Tool support for assurance case development

Abstract

Argument-based assurance cases, often represented and organized using graphical argument structures, are increasingly being used in practice to provide assurance to stakeholders, e.g., regulatory authorities, that a system is acceptable for its intended use with respect to dependability and safety concerns. In general, comprehensive system-wide assurance arguments aggregate a substantial amount of diverse information, such as the results of safety analysis, requirements analysis, design, verification and other engineering activities. Although a variety of assurance case tools exist, many desirable operations on argument structures such as hierarchical and modular abstraction, argument pattern instantiation, and inclusion/extraction of richly structured information have limited to no automation support. To close this automation gap, over the past four years we have been developing a toolset for assurance case automation, AdvoCATE, at the NASA Ames Research Center. This paper describes how AdvoCATE is being engineered atop formal foundations for assurance case argument structures, to provide unique capabilities for: a) automated creation and assembly of assurance arguments, b) integration of formal methods into wider assurance arguments, c) automated pattern instantiation, d) hierarchical abstraction, e) queries and views, and f) verification of arguments. We (and our colleagues) have used AdvoCATE in real projects for safety assurance, in the context of unmanned aircraft systems.

Model based system assurance using the structured assurance case metamodel

“…Comparing to GSN and CAE, SACM provides an ideal basis that could underpin AssuranceCase@Runtime in this context, due to the features mentioned later in this section. In [8], the authors motivate the need for automation in assurance case. They point out that assurance case models should link their evidence in order to perform automated reasoning on the validity of assurance cases.…”

Isabelle/SACM: Computer-Assisted Assurance Cases with Integrated Formal Methods

“…Here, we use Isabelle/SACM to model an AC with the claim that TIS satisfies SFR1, using Theorems 5.1 and 5.2 from §5 as evidential artifacts. The GSN diagram for the AC is shown in Figure 8, which is inspired by the "formalisation pattern" [9]. Figure 8 is translated to IAL and the result is show in Figures 9 and 10, which illustrate (1) a machine checked AC; (2) integration of informal, formal, and semi-formal artifacts; and (3) use of Isabelle/UTP verification techniques.…”

“…The formalisation pattern [9] shows how results from a formal method can be used to provide evidence to an AC that claims to satisfy a given requirement {R}. The strategy used to decompose the claim "Informal requirement {R} is met by {S}" is contingent on the validation of both the formal model of {R} and Figure 8, we adapt this pattern as follows.…”

“…Several works bring formality to assurance cases [8,9,11,29]. AdvoCATE is a powerful graphical tool for the construction of GSN-based safety cases [9]. It uses a formal foundation called argument structures, which prescribe well-formedness checks for the graph structure, and allow instantiation of assurance case patterns.…”

“…Our vision, illustrated in Figure 1, is a unified framework for machinechecked ACs with heterogeneous artifacts and integrated FMs. We envisage an assurance backend for a variety of graphical assurance tools [9,30] that utilise SACM as a unified interchange format, and an array of FM tools provided by our Isabelle-based verification platform, Isabelle/UTP [16,17]. Our framework aims to improve existing assurance processes by harnessing formal verification to produce mathematically grounded ACs with guarantees of consistency and adequacy of the evidence.…”