Piero Baraldi

Francesco Di Maio

Enrico Zio

UMR7039 Romain Duponnois Cran
email: romain.duponnois@inrs.fr

Pascal Lamy
email: pascal.lamy@inrs.fr

Eric Levrat
email: eric.levrat@univ-lorraine.fr

Ali Siadat
email: ali.siadat@ensam.eu

Working Situation Reference Model for Risk Assessment on Automated Assembly Lines

Keywords: hazardous situation, man-machine interactions, occupational safety, risk assessment, system model, technical drift, working situation, working situation health monitoring

Safety rules and regulations, including the European "Machine" Directive 2006/42/EC, require consideration of worker safety when designing automated machinery, but occupational injuries resulting from using machines have not completely disappeared from industrial landscape. The French National Research and Safety Institute for the Prevention of Occupational Accidents and Diseases (INRS) addressed one of the causes of these occupational injuries, namely technical drift of machinery causing work situation deviation, which forces the worker to adapt and act in a non-nominal way. These reactions can place the worker in a hazardous situation. To anticipate this type of hazardous situation, the present study proposes development of an original Working Situation Health Monitoring approach that will aim to define indicators of potential occurrence of hazardous situations. These indicators will be based on the results of malfunction and risk analyses of the working situation through interactions between its components. In supporting these analyses, this work proposes to use a model of the working situation from a worker's safety standpoint. The purpose of this publication is to introduce the proposed working situation model and the resulting enhancement of working situation understanding, in particular, by the representation of interactions between working situation components.

Introduction 1.1 Study background

Since 2013, the French National Research and Safety Institute for the Prevention of Occupational Accident and Diseases (INRS) has been conducting prospective research aimed at considering changes in the world of work with the aim of identifying possible futures and their consequences on health and safety at work. More specifically, the objective has been to identify the future needs of prevention, guide its medium-term policy and identify levers for action.

The Automated Work System and Equipment (SETA) laboratory at INRS conducts research on the safety of automated installations or on the safety of machines with different operating modes (automatic, manual, etc.) to protect operators or others from so-called "machine" risks, in particular mechanical risks related to mobile work elements, when using these machines.

User protection must be taken into account at machine design stage (Directive 2006/42/EC (CE 2006) and related standards). The manufacturer must then provide appropriate protective measures based on the state of the art. However, in practice, the operating context causes the equipment or production process to drift and cause the operator to react to this disturbance. By following an inappropriate operating mode, the operator can then place himself in a hazardous situation that could lead to an accident.

With a view to improving operator safety, the idea is to examine whether detection and identification of these hazardous situations are feasible so they can be anticipated and the potential consequences of work situation drift towards hazardous working conditions can be prevented.

This research forms part of a PhD thesis conducted in collaboration by INRS, the Research Center for Automatic Control (CRAN) and the Laboratory for Conception Fabrication and Command (LCFC). This PhD research follows on from four Master's research projects and an internal research project all conducted at INRS.

Concepts definitions

To help in a better understanding this paper, we provide the following definitions:

Situation. Described in the Cambridge Dictionary (Dictionary 2017) as "the set of things that are happening and the conditions that exist at a particular time and place".

This definition can be broken down into different elements:

 "The set of things […]": elements of the situation (physical object, living being, organization, etc.)  "[…] that are happening […]": a situation is dynamic  "[…] the conditions that exist […]": the context of the situation, the condition of its existence  "[…] at a particular time […]": the temporal dimension of the situation  "[…] and place": the spatial dimension of the situation.

Working situation. A situation defined in a working system. The same standard describes a working system as a "System comprising one or more workers and work equipment acting together to perform the system function, in the workspace, in the work environment, under the conditions imposed by the work tasks".

In the remainder of this publication, the context of our study will only take into account a working situation on an automated assembly line.

Dangerous/Hazardous situation. Described in ISO Standard12100:2010 (ISO 2010) as the "circumstance in which a person is exposed to at least one hazard". The concept of hazard is described in the same standard as a "potential source of harm (physical injury or damage to health)".

Paper structure

The remainder of this paper is structured as follows.

Section 2 presents an overview of the proposed method of answering the question: can we anticipate a hazardous situation by monitoring a working situation?

