## 4 System Architecture Evaluation
### Safety Analysis  
A preliminary risk identification was performed and helped in identifying the following undesired event \"Undesired contact with operator hands\" during the \"Assembling EMA\" phase where the cobot is close to the operator (c.f. Figure 6). During Assembling  
Figure 10: Workplace logical architecture (Internal block diagram). Figure 9: Breakdown structure of the workplace. EMA phase, the AGV, Cobot and Gripper shall stay motionless while holding the EMA in position so that the operator safely performs the integration tasks (connecting wires and screwing the EMA to the wing). To model this behavior, an AltaRica 3.0 [20] model is built. In this model (c.f. Figure 11), first a class of component is defined in which the component is initially motionless and an event \"inadvertent\" is defined that will make the component become mobile (motionless becomes false). The component also has an input \"in_position\" and an output \"out_position\". Then, the global system is built by instantiating three components that are respectively the AGV, the Cobot and the Gripper. A stepwise simulation allows to play many scenarios with the system. For instance, in Figure 12, we can see that if the AGV moves inadvertently, then the final observer corresponding to EMA_position becomes false. This means that the EMA hold by the Cobot is not in the intended place which means that there is a risk for it to hit or pinch the operator expressed above by the undesired event \"Undesired contact with operator hands\". By simulation of the AltaRica code or by generating the corresponding fault tree ( given in Figure 13), this event can be caused by one of the following events (or failure modes):  
* The gripper moves inadvertently \"Unintended proper motion of the Gripper\"
* The cobot moves inadvertently \"Unintended proper motion of the Cobot\". This would lead to the moving the Gripper consequently. * The AGV moves inadvertently \"Unintended motion of the AGV\" that in turn would result in moving the Cobot and the Gripper. The operator and AGV plus cobot are physically separated by the wing and aileron assembly. However, while displacing and EMA, the cobot may hit the operator. In the same way, while the cobot+gripper handle the EMA prior to connection (mechanical fixation data bus, electrical wiring), the hands of the operator are working in the EMA well area, meaning that his hands may be pinched between the robotic arm and the wing and aileron elements. Then, whatever the reason, if the cobot detects an obstacle during any displacement, it has to drastically reduce its force/torque and stop in order to analyze the situation before any restart. Considering the proposed use case, unwanted contact is more likely to occur between the operator's hands and the robotic arm as represented in the Figure 14. It could occur a quasi-static contact or a transient contact. Referring to the tables provided by the Annex A of ISO/TS 15066:2016, it is possible to identify the maximum permissible pressure and force both in the first and in the second case (see Table 2). Figure 11: AltaRica 3.0 model. Figure 14: Illustration of the most likely contact scenario: both quasi-static and transient contact with the operator’s hands could occur. Figure 12: OpenAltarica stepwise simulation. Figure 13: Fault tree. Furthermore, the maximum permissible energy transfer may be defined as a function of the maximum force or maximum pressure values as stated in Equation (1):  
\[E=\frac{F_{max}^{2}}{2k}=\frac{A^{2}p_{max}^{2}}{2k}; \tag{1}\]  
Where \(E\) is the transfer energy, \(F_{max}\) and \(p_{max}\) are respectively the maximum contact force and the maximum contact pressure for specific body area, \(k\) is the effective spring constant for specific body region (these values is provided by the reference ISO standard), and \(A\) is the area of contact between robot and body region.