System Safety: Where Next?

Abstract

System safety is a widely practised discipline that is built on the familiar everyday notions of risk and hazard. There are a number of well-known standards covering the safety of defence systems, railway systems, automotives and aircraft. Central to system safety is the idea of a safety case: a reasoned argument for safety of a system that is based on evidence. However, the concepts on which system safety is built, i.e. risk and hazard, can sometimes be confusing, are often poorly understood and are frequently misapplied in the context of safety engineering for software-intensive systems. In this paper we discuss these matters, and speculate on where system safety might be heading. We describe some common issues with -and desirable attributes of -safety standards and safety cases. We present the idea of a structured document as a means of understanding these issues. We discuss first how the notion of structured document was used in a lightweight way in the Australian Defence standard DEF(AUST)5679, and how the HiVe tool, currently under development at DSTO, offers a more powerful means of building structured documents. We conclude with brief comments on how the notion of hazard could be replaced by that of a safety protocol.

Assurance of System Safety: A Survey of Design and Argument Patterns

“…Intermediate results are reported in [Gleirscher and Kugele 2016]. A summary of the tactics covered according to the taxonomies in [Preschern et al 2013c] and [Wu and Kelly 2004] 2 A coverage analysis based on challenges from Cant [2013]; Graydon [2015Graydon [ , 2017; Langari and Maibaum [2013] 2.12 For a more comprehensive overview of literature on safety patterns and to determine research directions, we created a systematic map along the lines of Petersen et al [2008]. We selected the most relevant studies by summed ranking of relevance.…”

“…Inspired from discussions by Cant [2013]; Graydon [2015Graydon [ , 2017; Knauss et al [2017]; Langari and Maibaum [2013]; Laplante et al [2007], we comment on some practical challenges we expect to be addressed by research on safety concepts and assurance cases.…”

“…being undesirably heterogeneous in their constitution, like pointed out by Cant [2013]. For two fairly different risks of the same equivalence class, safety analysts could make similar decisions about risk handling and safety engineers could follow similar directives for risk handling.…”

“…System-level hazards are defined to have an impact on the system's environment. Whether or not such hazards are caused by component failure, studies about behavior patterns discuss what Cant [2013] describes as "safety functionality in terms of the system interface. " He states that "hazard analysis is inward-looking, making it hard to describe safety functionality in terms of the system interface. "…”