requirements in order to prevail in the increasingly challenging market environment. In this future production, production resources, machinery and humans are integrated seamlessly to achieve common production goals. If production changes are required, the system configuration can be adapted flexibly and dynamically to address new production requirements. This highly reconfigurable nature of the production systems is made possible thanks to the application of Plug-and-Produce (PnP) technology and the usage of Cyber Physical System (CPS) within the production. Relevant approaches and implementations to achieve this vision are currently studied within the research project FluPro (Fluid Production) at the research campus ARENA2036 of the University Stuttgart.

Safety assessment represents one of the many important aspects to guarantee production safety and to enable the successful operation of fluid production [1]. According to the Machinery Directive [2] in the European Union, every machinery or production system needs to be risk assessed and the results documented before the CE marking can be issued, which represents the manufacturer declaration for the system conformity according to related safety standards and regulations. The procedure for risk assessment according to ISO 12100 [8] has to be done after every system modification to ensure that possible emerging risks are identified, eliminated or reduced to an acceptable level. Current industrial practices depend mostly on manual efforts of highly-experienced safety engineers and the created document-based assessment results are hardly reusable. This time-consuming and labor-intensive safety-related procedures are counterproductive, especially in consideration of the main objectives of fluid production to allow an efficient and seamlessly integrated production.

In this paper, we propose a safety assessment framework called the Fluid Production Safety 4A-Framework (FluPro-S4A) to provide an assisted risk assessment and documentation process within fluid production. The goal of this framework is to facilitate the manual efforts needed to risk assess and approve the operational safety of production systems, which will lead to an accelerated system commissioning. This paper proposes a new modeling method to describe the different types of assets (i.e. production equipment and machinery) within fluid production and derive the integrated framework FluPro-S4A alongside relevant software tools to enable a semi-automated and assisted assessment during system commissioning.

2 Related Work

Tools or assistance systems with more advanced capabilities for risk assessment are desired among experts based on a study conducted by [7]. In the field of Human-Robot-Collaboration (HRC), some of the methods and tooling worth mentioning include the formal method SAFER-HRC for hazard analysis [4, 15], the rule-based system [5], the simulation-based approach [6, 16] and the robot reachability analysis [14, 17]. The author in [9] focuses more on robot behaviour analysis and proposes an automated configuration method for different robot states. These mentioned methods deal mostly with concrete aspects within the HRC applications to facilitate the risk assessment procedure.

In the field of reconfigurable systems, similar approaches can also be found as frequent system changes might lead to an increased effort for risk assessment. The authors [12] provide a certification concept for modular production lines, whereas [13] proposes a digital certificate for the CE-conformity of I4.0 production lines. Toolings and methods to facilitate risk assessment in various domains such as manufacturing have similar motivation to assist humans during the assessment and decision-making process. Some of the examples include the concept AutoSafety for assisted risk assessment for adaptable production systems [10], the decision tree analysis method [11], the framework for the assessment of complex systems [3] or the runtime analysis of failure rates for automated guided vehicles [18].

The contributions in this paper lie mainly on the whole integrated process during the commissioning of fluid and reconfigurable production systems, where high-level modeling and safety approval procedures are proposed. With the methodical foundation provided by the aforementioned publications, we demonstrate how such computer-aided methods can be integrated seamlessly into production systems.

3 Modeling and Integrated Process for the System Commissioning

Considering the context within fluid production, several terminologies are firstly introduced to describe the hierarchy and the types of production assets:

  • A System (S) is a collective term to describe the whole production layout that is made up of one or more production cells or machinery (Base) to achieve common production goals.

  • A Base (\(B_S\)) represents a standalone production unit (cell or machinery) that is made up of modular production assets (Mechatronic Object) that offer distinct production skills. This represents the starting point for the system safety assessment introduced later in this paper.

  • A Mechatronic Object (\(MO_{S,B}\)) describes a production asset that is integrated into the Base. Two categories of MO are introduced based on our modelling: MO Process offers production skills, while MO Measure represents implemented safety devices/measures for the purpose of risk mitigation.

The introduced terminologies can be further described using the presented meta-model in Fig. 1 to illustrate the relationships between different production assets in the fluid production. With this asset relationship, we focus specifically in this paper on the assessment and commissioning of one Base that possesses a combination of different Mechatronic Objects (MOs).

Fig. 1.
figure 1

Meta-model to describe the asset structure for fluid production

Full size image

To derive our integrated framework for the safety management, we firstly analyze the commissioning process of fluid production systems and identify its relevant connections to safety. The commissioning of a fluid system can be divided into four phases before the production starts: (1) planning phase, (2) external implementation, (3) internal implementation, and (4) documentation.

