Driving the Development Process from the Safety Case

Due to high levels of complexity in the design and operation of safety-critical systems, the size and complexity of safety-cases continues to grow. This presents considerable challenges to the development, review and maintenance of safety cases. The independent review into the Nimrod crash in 2006 pointed out the dangers of poor practices in safety cases. It noted that the UK Health and Safety Executive (HSE) has also found a number of problems with safety case practices in its role as regulator. In the past, the area of software architecture has been plundered to provide techniques that aid safety case construction and presentation. This paper argues that this can continue to bear fruit, and demonstrates how the principles of multi-view architecture can be used to produce multi-view safety cases. Multi-view safety cases have the potential to filter information of interest to stakeholders, thus reducing complexity and increasing comprehension of the safety argument. Modifiability and extensibility could be improved, as changes to the safety case can be reviewed more easily through relevant stakeholders' views. (6 pages)

Automotive embedded systems have become very complex, are strongly integrated, and safety-criticality of these systems raises new challenges. Due to this safety-criticality the ISO 26262 road vehicle safety norm was introduced. Development conforming ISO 26262 requires providing consistency of the safety concept during the entire product lifecycle, and supporting evidences, known as and combined via safety case. A safety case is a collection of development artifacts (e.g. test protocols, interface descriptions, domain experts group meeting protocols, certificates) aiming to convince customers or auditors by arguing that the product is capable safe. Establishment of such a safety case is a tedious task, and practical examples and guidelines are yet rather uncommon due to intellectual property reasons.This paper presents the application of patterns to generate a ISO 26262 safety case documentation for an industrial case study. The introduced patterns and use case should serve for novices in the area of automotive safety as guidance for construction of safety cases.

BNFL is committed to achieving world class safety performance, through a process of continuously reviewing and improving its safety practices. In the mid 1990s, as part of this process, the company began to develop a new type of safety case, for existing non-reactor nuclear plants, called the continued operation safety report (COSR). Following a significant amount of development work from experts within BNFL and important contributions from its regulators, the first approved COSR was recently completed and submitted to the Nuclear Installations Inspectorate. The COSR aims to provide a visibly integrated safety and engineering case for the adequacy of continued operation of a nuclear facility. It achieves this by identifying the main plant structures, systems and components that have a safety function and provides the appropriate supporting engineering substantiation. The COSR aims to explore plant safety and identify worthwhile improvements. The document also aims to be reader-friendly by focusing on the main safety issues. It is therefore a slim safety summary which provides operators, safety specialists and regulators with an overview and introduction into the broader, more detailed safety case. This paper provides an overview of the COSR and its production process, describing the safety case improvements that have been made by comparing it to its predecessor, the fully developed safety case. The paper also illustrates the benefits of the COSR by providing current examples of its application on existing BNFL plant. Finally, the paper describes ongoing development work aimed at further improving the COSR and its production process.

Safety case is one of system safety lifecycle products and should be consistent with other lifecycle products like hazard analysis results. In this paper we present a method of safety case integration with hazard tables based on the use of parametrized argument patterns. We describe a hazard table metamodel, a safety argument pattern and a mechanism of pattern instantiation using a linking table which represents references to system lifecycle artefacts. We report and comment results of a feasibility study of pattern application for medical device hazard analysis. Finally we discuss the opportunities of applying such solution to safety case development and maintenance and the perspectives of further development of this approach.

Safety cases are recommended, and in some cases required, by a number of standards. In the product line context, unlike for single systems, safety cases are inherently complex because they must argue about the safety of a family of products that share various types of engineering assets. Safety case modularization has been proposed to reduce safety case complexity by separating concerns, modularizing tightly coupled arguments, and localizing effects of changes to particular modules. Existing modular safety-case approaches for product lines propose a feature-based modularization, which is too coarse to modularize the claims of different types, at different levels of abstraction. To overcome these limitation, a novel, modular safety-case architecture is presented. The modularization is based on a contract-based specification product-line model, which jointly captures the component-based architecture of systems and corresponding safety requirements as assume-guarantee contracts. The proposed safety-case architecture is analyzed against possible product-line changes and it is shown that it is robust both with respect to fine and coarse-grained, and also product and implementation-level changes. The proposed modular safety case is exemplified on a simplified, but real automotive system.

In the assessment of safety aspects for the Gardermobanen railway signalling system, the methods indicated in the CENELEC Railway safety norms were utilised. The safety documentation was presented as Safety Cases that were assessed. During the development and engineering period, a proactive way of working was used by the Assessor, to disseminate understanding of the Assessor's point of view as early in the process as possible. Thus, the Assessor's sources of information were taken from the development process, the system descriptions as well as early drafts of the Safety Cases.

There is a plethora of models, techniques and tools that support model-and component-based software development of vehicular distributed embedded systems. However, a large majority of them have a limited or no support to model and specify end-to-end resource reservations on the software architectures of these systems. Resource reservations allow flexibility during the development and execution of such complex systems without jeopardizing their predictable behavior. As a result, several applications in the system that share the same hardware platform can be developed independently. In this paper we identify several requirements that any existing component model should fulfill in order to support the modeling of end-to-end resource reservations on the software architectures of such systems. As a proof of concept, we extend the Rubus Component Model (RCM) by fulfilling these requirements. RCM is used for the development of control functionality in vehicular embedded systems by several international companies. We also provide a technique to extract execution models from the software architectures of these systems with resource reservations. In order to show the usability of our technique, we model a vehicular distributed embedded system with the extended component model and extract the execution model from the software architecture augmented with end-to-end resource reservations.

