🎓 Lesson 9
D5
Safety Validation Test Plan Development
A Safety Validation Test Plan is a step-by-step roadmap that proves an autonomous haulage system (AHS) operates safely under real mining conditions before full deployment.
🎯 Learning Objectives
- ✓ Design a traceable SVTP aligned with ISO 26262 ASIL-B requirements
- ✓ Analyze hazard logs to derive at least five critical test scenarios for AHS interaction zones
- ✓ Apply SIL verification methods to calculate required proof-test intervals for safety-critical sensors
- ✓ Explain how validation evidence maps to functional safety claims in a Safety Case
📖 Why This Matters
In 2023, three major iron ore mines reported near-miss incidents during AHS ramp-up due to unvalidated edge-case behaviors—like blind-spot detection failure during simultaneous loading and dumping. A robust Safety Validation Test Plan isn’t paperwork—it’s the engineering safeguard that prevents catastrophic failure when autonomy meets complex, dynamic mine environments. Without it, regulatory approvals stall, insurance coverage lapses, and operational trust erodes.
📘 Core Principles
Safety validation for AHS rests on three interdependent pillars: (1) Hazard-driven test derivation—using HAZOP and STPA outputs to identify failure modes; (2) V-model traceability—linking safety requirements → design specifications → test cases → evidence; and (3) Confidence-based verification—applying statistical confidence bounds (e.g., 95% confidence in <10⁻⁶ failures/hour) through fault injection, scenario replay, and field exposure testing. Unlike traditional equipment validation, AHS validation must account for emergent behavior from AI decision logic, sensor fusion uncertainty, and human-in-the-loop variability across shifts and weather conditions.
📐 Required Test Exposure Time for SIL 2 Validation
This formula calculates minimum operational exposure time needed to statistically validate a safety function’s failure rate target, based on observed failures and desired confidence level.
SIL Validation Exposure Time (Bayesian, r=0)
T_min = χ²(1−α, 2) / (2 × PFH_target)Minimum operational exposure time required to statistically validate a safety function’s probability of dangerous failure per hour (PFH) target at specified confidence level.
Variables:
| Symbol | Name | Unit | Description |
|---|---|---|---|
| T_min | Minimum validation exposure time | hours | Total accumulated safe operating time required to claim SIL compliance |
| χ²(1−α, 2) | Chi-square value | dimensionless | Critical value from chi-square distribution for confidence level (1−α) and 2 degrees of freedom |
| PFH_target | Target probability of dangerous failure per hour | h⁻¹ | Maximum allowable failure rate per SIL level (e.g., SIL 2 = 1×10⁻⁶ h⁻¹) |
Typical Ranges:
SIL 2 AHS proximity function: 2.0×10⁶ – 5.0×10⁶ hours
SIL 3 brake control function: 2.0×10⁷ – 1.0×10⁸ hours
💡 Worked Example
Problem: An AHS proximity warning system must achieve SIL 2 (PFH ≤ 1×10⁻⁶). During factory testing, zero failures were observed over 2,500 operating hours. What minimum additional field exposure time is required to claim SIL 2 with 95% confidence?
1.
Step 1: Identify parameters — PFH_target = 1×10⁻⁶ h⁻¹, confidence = 95% (α = 0.05), observed_failures = 0
2.
Step 2: Apply Poisson-based confidence bound: T_min = -ln(α) / PFH_target = -ln(0.05) / (1×10⁻⁶)
3.
Step 3: Compute: ln(0.05) ≈ -2.9957 → T_min ≈ 2.9957 × 10⁶ hours ≈ 342 years of continuous operation — but since zero failures occurred, use Bayesian lower bound with non-informative prior: T_min = χ²(1−α, 2×(r+1)) / (2 × PFH_target), where r = 0 → χ²(0.95, 2) = 5.991 → T_min = 5.991 / (2 × 1×10⁻⁶) = 2.9955×10⁶ hours
Answer:
The calculated minimum exposure time is ~3.0 million hours (~342 years continuous). However, industry practice combines this with fault injection (e.g., 10,000 simulated sensor faults) and scenario-based testing per ISO 26262 Annex D to achieve practical validation within 6–12 months of phased deployment.
🏗️ Real-World Application
At Rio Tinto’s Gudai-Darri mine (Western Australia), the SVTP for their Cat® Command™ AHS fleet included 1,200+ test cases derived from 47 identified interaction hazards (e.g., 'truck entering shovel swing radius during auto-dump'). Each case was executed across 3 shift patterns, 4 weather states (dry, wet, fog, dust), and 2 communication latency profiles (5G vs. LTE fallback). All test results were logged in a digital twin environment and cross-referenced to ISO 26262 Part 5 clauses. The plan enabled successful audit by WA Department of Mines, Industry Regulation and Safety (DMIRS) and reduced commissioning timeline by 38% versus previous AHS deployments.
🔧 Interactive Calculator
🔧 Open Autonomous Haulage Systems Integration Calculator📋 Case Connection
📋 Underground Copper Mine AHS Deployment at Codelco El Teniente
Limited GNSS availability, high dust, and narrow ramps requiring <1.2m lateral accuracy
📋 Limestone Mine Geofence Integrity Validation at Heidelberg Materials Buxton
Standard geofences failed during seismic events, triggering false emergency stops and production loss