Enhancing the Maintainability of Safety Cases Using Safety Contracts

Safety critical systems are those systems whose failure could result in loss of life, significant property damage, or damage to the environment. These systems must be dependable and of high quality. System safety is a major property that should be adequately assured to avoid any severe outcomes. Many safety critical systems in different domains (e.g., avionics, railway, automotive, etc.) are subject to certification. The certification processes are based on an evaluation of whether the associated hazards to a system are mitigated to an acceptable level.Safety case is a proven technique to argue about systems safety. Safety cases can provide evidential information about the safety aspect of a system by which a regulatory body can reasonably conclude that the system is acceptably safe. The development of safety cases has become common practice in many safety critical system domains. However, safety cases are costly since they need significant amount of time and efforts to produce. This cost is dramatically increased (even for already certified systems) if the changes require the safety case to be updated and submitted for re-certification. A reason for increased cost is that safety cases document highly interdependent elements (e.g., safety goals, evidence, assumptions, etc.) and seemingly-minor changes may have a major impact. Anticipating potential changes is useful since it could reveal traceable consequences that can reduce the maintenance efforts. However, considering a complete list of anticipated changes is difficult.Safety contracts have been proposed as a means for helping to manage changes. There has been significant work that discuss how to represent and to use them, but there has been little attention on how and where to derive them. In this thesis, we focus on supporting the change impact analysis as a key factor to enhance the maintainability of safety cases. We propose an approach that shows how safety contracts can be associated with a safety case's elements to highlight them once they are impacted by changes. Moreover, we propose a safety case maintenance technique which applies sensitivity analysis in Fault Tree Analysis (FTA) to determine a system's ability to tolerate changes. The technique is twofold: (1) it supports changes prediction and prioritisation, (2) it derives safety contracts to record the information of changes with the aim to advise the engineers what to consider and check when changes actually happen. We use hypothetical and real-world systems to demonstrate our proposed approaches and technique.