Objectives Based Assurance Management

This article provides an overview of discussions held at the Software and Supply Chain Assurance (SSCA) forum held May 1-2, 2018, in McLean, Virginia. The two-day event focused on education and training for software assurance (SwA) and Cyber-Supply Chain Risk Management (C-SCRM). Attendees discussed questions such as “What are some challenges facing industry, academia, and government organizations in this area?” “Who needs education or training?” “What needs to be taught?” and “What strategies do or do not work?” Discussions related to the current environment, hiring and retaining qualified employees, defining roles and responsibilities, and the knowledge, skills, and abilities (KSAs) that are most in-demand.

Software Product Line Engineering (SPLE) has been proven to reduce development and maintenance costs, improving the time-to-market, and increasing the quality of product variants developed from a product family via systematic reuse of its core assets. SPLE has been successfully used in the development of safety-critical systems, especially in automotive and aerospace domains. Safety-critical systems have to be developed according to safety standards, which demands safety analysis, Fault Tree Analysis (FTA), and assurance cases safety engineering artefacts. However, performing safety analysis, FTA, and assurance case construction activities from scratch and manually for each product variant is time-consuming and error-prone, whereas variability in safety engineering artefacts can be automatically managed with the support of variant management techniques. As safety is context-dependent, context and design variation directly impact in the safety properties changing hazards, their causes, the risks posed by these hazards to system safety, risk mitigation measures, and FTA results. Therefore, managing variability in safety artefacts from different levels of abstraction increases the complexity of the variability model, even with the support of variant management techniques. To achieve an effective balance between benefits and complexity in adopting an SPLE approach for safety-critical systems it is necessary to distinguish between reusable safety artefacts, whose variability should be managed, and those that should be generated from the reused safety artefacts. On the other hand, both industry and safety standards have recognized the use of model-based techniques to support safety analysis and assurance cases. Compositional safety analysis, design optimization, and model-based assurance cases are examples of techniques that have been used to support the generation of safety artefacts required to achieve safety certification. This thesis aims to propose a model-based approach that integrates modelbased development, compositional safety analysis, and variant management techniques to support the systematic reuse and generation of safety artefacts in safety-critical software product line engineering. The approach contributes to reduce the effort and costs of performing safety analysis and assessment for a particular product variant, since such analysis is performed from the reused safety artefacts. Thus, variant-specific fault trees, Failure Modes and Effects Analysis (FMEA), and assurance case artefacts required to achieve safety certification can be automatically generated with the support the model-based safety analysis and assurance case construction techniques.

Recently, Assurance case has been used in order to improve system and software dependability. However, assurance case is difficult to write because of risk and safety standards have not been commonly defined, and plenty of risks are domain specific risk that arouses depending on the combinations of components and implementations. It is hard to assess and cover all of the risk at developing assurance case. In this paper we propose a method to convert risk flow management to assurance case, and a support tool for collecting keywords for them. Our proposed method it to apply possible risks from the threat-source to harm level along with the structure of the GSN (Goal Structural Notation) and convert it to adapt the notation automatically. These will support to assess the risk on assurance case before a severe engineering task of operational system. Our achievement is that new strategy to subdivide goals using risk.

