1. Industrial Avionics Working Group 18/04/07 Modular Certification Basic Concepts

2. Industrial Avionics Working Group 18/04/07 Overview Objectives of Incremental Certification Principles Modular GSN Patterns/Templates Product/Process Containment IAWG Modular Software Safety Case Process

3. Industrial Avionics Working Group 18/04/07 Objectives: Typical Cost Relationships for Certification Cost of re-certification is related to the size and complexity of the system. Cost of re-certification is related to the size and complexity of the change. £ Change Size & Complexity £ CurrentAim for the Future

4. Industrial Avionics Working Group 18/04/07 Principles of Modular Certification First step towards Incremental Certification is Modular Certification Apply principles of object orientation to Safety Cases: –High cohesion –Low coupling –Information Hiding –Well-defined interfaces

5. Industrial Avionics Working Group 18/04/07 Modular GSN – Basic Symbols Public Goal ‘Away’ Goal Module Reference

6. Industrial Avionics Working Group 18/04/07 Modular GSN – Module View/Safety Case Architecture

7. Industrial Avionics Working Group 18/04/07 MSL OSL Application Layer (AL) RT BP Design ArchitectureSafety Case Architecture

8. Industrial Avionics Working Group 18/04/07 Patterns/Templates Patterns –Authoring-Time Instantiations Template –Read-Time Instantiations Instantiation Number {Requirement A}{Evidence B} 1Displayed information is redSection 3.2 2Font is Times New RomanSection 4.7 3 4

9. Industrial Avionics Working Group 18/04/07 Product/Process DEF STAN 00-56 issue 2 requires that process to develop system/software is appropriate DEF STAN 00-56 issue 3 requires that product is demonstrated to be acceptably safe and only uses process argument where needed to support product evidence Parallel study undertaken to DEF STAN 00-56 issue 3 –Process acceptability only highlighted where product argument relies upon it – public ‘process’ goal –Public process goal could be supported Empirically, per instance of dependence on process argument Generically, as individual public goals within an overall process argument Variance of process with assurance requirements has not yet been considered

10. Industrial Avionics Working Group 18/04/07 Containment Safety Case equivalent to ‘information hiding’, to manage complexity in safety case architectures It is not always necessary for each safety case module to have visibility of all other safety case modules Where elements of one safety case module are of limited applicability, their scope can be limited through containment Particularly useful for Process arguments which relate only to a single product argument module

11. Industrial Avionics Working Group 18/04/07 Containment Simplifying the SCA Without Containment

12. Industrial Avionics Working Group 18/04/07 Containment Simplifying the SCA With Containment

13. Industrial Avionics Working Group 18/04/07 Methods for Modular Certification Probably many ways to do modular certification IAWG have investigated modular software safety cases Further material refers to experience gained in defining the IAWG Modular Software Safety Case method Start by looking at how to define the Safety Case Architecture