Industrial Avionics Working Group 18/04/07 Defining the Safety Case Architecture IAWG Modular Certification

Industrial Avionics Working Group 18/04/07 Key Considerations Change Scenarios Design for Safety Proposing a Safety Case Architecture Application Layer Partitioning Assessing the Safety Case Architecture Optimisation Proposed SCA for IMS

Industrial Avionics Working Group 18/04/07 Change Scenarios IAWG Modular Certification

Industrial Avionics Working Group 18/04/07 Purpose of Analysing Change –To assess the applicability of the Modular Safety Case methodology for a specific system –To help in the analysis and optimisation when creating a Modular Safety Case for a system –To assess the Modular Safety Case for its ability to cater effectively with system updates and change –To help optimise the design of new systems to cater for change

Industrial Avionics Working Group 18/04/07 Identifying Changes Sources of change: –New and changed functional requirements (from customers, users, regulatory bodies). –Changes in operational usage. –Problem fixes (either outstanding or as yet unknown). –Obsolescence of hardware (in new build and maintenance). –Knock-on effects from other changes - Obsolescence of tools required in producing or maintaining the system, throughput upgrades to support enhancements, adoption of new procedures and standards.

Industrial Avionics Working Group 18/04/07 Gathering and Estimating Change Information Type of change: –Known (e.g. from firm customer requirements) –Predicted (e.g. compiler updates, tentative requirements) –Unknown (need to generate representative sets from statistical and historic data) System effect: –Functional (change to the way the system behaves) –Operational (change to the way in which the system is used) Relationship to safety: –New safety requirement –Changed safety requirement –Associated with safety requirements –No obvious safety relationship –Integrity levels relating to the change

Industrial Avionics Working Group 18/04/07 Preliminary Assessment of Changes The number of possible life time changes is huge with complex combinations. Categorise and and possibly reduce by considering: –Likelihood of change –Size of change –Frequency –Complexity –Their relationship to safety –Required grouping of changes This gives a set of realistic Change Scenarios for a particular system

Industrial Avionics Working Group 18/04/07 Assessment of Changes on the Safety Case The change scenarios can be “applied” to a safety case to: –Identify frequency of change to the safety case modules –Discover the impact of changes in terms of integrity and criticality issues –Compare the size of the change to the impact on the safety case –Assess the modularisation choices and the resulting isolation level of the changes applied –Assess module replacement capabilities and the adequacy of the contracts –Give a defensible basis for recommendations for improvements in either the safety case, system design, or both