A successful transition to global clean energy hinges on meeting the world’s growing demand for power, while at the same time reducing greenhouse gas emissions. Achieving this will require significant growth in electricity generation from clean and carbon-free energy sources. Several energy providers (Acar and Dincer, 2019, “Review and Evaluation of Hydrogen Production Options for Better Environment,” J. Cleaner Prod., 218, pp. 835–849 and Nagashima, M., 2024, “Japan’s Hydrogen Strategy and Its Economic and Geopolitical Implications,” Afficher la page d’accueil du site) have already begun the transition from traditional carbon-based fuels to cleaner alternatives, such as hydrogen (H2) and hydrogen-enriched natural gas (HENG). However, there are still many technical questions/challenges that must be addressed when applying these fuels in gas turbines. The application of H2 or H2/natural gas (NG) blends to advanced-class gas turbines, which have higher operating pressures and temperatures, has raised concerns about the potential for leakages or fuel sequencing operations where flammable mixtures of fuel and air could auto-ignite. Public information on the auto-ignition of H2 in the air at atmospheric pressure shows an auto-ignition temperature (AIT) between 520 and 585 °C (U.S. Department of Energy, 2024, “U.S. Department of Energy Hydrogen Program Plan,” U.S. Department of Energy, Washington, DC; Georgia Power, 2022, “Georgia Power, Mitsubishi Power, EPRI Complete World’s Largest Hydrogen Fuel Blending at Plant McDonough-Atkinson,” Georgia Power, Atlanta, GA; and gepower-v2, 2024, “New York Power Authority: GE Vernova,” gepower-v2, Cambridge, MA). Such data show AIT of H2 is ∼100 °C lower than that of methane (CH4) which has a minimum AIT of around 600 °C (Huth, M., and Heilos, A., 2013, “Fuel Flexibility in Gas Turbine Systems: Impact on Burner Design and Performance,” Modern Gas Turbine Systems, Sawston, UK, pp. 635–684). Studies also show that as pressure increases, methane’s AIT decreases significantly to around 390 °C (Loving, C., Mastantuono, G., Terracciano, A. C., Vasu, S. S., Pigon, T., Hernandez, A., and Cloyd, S., 2023, “Auto-Ignition Test Results of Hydrogen and Natural Gas Fuels at Atmospheric and Elevated Pressures for Gas Turbine Safety,” ASME Paper No. GT2023-102674). However, there was insufficient information in the published literature to characterize the influence of pressure on the AIT of H2 and HENG fuels. At atmospheric conditions, H2 has a wider flammability range of equivalence ratios that ignition can occur compared to methane. H2’s flammability ranges from 4% to 75% molar (volume) fuel concentration, which is an equivalence ratio range of 0.137–2.57. Methane’s flammability limit ranges from 5% to 15% molar (volume) or an equivalence ratio between 0.53 and 1.58 (National Aeronautics and Space Administration, 1997, Safety Standard for Hydrogen and Hydrogen Systems: Guidelines for Hydrogen System Design, Materials Selection, Operations, Storage, and Transportation, National Aeronautics and Space Administration, Office of Safety and Mission Assurance; National Technical Information Service, Distributor, Washington, DC, Springfield, VA). Previous research has also been done to determine the effect of longer hydrocarbons present in natural gas mixtures. The presence of ethane (C2H6) and propane (C3H8) has been shown to reduce the AIT of natural gas, especially at elevated pressures (The Association, 1994, NFPA 49: Hazardous Chemicals Data, The Association, Quincy, MA). These longer hydrocarbons also tend to promote ignition in richer conditions, whereas methane tends to ignite easier in slightly lean conditions (National Aeronautics and Space Administration, 1997, Safety Standard for Hydrogen and Hydrogen Systems: Guidelines for Hydrogen System Design, Materials Selection, Operations, Storage, and Transportation, National Aeronautics and Space Administration, Office of Safety and Mission Assurance; National Technical Information Service, Distributor, Washington, DC, Springfield, VA). Numerous variables besides the pressure, fuel, and equivalence ratio can affect the AIT including chamber volume size, chamber materials, presence of diluents, and other factors (Standards Australia International, 2000, Electrical Apparatus for Explosive Gas Atmospheres. Part 20, Data for Flammable Gases and Vapours, Relating to the Use of Electrical Apparatus, Standards Australia International; Standards New Zealand, Strathfield, NSW, Wellington, NZ). This study describes the test methodology used to evaluate conditions where auto-ignition occurs for various fuel–air mixtures operating at different pressures (1–30 atm) and temperatures. Testing was completed with 100% H2 and multiple H2/NG blends at various equivalence ratios (ER) between 0.2 and 2.5. Testing was similarly performed for 100% NG to validate the test and data collection methods cited in prior published literature. Results indicate that, at atmospheric pressures, an increase in H2 concentration results in a reduced AIT. However, at 30 atm, the increased presence of H2 increased the AIT. At elevated pressures above 10 atm, increased equivalence ratio resulted in reduced AIT for all mixtures with NG having the greatest sensitivity to equivalence ratio. Variations of auto-ignition delay times (AIDT) were also observed during the testing and are compared to modeling predictions, providing insight into auto-ignition characteristics.

