## 5 Application of STPA with POMDP in Collaborative Tasks
### Feasibility Study  
The calculated policy graph \(\pi\) has been employed to assess the defined STPA-related safety model. The main objective of the assessment process is to prove that the resulting policy graph is capable of monitoring the ongoing collaborative task while inferring either successful flows of the scenario or by extracting the loss scenarios during human-robot collaboration. The validation of the policy graph \(\pi\) has been conducted with simulation experiments upon which the collaborative scenario has been executed for 100 epochs. We assumed that, in each epoch, the system initiates from a fixed state, which indicates the start of the collaborative task. For the simulation, we employed the Matlab software and created a sequence of actions and their respective observations with logical connections that can eventually resolve the collaborative task. The policy graph \(\pi\) (calculated through the [PERSON]'s solver) was utilized as a transition map, in accordance to which, for each selected action, a random selected observation that corresponded to the specific controller was generated through the simulation script. The observation probability function followed the uniform distribution based on the control process that was referred to. Given a selected observation and the past sequence of actions-observations, the transition probability was calculated and based on the indexing of the policy graph \(\pi\) the system transited from one state to the other, populating, respectively, the simulation script to be transited to the next state. In our experiment, each simulation epoch was terminated either when the system has selected the specific action linked to the final state of the collaborative task or when the system has reached an action that indicated that the system cannot recover any further, the collaboration task has not been completed and a sequence of unsafe control actions has occurred. Considering the fact that a loss scenario describes the causal factors that can lead to the unsafe control actions and to hazards, and given the complexity of the studied  
Figure 4: Control structure for the collaborative task. system, our POMPD-modeled STPA can track and define loss scenarios associated with the control path. When such a type of situation occurred, the selected--through the POMDP model--sequence of actions constitutes the loss scenarios in accordance to which when specific type of observations occur in each system state, it prompts the system to select the respective actions, the sequence of which end up with a loss scenario. The duration of each simulation epoch was approximately 2 s \(\pm\) 0.02 s, measured on an Intel Core i7 CPU at 2.8 GHz. The 60 iterations corresponded to the selection of a sequence of actions that completed successfully the collaborative tasks. The 25 epochs resulted in sequences of actions corresponding to loss scenarios, while the result of the other 15 simulation epochs corresponded to an already appeared loss scenario. Each identified loss scenario has been further examined for its logical flow and found to be valid, i.e., based on specific sequence of safe, unsafe and recovery actions, the identical loss scenario can occur. The evaluation of the simulation scenarios has been performed manually by comparing the sequence of actions with the logical states defined in the initial script. In Figure 5, three selected scenarios are graphically illustrated. On top, the first sequence of selected actions that corresponds to a successful collaborative task is presented. In the middle and the last row of Figure 5, two loss scenarios are outlined. Note that the existence of an unsafe control action \(A_{UCA}\) does not indicate that the system will directly pass to a loss scenario. Our model also supports recover states \(S_{R}\) that through to \(A_{RCA}\) prompt the system to select actions that will transit the system into safer states \(S_{S}\). Figure 5: Example of state diagrams corresponding to three different different simulation executions.