A Method to Formally Evaluate Safety Case Evidences against a System Architecture Model

Abstract

For a large and complex safety-critical system, where safety is ensured by a strict control over many properties, the safety information is structured into a safety case. As a small change to the system design may potentially affect a large section of the safety argumentation, a systematic method for evaluating the impact of system changes on the safety argumentation would be valuable.We have chosen two of the most common notations: the Goal Structuring Notation (GSN) for the safety argumentation and the Architecture Analysis and Design Language (AADL) for the system architecture model. In this paper, we address the problem of impact analysis by introducing the GSN and AADL Graph Evaluation (GAGE) method that maps safety argumentation structure against system architecture, which is also a prerequisite for successful composition of modular safety cases.In order to validate the method, we have implemented the GAGE tool that supports the mapping between the GSN and AADL notations and highlight changes in impact on the argumentation.

An Industrial Survey of Safety Evidence Change Impact Analysis Practice

“…Prior work studied the evolution of safety analyses and assessments [40] and the possible impact of architectural changes in safety cases [3]. Recent models for safety certification explicitly address SECIA needs (e.g., [13]), such as the specification of the effects that a change in an artefact type can have in other types.…”

“…In fact, this approach is recommended in some safety standards, explicitly (e.g., Defence Standard 00-56) or implicitly (e.g., EN 50129). Consequently, it would be logical that the median for Safety Cases in Table 3 was higher than "some projects", and that Safety Cases had strong or very strong correlations with more artefact types (e.g., Architecture Specifications, in line with [3]). Albeit "every project" was the mode for Safety Cases in Table 3, 28.8% of the respondents indicated that Safety Cases had never been affected by changes or had been affected in few projects.…”

Evaluating models for the inclusion in a safety assessment framework for efficient transport

“…The EU funded project MODSafe provides a risk analysis method purposed to combine potential hazards, safety requirements and functions, and link these elements to a generic functional and object-oriented structure of a guided transport system. The SaferCer project (Björnander, 2012) provides a generic process model for integrated certification and development of component based systems, including an overall picture of the development and verification of components and systems. ASCOS (Roelen, 2014) focuses on safety and certification of new aviation operation and systems, including advices on methods and tools for safety based design.…”