Context. Development of safety assurance cases (SACs) is a trending need for certification of safety-critical systems in regulated domains. Their development encompasses collecting, linking, and structuring diverse project information, such as requirements, hazards, and components. A key building block of SACs is the explanation behind requirements and design decisions, the so-called assurance rationale, which provides compelling argumentation on the system suitability for use. Late development of SACs leads to late discovery of hazards, risks, requirement and design issues that affect the system safety. Question/ problem. Current practice is to manage the assurance rationale in the SAC tools or artefacts, even though it is closely related to project and traceability information. This separation inhibits the shared understanding between safety and software professionals and may cause loss of rationale that results in a poor quality of certification documentation. It also hinders the automated SAC construction and assessment directly from project management tools. Principal ideas/results. This paper presents an approach to support the management of assurance rationale integrated with project information. Our approach defines an assurance rationale model that binds requirements, safety analysis information and assurance case elements. We show the use of the model applied to an issue tracking system. Contribution. We propose a new perspective on assurance cases management by bringing their building blocks into project management tools. Such integration could help bridge Safety and Software Engineering activities and avoid loss of rationale through the system life cycle. Also, it fosters the development of new approaches for SAC generation and assessment.

A systematic approach and tool support for GSN-based safety case assessment

In 2014, in response to a large volume of feedback from industry, the science community, and internal to Goddard Space Flight Center (GSFC), GSFC’s Safety and Mission Assurance (SMA) Directorate began a transition to a risk-based implementation of SMA, departing from its longstanding practice of being primarily driven by a mostly static set of Mission Assurance Requirements. The transition started out with a pilot project involving risk-based acceptance of bare-printed circuit boards that was enormously successful, continued through a complete organizational transformation in 2015, and culminated with the baselining of formal Risk-Based SMA policy in 2016. This article highlights five major examples of successful implementation of Risk-Based SMA that have demonstrated not only substantial savings in project resources, but also the ability to achieve the lowest level of risk in developing and operating inherently risky systems.

Two existing notations for the assurance case (claim, argument and evidence [CAE] and goal structuring notation [GSN]) are considered. Supporting software tools for development of the assurance case are considered. Some ways for improvement and modification are proposed for both assurance case notations (CAE and GSN). For CAE, the authors obtained annex with acceptance and coverage criteria as well as an algorithm of the assurance case update through life cycle stages. For GSN, they improve structured argumentation with support of structured text using. Recommendations for using the assurance case notations and tools for I&C systems are formulated.

In this paper we discussed Assurance Case fundamentals which are essential to apply that approach for Green IT. Notations and supporting tools for Assurance Case, as well as state-of-the-art researches survey are briefly represented. We also consider in general the main structure of safety and security requirements and goals which contain requirements to safety and security management, to safety and security life cycle and requirements to measures and techniques to avoid failures and attacks. Finally, we proposed a specific part of Assurance Case related with assessment of compliance with requirements to power consumption. We named the proposed methodology of integrated safety, security and power consumption assessment as "Green Assurance Case"..

Autonomous Vehicles (AVs) have significant ethical and safety implications. Questions of informed consent and risk acceptance are of primary importance, as is an explicit identification of the ethical principles underlying these decisions. In this paper we present a process framework for producing an ethics assurance case, which can be used to translate ethical imperatives into design decisions and safety management practices. The process and resultant assurance case integrate ethical considerations into the wider engineering lifecycle, providing a tool to demonstrate that design and safety management decisions reflect an identified ethical position.