Section 3 introduces the proposed working situation's reference model.

Section 4 concludes by summarizing the work and overviewing future development of the proposed reference model and method.

A proposed method: Working Situation

Health Monitoring (WSHM)

Overview of the method

Working Situation Health Monitoring (WSHM) emanates from a single question: can we monitor a working situation, originally safe, to anticipate the apparition of a hazardous situation due to technical drift? Our work has been inspired by existing health management tools, e.g. Prognostic and Health Management described in ( [START_REF] Kalgren | Defining PHM, a lexical evolution of maintenance and logistics[END_REF][START_REF] Cocheteux | Contribution à la maintenance proactive par la formalisation du processus de pronostic des performances de systèmes industriels[END_REF])) for anticipating apparition of a hazardous situation. The outcome of the proposed WSHM method is to provide health indicators of the working situation, i.e. the greater the potential for apparition of a hazardous situation in the near future, the lower the quality of health.

To build these indicators, we need to identify the maximum hazard potential, which may emerge of the analyzed working situation. We therefore propose analyzing the malfunctioning of interactions that occur during the working situation. This proposition lie on the fact that this method will analyze the working situation as a whole: elements (operator, machine, product …) interacting with each other's.

All the nominal interactions present in the nominal, drift-free working situation must be identified to analyze interaction malfunctioning.

Interactions in a working situation

The working situation is the situation defined in a working system. The concept of interaction is at the heart of the notion of system according to (De Rosnay 1995): "A complex system is characterized by the number of elements that constitute it by the nature of the interactions between these elements by the non-linear dynamics of its development". Each system is made up of elements whose interactions form the activities of that system and which, in turn, make it possible to accomplish the system's purpose, its objective, mission and finality. These interactions define the complexity of a system: "Complexity can arise from simple interactions repeated myriad times from elements in constant interaction. A small change can be amplified and lead to highly organized states" (e.g. the so-called butterfly effect). Changes within an interaction have repercussions at a higher or lower level in the organization of the system and its elements. In this study, it is the concept of "minimal change" that interests us: how can "minimal" drifts of the situation cause malfunctioning of the whole situation?

Before trying to study the drifts within interactions, it is interesting to look at the different ways of representing interactions. An interaction can be represented through a "sourcesink" relationship. This approach allows us to represent an interaction by comparing the interaction with a "message" [START_REF] Lieber | Improving physical-physiological interaction requirements for maintenance enabling systems specification[END_REF][START_REF] Bouffaron | Integrative construct for model-based humansystem integration: a case study[END_REF].

This "source-sink" representation can also be found in the MADS risk analysis method [START_REF] Perilhon | MOSAR-Présentation de la méthode[END_REF]:

 The source is the source of the hazard  The sink is the object vulnerable to the hazard generated by the source.

Interaction in a working situation on an automated assembly line

According to [START_REF] Bouffaron | Integrative construct for model-based humansystem integration: a case study[END_REF], interaction elements in a work situation involving automated equipment include:  A user (worker, operator, ...) "User"  A control part (which controls the operating part) "Automation"  An operating part (whose action transforms the product) "Process". Figure 1 illustrates the interactions between these elements. These interactions can be split into three categories. Automation-Process interactions also contribute to form "a partially information representation (in the world of logic) of the process part (in the world of physics) but restricted to what can be perceived by instrumentation with the remaining problem of its location." [START_REF] Bouffaron | Integrative construct for model-based humansystem integration: a case study[END_REF]). These interactions allow the automated work equipment (machine) to "perceive" the current state of the process. This perception is limited by the information generated by various sensors.

Automation-User interactions -IAU

"IAU provides the interface between operators and the related automated/digitalized devices at plant level, including for warning purposes." [START_REF] Bouffaron | Integrative construct for model-based humansystem integration: a case study[END_REF]). These are interactions that are perceptible by the automated work equipment (e.g. pressing a pushbutton). Automation-User interactions are helpful for the process sequence (e.g. launching an assembly cycle) but they can also be information provided by the machine operator (information imperceptible to the machine or too complex for it to acquire).

