Industrial Avionics Working Group 18/04/07 Modular Certification Basic Concepts

Industrial Avionics Working Group 18/04/07 Overview Objectives of Incremental Certification Principles Modular GSN Patterns/Templates Product/Process Containment IAWG Modular Software Safety Case Process

Industrial Avionics Working Group 18/04/07 Objectives: Typical Cost Relationships for Certification Cost of re-certification is related to the size and complexity of the system. Cost of re-certification is related to the size and complexity of the change. £ Change Size & Complexity £ CurrentAim for the Future

Industrial Avionics Working Group 18/04/07 Principles of Modular Certification First step towards Incremental Certification is Modular Certification Apply principles of object orientation to Safety Cases: –High cohesion –Low coupling –Information Hiding –Well-defined interfaces

Industrial Avionics Working Group 18/04/07 Modular GSN – Basic Symbols Public Goal ‘Away’ Goal Module Reference

Industrial Avionics Working Group 18/04/07 Modular GSN – Module View/Safety Case Architecture

Industrial Avionics Working Group 18/04/07 MSL OSL Application Layer (AL) RT BP Design ArchitectureSafety Case Architecture

Industrial Avionics Working Group 18/04/07 Patterns/Templates Patterns –Authoring-Time Instantiations Template –Read-Time Instantiations Instantiation Number {Requirement A}{Evidence B} 1Displayed information is redSection 3.2 2Font is Times New RomanSection

Industrial Avionics Working Group 18/04/07 Product/Process DEF STAN issue 2 requires that process to develop system/software is appropriate DEF STAN issue 3 requires that product is demonstrated to be acceptably safe and only uses process argument where needed to support product evidence Parallel study undertaken to DEF STAN issue 3 –Process acceptability only highlighted where product argument relies upon it – public ‘process’ goal –Public process goal could be supported Empirically, per instance of dependence on process argument Generically, as individual public goals within an overall process argument Variance of process with assurance requirements has not yet been considered

Industrial Avionics Working Group 18/04/07 Containment Safety Case equivalent to ‘information hiding’, to manage complexity in safety case architectures It is not always necessary for each safety case module to have visibility of all other safety case modules Where elements of one safety case module are of limited applicability, their scope can be limited through containment Particularly useful for Process arguments which relate only to a single product argument module

Industrial Avionics Working Group 18/04/07 Containment Simplifying the SCA Without Containment

Industrial Avionics Working Group 18/04/07 Containment Simplifying the SCA With Containment

Industrial Avionics Working Group 18/04/07 Methods for Modular Certification Probably many ways to do modular certification IAWG have investigated modular software safety cases Further material refers to experience gained in defining the IAWG Modular Software Safety Case method Start by looking at how to define the Safety Case Architecture