Assurance cases, which provide an organized and explicit argument for correctness, should be used for certifying Scientific Computing Software (SCS), especially when the software impacts health and safety. Assurance cases have already been effectively used for safety cases for real time systems. Their advantages for SCS include engaging domain experts, producing only necessary documentation, and providing evidence that can potentially be verified/replicated by a third party. This paper illustrates assurance cases for SCS through the correctness case for 3dfim+, an existing medical imaging application. No errors were found in 3dfim+. However, the example still justifies the value of assurance cases, since the existing documentation is shown to have ambiguities and omissions, such as an incompletely defined ranking function and missing details on the coordinate system convention adopted. In addition, a potential concern for the software itself is identified: running the software does not produce any warning about the necessity of using data that matches the assumed parametric statistical model.

This paper describes the Safety and Mission Assurance (SMA) processes and the role of the NASA-delegated Safety and Mission Assurance Technical Authority (SMATA) that together contributed to the Mars 2020 Project development through launch. The M2020 flight system development included many high heritage designs and new developments. Inheritance reviews at the subsystem level fully document and confirmed the level of inheritance. New developments for subsystems, assemblies, and instruments followed a standard phased development cycle per standards at the Jet Propulsion Laboratory (JPL) through delivery to JPL Assembly, Test, and Launch Operations (ATLO). SMA processes exercised oversight and insight through all phases including ATLO. SMA processes were adapted for oversight and insight of contributed instruments. SMA Disciplines at JPL managed approval of EEE Parts and design analyses, specification of mission environments and required testing and analyses as well as accepted completion of the required testing and analysis. Software Quality Assurance (SQA) oversaw all flight software development. All hardware processing and testing was completed under the watchful eye and approval of Hardware Quality Assurance (HQA). Finally, System Safety continually assured safe execution of all hazardous processes. Throughout development, SMA assessed risk resulting from anomalies, requirement waiver requests, and other technical risks. SMATA independently reported risk to the Project Manager, JPL Management, and NASA culminating in a Safety and Mission Success Review (SMSR) prior to launch.

Abstract: Transforming Mobility: Cutting-Edge Innovations in Modern Transportation Systems frames mobility as a cyber-physical-social ecosystem in which vehicles, infrastructure, markets, energy systems, and human behavior co-evolve. The book advances a unifying analytical stack—Car–City–Cloud–Carbon—to jointly optimize safety, reliability, equity, and lifecycle emissions rather than treating them as competing goals. Methodologically, it integrates systems engineering, control theory, network science, institutional economics, and human–computer interaction with an evidence pipeline that links simulation to field experiments and post-market telemetry. Core contributions include: (i) deployable architectures for electrification and grid–transport coordination; (ii) perception-to-planning assurances for connected and automated mobility; (iii) Mobility-as-a-Service backplanes that prevent platform lock-in while guaranteeing accessibility; (iv) curb logistics, dynamic pricing, and freight consolidation that reclaim public space; and (v) governance-by-design—assurance cases, red-team protocols, privacy-preserving telemetry, and equity slices—so innovation earns public legitimacy. Drawing from global case studies across dense megacities, mid-sized metros, and rural corridors, the book translates research into policy-ready playbooks and procurement templates. A 2025–2035 roadmap concludes the volume, aligning interoperable data standards, certified assist-as-needed controllers, inclusive HMI toolkits, and circular design with risk-tiered regulation and open artifacts. The result is a rigorous, actionable foundation for scholars, practitioners, and policymakers committed to safe, sustainable, and inclusive mobility transitions. Keywords: mobility systems, electrification, connected automated vehicles, V2X, MaaS, curb logistics, dynamic pricing, safety assurance, equity and accessibility, privacy-preserving telemetry, digital twins, lifecycle carbon, circular design, transport governance

Modern medical devices are increasingly developed by composing a variety of interoperable elements such as medical devices, services, and platform infrastructures. In many scenarios, multi-vendor consortia are organized to support the development and deployment of interoperable medical systems, in which safety-critical element implementations, risk management results, and safety assurance are reused across organizational boundaries. This reality calls for an assurance case approach that supports interfacing, refinement, and composition of distributed, component-level claims and evidences to construct system-level assurance argumentation. We present a collection of objectives and top-level safety claims towards the development of such an approach for interoperable systems built using medical application platforms.

Safety and mission assurance in a better, faster, cheaper environment