During the planning phase, the required modular MOs that are needed are selected. Relevant tasks that can be done in this phase include the layout planning of MOs, the analysis of production cycle times and the derivation of production cost. In the second phase external implementation, further fine-tuning of the selected MOs can be carried out to fulfill production requirements and to prepare for the system modification. Here, the selected MOs must undergo a safety pre approval process to ensure that the MOs are safe according to the Machinery Directive [2] and risk assessed based on ISO 12100 [8]. Preapproved MOs will bring along its safety-related digital descriptions and can be integrated.

During the third internal implementation phase, a temporary production shutdown is required to conduct the system modification. The selected MOs are now integrated into the production environment. A system risk assessment and a safety approval will take place (approval of the complete Base described in this paper). The interlinking of the integrated MOs will be risk assessed and, if necessary, optimisation/mitigation suggestions will be made. The documentation phase ensures that requirements based on the Machinery Directive [2] are fulfilled and represents the final step before the new system configuration is commissioned. This required documentation contains e.g. operating manuals, conformity declarations, involved production costs and hazard/risk assessment documents.

4 Fluid Production Safety 4A-Framework (FluPro-S4A)

Based on the modeling and the commissioning process explained in Sect. 3, a framework called FluPro-S4A is proposed for the integrated safety management/assisted risk assessment of fluid production systems (Fig. 2). During these presented assessment procedures, the acquired up-to-date system model that represents the production system will be used as foundation for all the conducted assessments. The FluPro-S4A framework constitutes four main steps described as follows:

  1. 1.

    Change Acknowledgement: This step represents the starting point of the framework and is usually triggered manually by the operator after a system modification or automatically by a monitoring system. The up-to-date system model will be checked and its changes acknowledged for the subsequent steps. (see Sect. 4.1)

  2. 2.

    Asset Assessment: If system changes are identified, every integrated asset will be assessed to ensure its validity. This is to ensure that the assets fulfill the basic requirements for operation. (see Sect. 4.2).

  3. 3.

    System Assessment: During this overall system assessment, the whole production system (i.e. system model) will be assessed using our developed methods (see Sect. 4.3) to ensure that all identified risks are properly addressed and mitigated by the available safety measures.

  4. 4.

    Approval Assistance: In the final step (see Sect. 4.4), relevant methods will be applied to show how the assessment results can be post-processed to support safety engineers during decision-making.

Fig. 2.
figure 2

The proposed FluPro-S4A framework for an integrated assessment

Full size image

Using the FluPro-S4A framework, the operator can also improve the production system configuration gradually based on the generated assessment results. As can be seen in Fig. 2, if adjustments to the production system are made, a reassessment can be triggered to reevaluate the system configuration. The system model will be updated digitally and the aforementioned four assessment steps will be conducted again. In the following subsections, detailed descriptions will be provided for the four assessment steps within FluPro-S4A framework.

4.1 Step 1: Change Acknowledgement

A fluid production system is described by the modeling method explained in Sect. 3 and represented digitally using a system model. Through this semantic data model of the system, the structural interconnections between the assets and the base system can be described and visualized digitally, which enables the change identification and acknowledgement of the fluid production by comparing both the states before (S) and after (\(S^{'}\)) a system change. This change acknowledgement analysis will look through both the base and the asset level to identify the type of system change. The three possible types of system changes are base structural changes (changes at the level of production systems), asset structural changes (changes within a Base) or asset configuration changes (changes of a MO/asset itself). Each of these types will have different implications and will be assessed differently (further details will be provided in the subsequent Sect. 4.3).

4.2 Step 2: Asset Assessment

The main focus of this assessment step is to ensure that the integrated production assets have properly gone through the safety preappoval stage before being integrated into the overall fluid production. The status of an asset can be issued during the preapproval stage and is represented by its approval status. A confirmation of the approval status is required to guarantee its validity and to avoid data incompleteness during the System Assessment. Operators will be guided by the framework to properly deal with invalid assets during the asset integration. We define four types of approval status with the following explanation:

  1. 1.

    Status “approved”: The asset has been checked during the preapproval stage and its risks are eliminated inherently. The Asset can be integrated within the fluid production without additional safety measures.

  2. 2.

    Status “pre-approved”: The asset has undergone the preapproval procedures and possesses residual risks that cannot be fully eliminated by itself. Further safety measures have to be applied and confirmed during the overall System Assessment.

  3. 3.

    Status “expired”: An expired asset loses its approval validity and needs to be reapproved before being integrated into the fluid production. Possible reasons for an “expired” status are the necessity for an inspection after a predefined timeframe.

  4. 4.

    Status “awaiting approval”: The asset has not gone through the safety preapproval stage and requires preapproval to ensure its data completeness during the overall System Assessment.