User-Process interactions -IUP

"Missing information to form a more complete representation of the process to control is collected by FOs [Field Operators]." [START_REF] Bouffaron | Integrative construct for model-based humansystem integration: a case study[END_REF].

"By so doing, FOs [Field Operators] perceive and interpret many physical phenomena and provide the necessary amount of information which consequently is not digitalized. [...] So, mastering IUP is vital to face a lot of non-nominal situations which are not under the artefact control." [START_REF] Bouffaron | Integrative construct for model-based humansystem integration: a case study[END_REF].

This information also enables the operator to make decisions in the event of non-nominal behavior of automated equipment [START_REF] Endsley | Situation awareness global assessment technique (SAGAT)[END_REF][START_REF] Boyd | OODA loop[END_REF][START_REF] Boy | On the complexity of situation awareness[END_REF].

On the other hand, IUP can also be the actions of the operator on the process and, in particular, actions on the product that are not directly perceived by the automated equipment [START_REF] Bouffaron | Integrative construct for model-based humansystem integration: a case study[END_REF]. The fact that IUP are not directly perceptible by the automated equipment does not mean that these interactions are imperceptible by the machine.

Interaction types

To extend our understanding of these interactions, we propose dividing them into three "types" of interactions in keeping with the three "types of messages" proposed in [START_REF] Guiochet | Hazard analysis of human-robot interactions with HAZOP-UML[END_REF], when studying an aid-to-individual robot:  Physical ("Physical"): "direct contact between the physical structure of the robot and the user" [START_REF] Guiochet | Hazard analysis of human-robot interactions with HAZOP-UML[END_REF]). This type of interaction is a direct contact between the physical structures of several elements of the situation  Sensory ("Cognitive"):

"gesture or voice/audio signals are exchanged". Transmission of message/information by one of the following senses: hearing, sight, smell (natural sensor). "Touch" being used in "Physical" type interactions. These interactions are those that are potentially the most disturbed [START_REF] Bouffaron | Integrative construct for model-based humansystem integration: a case study[END_REF])  Informational ("Indirect interaction"): "[interaction] through the robot teach pendant (hardware or software interfaces" [START_REF] Guiochet | Hazard analysis of human-robot interactions with HAZOP-UML[END_REF]. Exchange of information between different elements of the system or within the same element of the system (interaction between the control part and the operating part of an automated equipment through a control circuit, man-machine interaction through an HMI...). This also includes the information retrieved by artificial sensors on the work equipment.

Conclusion on interactions

Interactions within a system are subject to resilience, just like system elements. If one of these families of interactions is disrupted, the others can be modified to allow the system to be resilient. The advantage of Man in this kind of situation is that he is able to adapt, unlike the rest of the elements of the work system (machine, product, etc.) [START_REF] Pariès | De l'obéissance à la résilience, le nouveau défi de la sécurité[END_REF][START_REF] Pariès | Rule-based vs managed safety : from compliance to resilience[END_REF][START_REF] Pariès | Resilience engineering in practice: a guidebook[END_REF]. Change in behavior of an element of the working situation will be reflected in other elements by its interactions with them.

As described in (Bouffaron, Dupont et For these two reasons, we propose studying IUP through their repercussions on the interactions perceptible by the automated equipment: IAU and IAP.

 The sensory interactions within IUP provide information to the operator that can make him change his behavior. Changes that can be reflected by an alteration of IAU or physical IUP (Lamy and Perrin 2018)  Physical and informational IAP can be altered by physical IUP [START_REF] Laloix | Méthodologie d'élaboration d'un bilan de santé de machines de production pour aider à la prise de décision en exploitation: application à un centre d'usinage à partir de la surveillance des composants de sa cinématique[END_REF].

It should also be noted that, while IUP interactions are not directly perceptible by the automated equipment but are perceptible by the operator, the reverse is true for IAP interactions: these are not directly perceptible by the operator but are perceptible by the production equipment.

We need to represent a working situation in order to identify and classify all the interactions taking place within it. This work therefore involves modeling the working situation based on a proposed working situation reference model.