We observed that safety arguments are prone to stay too abstract, e.g. solutions refer to large packages, argument strategies to complex reasoning steps, contexts and assumptions lack traceability. These issues can reduce the confidence we require of such arguments. In this paper, we investigate the construction of confident arguments from (i) hazard analysis (HA) results and (ii) the design of safety measures, i.e., both used for confidence evaluation. We present an argument pattern integrating three HA techniques, i.e., FTA, FMEA, and STPA, as well as the reactions on the results of these analyses, i.e., safety requirements and design increments. We provide an example of how our pattern can help in argument construction and discuss steps towards using our pattern in formal analysis and computer-assisted construction of safety cases.

Descriptive arguments are an intrinsic part of the process of determining the dependability of any system, particularly in the case of safety critical systems. For such systems, safety cases are constructed to demonstrate that a system meets dependability requirements. This process includes the application of hazard analysis techniques. However, such techniques are error-prone, time consuming and apply ad hoc reuse. Hence, the use of systematic, exhaustive hazard analysis can lead to an illusion of high confidence in the parent dependability argument that is compromised by lack of rigour.We have investigated the application of structure and reuse techniques to improve hazard classification arguments and their associated parent dependability arguments. A structure for hazard arguments has been presented and an example from a software hazard analysis has been exemplified using XML. Using two methods of structural reuse, hazard arguments can be improved for both argument generation and post argument construction analysis.

Several advanced reactor designs are now under active development in the United States and elsewhere, promising sustainable solutions to the growing world energy needs. The designs currently being considered are quite diverse and different from the more established light water reactor technology that has dominated the operating commercial nuclear landscape. While advanced reactor concepts were first explored in the dawn of the nuclear age, they are now being reconsidered under the light of modern needs, and specifically, for their flexible operating conditions and inherent safety characteristics. In response, the U.S. Nuclear Regulatory Commission staff is moving forward with development of 10 CFR Part 53 rulemaking, which is a more risk-informed, technology-agnostic framework for licensing and regulating such new designs. The nuclear industry response to this regulatory initiative resulted in the technical report by the Nuclear Energy Institute, NEI 18-04 Revision 1, which provides an implementation roadmap of the risk-informed approach when defining the safety case for a new plant design. The implementation of this safety case may be a nontrivial exercise for an actual reactor design. This paper provides a demonstration of performing such an analysis for a representative advanced reactor. Public information from the General Atomics high-temperature gas reactor design was considered in this demonstration. The analysis workflow was facilitated with the FPoliSolutions’ proprietary Risk-Informed System Engineering (RISE) digital platform, a product that was presented in previous publications. RISE is one application of FPoli’s enterprise digital platform, which was created to facilitate orchestration of complex workflows leveraging recent technologies developed at national laboratories, such as Idaho National Laboratory’s RAVEN and EMRALD frameworks. The analysis described in the paper includes the selection and classifications of events, the integration of probabilistic risk analysis artifacts, and event modeling simulations for consequence evaluations. The results are then used for system, structures, and components safety classification and a synthesis of the safety case for the design in line with the frequency-consequence targets presented in NEI 18-04. The purpose of the analysis, as framed in RISE, is to readily produce outputs and views that can aid users and regulators in making risk-informed decisions to demonstrate their plant safety case.

Application of ALARP to the design of the BP Andrew platform against smoke and gas ingress and gas explosion

The risks posed by management are neither addressed by risk analysis nor included in safety cases. Yet they have been shown to be significant contributors to accidents. This paper argues for more attention to be paid to them and for the development of a risk-analysis method to address them. The paper examines the aspects of management risk that it might cover and offers a set of proposals for its design.

Traceability is defined by Center of Excellence for Software Traceability as the ability to interrelate any uniquely identifiable software engineering artifact to any other, maintain required links over time, and use resulting network to answer questions of both software product and its development process. It is an essential element in software development process, especially for Safety-Critical systems where trace links are used to demonstrate that all hazards and faults are mitigated in delivered system. Maintaining trace links as a software system evolves over time is difficult, error-prone and costly. As a result, trace links tend to become outdated and safety-cases, which rely on trace links and associated data to compose arguments and evidence for system safety are invalidated. In practice, software developers must therefore painstakingly update trace links in order to re-validate safety-cases whenever they seek re-certification of their product. While a significant body of work exists in area of trace link creation, very limited research has focused on problem of link evolution. The goal of this dissertation is therefore to deliver an accurate, scalable, and practical approach for supporting trace link evolution across a diverse set of software artifacts including requirements, source code and safety cases.

The software architecture is typically defined as the fundamental organization of the system embodied in its components, their relationships to one another and to the system's environment. It also encompases principles governing the system's design and evolution. In order to manage the architecture of a large software system the architect needs a holistic model that supports continuous integration and verification for all system artifacts. In earlier papers we proposed a unified graph-based approach to the problem of managing knowledge about the architecture of a software system. In this paper we demonstrate that this approach facilitates convenient and efficient project measurement. First, we show how existing software metrics can be translated into our model in a way that is independent of the programming language. Second, we introduce new metrics that cross the programming language boundaries and are easily implementable using our approach. We conclude by demonstrating how the new model can be implemented using existing tools. In particular, graph databases are a convenient implementation of an architectural repository. Graph query languages and graph algorithms are an effective way to define metrics and specialized graph views.

Guidelines for thermodynamic sorption modelling in the context of radioactive waste disposal