4.3 Step 3: System Assessment

The overall System Assessment ensures that possible risks due to the combination of all integrated production assets within the fluid production are properly identified and mitigated. Using the methods proposed in this paper, the process can be conducted in a semi-automated manner to provide assistance to users during the commissioning phase and consists of two parts with different purposes: (1) the identification of emerging risks based on the combination of assets, (2) the integrated process to provide safety evidences for the approval.

Identification of Emerging Risks Due to Combination of Assets

During the consideration of emerging risks (i.e. risks resulting of the overall system configuration), several factors need to be taken in account. Firstly, risks might arise due to visible root causes (e.g. movement of a mechanical components) or due to non-visible reasons (e.g. timing behaviour). Secondly, possible relevant risks might not be completely identified or implied digitally. This means that user role remains crucial during the hazard/risk identification process. We propose the following methods to assist users in identifying emerging risks for fluid production:

  1. 1.

    Simulation: The application of simulation-based approaches, such as mechanical analysis using physics engine or non-mechanical analysis, allows a better understanding of the system behavior after integration. Possible emergent failures or risks can be identified using these methods.

  2. 2.

    Logical implication: Logical implication is useful where information is incomplete or provided in a rather abstract way. The identified risks from this implication will contain uncertainty and should be confirmed manually by users or experts. An exemplary scenario to apply this method is “if an asset with kinematics (i.e. robot) is integrated, possible crushing points will occur in the working space”.

  3. 3.

    Guided questionnaire: Guided questionnaire can be applied in situations where simulation-based approaches and logical implication are not possible or too complex to be modelled digitally. As an asset might have specified conditions that have to be fulfilled to guarantee its safe operation, a questionnaire to guide the operators during the identification and the analysis of emergent risks can be helpful.

Proposal of an Integrated Process for the Fluid Production

Based on the possible types of system changes for fluid production stated in Sect. 4.1 and the proposed methods for the identification of emerging risks, an integrated process for the overall System Assessment can be defined (visualized in Fig. 3) to categorize, identify and assess risks related to a concrete system configuration (represented by System Model).

As can be seen in Fig. 3, a series of steps are defined within this System Assessment based on our proposed methods for fluid production. Previously identified risks from the preapproval stage that are provided by every integrated asset will be updated to the risk list. By comparing both the previous (S) and the current state (\(S^{'}\)), the involved types of changes can be identified. Different software modules can be activated throughout the process to guide the user in completing the safety approval/risk assessment procedures.

Fig. 3.
figure 3

The proposed exemplary procedures based on our addressed case study for fluid production

Full size image

4.4 Step 4: Approval Assistance

The final step within the FluPro-S4A framework focuses on methods to provide assistance and to increase the efficiency of the approval process. Current legislative requirements only allow semi-automated, but not fully automatically generated results so far. Future work will be done to clarify and to enhance the decision making by a software.

5 Case Study

For a clearer understanding, a case study for the assembly of a small electrical control unit, comparable to those widely used in the automotive industry, is demonstrated (see Fig. 4). This case study shows a possible scenario in fluid production, in which previously unused MOs can be integrated seamlessly into production based on the required production changes. We model the system using our presented approach to describe the Base and the MOs (see “3” in Fig. 4). Besides, we also demonstrate the application of different software tools for the integrated safety management within the fluid production:

  • The preapproval tool can be used to assist the user during the hazard analysis and the preapproval of individual MO. The tool is integrated into the communication infrastructure and will update the digital model with the relevant hazard/risk descriptions of the MO for further analysis in the subsequent steps. (see “2” in Fig. 4)

  • The system safety assessment/approval tool called AutoSafety based on [10] can be used to assess the overall system configuration. Data can be extracted from the preapproval phase and be further analyzed. Different software analysis modules and simulations can be implemented and applied based on our approaches proposed in Sect. 4.3. (see “4” in Fig. 4)

With the new system configuration completely risk assessed, documented and finally approved by the responsible safety engineer under the assistance of the aforementioned tools, the new production process can now operate with minimal downtime and reduced manual effort.

Fig. 4.
figure 4

Demonstration of the presented approach for an assembly process and the usage of software tools for the preapproval and risk assessment/system approval phases

Full size image

6 Conclusion and Future Work

This paper presents an integrated approach to enable the dynamic safety management and risk assessment for fluid, reconfigurable production scenarios. By using our presented framework called Fluid Production Safety 4A-Framework (FluPro-S4A), modular I4.0 production assets and its data can be modelled considering both functional and safety-related aspects. Besides, different assessment/approval steps are presented to capture system changes, to support risk assessment, and to analyze the respective safety impact in a systematic and seamless manner. This framework contributes to a more efficient safety management, enables interoperability of vendor-independent production assets with safety guarantees and lays the foundation for the successful execution of fluid production systems for future factories. Future work includes further optimization of the approval procedures and the development of methodologies to better identify emerging risks for fluid production.