Proposed working situation reference model for WSHM

The proposed reference model is an entity relationship model. In the proposed WSHM method, this reference model is a framework for a systemic working situation representation. Such a representation is designed to assist in understanding and analyzing the working situation as a whole including its constituent elements and the interactions between them. The proposed reference model has been inspired by the MOSTRA representation introduced in [START_REF] Bernard | Working situation model for safety integration during design phase[END_REF][START_REF] Hasan | Contribution à l'amélioration des performances des systèmes complexes par la prise en compte des aspects socio-techniques dès la conception: proposition d'un modèle original de situation de travail pour une nouvelle approche de conception[END_REF][START_REF] Hasan | Integrating safety into the design process: elements and concepts relative to the working situation[END_REF]. The authors described the MOSTRA as a tool to assist the working situation designer: "In their work, designers have recourse to technical, functional and even economic and legislative databases. Modelling tools are limited to primarily geometric modelling representing the size of the product and the qualities of the associated functional surfaces.

[…] The aim of our research is to take account of the ''system behavior'' viewpoint in order to prevent the risks linked to its utilization." [START_REF] Hasan | Integrating safety into the design process: elements and concepts relative to the working situation[END_REF]. Our proposed reference model addresses the same intention but also aims at extending understanding of existing working situations and helping risk analysis of these situations considering their potential drift from nominal behavior.

Figure 2 illustrates an overview of the reference model's graphical representation.

Each model element has the attribute:

 Id: integer used to number each model element.

The following section describes all the model elements and their respective attributes.

Workspace and work environment

A working system is physically positioned in a workspace.

A workspace object is defined by the following attributes:

 Position: 3-dimensionnal coordinates of the center of zone  Volume: 3-dimensionnal volume of zone.
The work environment is described in ISO Standard 6385:2016 as the "physical, chemical, biological, organizational, social and cultural factors surrounding a worker" (ISO 2016). In the present study, the work environment is defined as the whole physical, chemical and biological workspace environment.

A work environment object has the following attributes:

 Physical: list of all physical values measurable in the work environment atmosphere (e.g. Temperature, Pressure…)

 Chemical: list of all chemical elements in the work environment  Biological: list of all biological elements in the work environment

Working system

The center of the proposed reference model is the working system.

Within the scope of this study, the concept of work system has been inspired by ISO Standard 6385:2016, which defines "a system consisting of one or more workers and work equipment, acting together to accomplish the function of the system, within the work space of the work environment, according to the conditions of execution of the tasks to be performed" (ISO 2016).

The working system object is defined by the following attributes:

 Finality: text-based description of the general purpose of the working system  Mission: text-based description of the mission of the working system. Based on the definition of system mission given in SEBoK, namely "The mission of a system is the top-level function of the system; the one that synthesizes all transformation of all inputs and solicitations into outputs and reactions." (SEBoK 2019).

Worker

The working system is composed of at least one human worker (in line with the ISO Standard 6385:2016 definition), specifically a "person performing one or more activities to achieve a goal within a work system" (ISO 2016). Each worker object is defined by the following attributes:  Danger: a Boolean value that indicates whether the worker is in danger (i.e. if Danger equals TRUE the worker is in danger). It is important to note that the model does not go further in describing each human worker present in the working system. The model and more generally the WSHM method focuses more on "how" each worker interacts with the other elements of the working system than on describing the worker and his/her precise modeling.

Work equipment, tool and machine

The working system is also composed of at least one work equipment (in line with the ISO Standard 6385:2016 definition), specifically "tools, including hardware and software, machines, vehicles, devices, furniture, installations and other components used in the work system" (ISO 2016).

Within the study scope (automated assembly lines), each work equipment object is composed of at least one machine (automated equipment) and can also be composed of tools (nonautomated equipment that can be used directly by the worker).

Each tool is defined by the following attributes:

 Function: textual description of nominal object function  Shape: 3-dimensional volume of physical object.

Each machine is defined by the following attributes:

 Function  Position: 3-dimensional coordinates of physical object center  Shape.

Each machine is composed of one or more elements. Each element of a machine is defined by the following attributes:  Function  Position  Shape  EnergyIn: list of all object energy inputs; this list can help in identifying a hazardous phenomenon such as the one described in (de Galvez, Marsot et al. 2017)  EnergyOut: list of all object energy outputs.

