• Peter Liggesmeyer, Fraunhofer IESE
•  Rasmus Adler, Fraunhofer IESE 
• Richard Hawkins, University of York 

An autonomous system is capable of independently achieving a predefined goal in accordance with the demands of the current situation. In safety-critical applications, the operational situations may demand some actions from the system in order to keep risks at an acceptable level. This motivates the implementation of algorithms that estimate, assess and control risks during operation. In particular, the risk assessment at runtime is challenging as it implies moral decision making about acceptability of risks: “How safe is safe enough?”. However, it is also challenging to find a suitable notion of risk. IEC and IEC standards define the term “risk” differently following two “root” definitions: “combination of the probability of occurrence of harm, and the severity of that harm” and “effect of uncertainty on objectives”. The first definition is related to the way how integrity levels like SIL and ASIL are determined at design-time. In the session, we will discuss in how far existing design-time approaches can be adopted to implement an autonomous risk management at runtime. For instance, is it reasonable to implement algorithms that determine integrity levels at runtime?

• Detlev Richter, TüV SüD:  

  Digital twin-based hazard analysis at runtime for resilient production

• Simon Burton, Fraunhofer IKS:  

  Prerequisites for dynamic risk management 

• Patrik Feth, Sick AG:   

  Sensors for Dynamic Risk Assessment 

• Michael Woon, retrospect:  

  Being Certain of Uncertainty in Risk