Each element can also be composed other components (i.e. sub-elements).

Product

Within the study scope (working situation on automated assembly line), the purpose of the working system is considered to be transformation/assembly of different objects into a combined product.

Each object is defined by the following attributes:

 Position  Shape  Flow: float representing production frequency (within study scope, assembly frequency).

Activity and Interaction

The working system carries out one or more activities. These activities are steps in accomplishing of the working system's mission.

The ISO Standard 6385:2016 application context is working situation/system design. Our proposed reference model represents a working situation/system in operation so the following changes are taken into account:  Activities are assigned to one or more elements of the working situation.  The concept of "task" is present in the proposed reference model as "activity" : "effectively do" as opposed to "tasks" described as "prescription" (Boy 2017);  An activity can be composed of one or more activities (i.e. Sub-activities);

Each activity object is defined by the following attributes:

 Actors: list of all the working systems taking part in the activity and all products used in the performing the activity or resulting from the activity  ActivityType: textual description of the activity. Type can refer to one of the activities performed during nominal use of working equipment listed in ISO Standard 12100:2010 (ISO 2010)  PreCondition: list of conditions that must be valid before the activity can be started (inspired from "Preconditions" of a Use-case in the HAZOP-UML method [START_REF] Guiochet | Hazard analysis of human-robot interactions with HAZOP-UML[END_REF]))  PostCondition: list of system states on completion of the nominal activity (inspired from "Postconditions" of a Use-case in HAZOP-UML method (Guiochet 2016));  Invariant: list of conditions that must stay valid throughout the activity to ensure activity safety [START_REF] Guiochet | Hazard analysis of human-robot interactions with HAZOP-UML[END_REF])  TimeStart: time value of activity start  Duration: time duration of activity performance.

Interactions can be seen as "basic" activities between only two elements of the working situation. The "basic" nature of the interaction means it is defined like an activity but with the following differences:

 Actors replaced by:  Source: name of element source of interaction  Sink: name of element target of interaction.  ActivityType replaced by:  InteractionType: physical, sensory or informational.  Function replaced by:  Message: description of energy, signal or information transferred. Each hazardous phenomenon creates a hazardous zone in the workspace. Each zone is described by the following attributes:

 Position: 3-dimensional coordinates of zone center  Influence: 3-dimensional volume of zone affected by the hazardous phenomenon.

Figure 1 .

 1 Figure 1. IAU, IAP, IUP; Interactions between process, user and automation within process control (Bouffaron, Dupont et al. 2014) 2.3.1 Automation-Process interactions -IAP These interactions are supported "by instrumentation and information control systems" with the aim of performing data acquisition and operating various actuators within the process [Operational part].Automation-Process interactions also contribute to form "a partially information representation (in the world of logic) of the process part (in the world of physics) but restricted to what can be perceived by instrumentation with the remaining problem of its location."[START_REF] Bouffaron | Integrative construct for model-based humansystem integration: a case study[END_REF]). These interactions allow the automated work equipment (machine) to "perceive" the current state of the process. This perception is limited by the information generated by various sensors.

Fig. 2 .

 2 Fig. 2. Graphical representation of the proposed working situation's reference model 3.7 Hazardous phenomenon and hazardous zone Some elements of the working situation can generate hazardous phenomena (i.e. the environment, machinery, products, etc.). Each hazardous phenomenon is described by the following attribute:  Energy: textual description of energy source of potential harm (e.g. electrical, mechanical, etc.) (de Galvez, Marsot et al. 2017).

Conclusion

The proposed reference model is a first step to developing the WSHM method. Alone, it can already be used as a framework for working situation/system modeling to assist in understanding all these components, their respective generated hazard and, more importantly, the interactions between all these components during the working system nominal activities in the working situation.

Further research will be carried out to develop the drift analysis aspect for each model element (i.e. physical components, activities, interactions, hazardous phenomena, etc.). The purpose of drift analysis is to assist in understanding:

 The consequences of each drift on working situation behavior and elements  How these drifts will affect the diverse interactions taking place normally in a working situation  How these drifts can influence the safety of a worker in these deviating working situations  Which drifts lead to the most critical hazardous situation.