Safety Cases in AF3
Introduction
AutoFOCUS3 supports the construction of modular safety cases, in compliance with the Goal Structuring Notation (GSN) standard.
What are modular safety cases?
Safety cases constitute a proven technique to systematically demonstrate the safety of such systems using existing information about the system, its environment and development context, facilitating the bridging of the regulatory gap. Three parts can be identified as part of a safety case: First, the safety goal that has to be achieved. Second, the evidence for achieving this safety goal and third, the structured argument constituting the systematic relationship between the goal the evidence. Safety cases can be designed in a modular approach, by subdividing complex safety cases into interconnected modules of safety arguments and evidence.
The Goal Structuring Notation (GSN) is a well-known description technique for the development of engineering arguments to construct Safety Cases. GSN uses a graphical argument notation to explicitly document the elements and structure of an argument and the argument's relationship of this evidence. An argument, based on GSN, may consists of several elements: Goals are the claims of an argument, whereas items of evidences are captured under Solutions. When documenting how claims are said to be supported by sub-claims, the Strategy-element is used and can be linked to Goals. A Context element captures and enables citation of information that is relevant to the argument. Rationale for a strategy can be described by a Justification element. GSN provides two types of linkage between elements: SupportedBy and InContextOf. SupportedBy relationships indicate inferential or evidential relationships between elements. InContextOf relationships declare contextual relationships.
One way of designing safety cases is by following the modular approach. In GSN, a safety case module contains the objectives, evidence, argument and context associated with one aspect of the safety case. In addition to the GSN argument elements presented in the previous paragraph, a module may contain away entities such as away goals, away solutions and away context elements. Away entities are references to the goal, solution or context in another module. Away goals cannot be (hierarchically) decomposed and further supported by sub-entities within the current module; rather, decomposition needs to occur within the referenced module. Inter-modular relationships are of two types: namely supported by and in context of relationships. A supported by relationship denotes that support for the claim presented by the away goal or away solution in one module is intended to be provided from an argument in another module. When there is an away context element in a module, that module is connected to another module by an in context of relationship; relationship that indicates that the context of a certain claim will be presented in details in another module.
Modular safety cases in AutoFOCUS3
AutoFOCUS3 enables the user to model a safety case containing several modules which are connected to each other through intra-module connections. Each such module contains a safety argumentation structure, build up by GSN-defined elements (e.g. Goals, Away Goals Optional Entities, Solutions, Away Solutions, Strategies, Justifications, Assumptions, Contexts, Away Contexts) connected to each other by GSN-defined relationships.
Apart from the construction of modular safety cases, the AutoFOCUS3 tool provides following functionality:
-
GSN argument elements may have references to other AF3 artifacts, such as:
-
A safety goal may reference to a safety requirement, if the goal and the requirement state the same safety claim;
-
A solution may reference to an AF3 artifact, if that artifact acts as evidence for the system's safety case;
-
A context may reference to an AF3 artifact, if that artifact offers contextual information for the system's safety case;
-
A context may reference to an AF3 artifact, if that artifact offers contextual information for the system's safety case;
-
Safety case patterns can be created by users and stored in an AF3 library;
-
AF3 offers a basic evaluation system for safety case elements. This system is based on annotations on safety case elements, that alert users for breaking a rule when creating their safety case.

Steps to create a modular safety case for your project
-
Go to an AF3 project, in the Model Navigator view and right-click on it;
-
Select the Safety Argumentation Package item from the context menu;

-
Go to the newly created Safety Argumentation Package, in the Model Navigator view, and right-click on it;
-
Select the Safety Case item from the context menu;

-
Go to the newly created Safety Case, in the Model Navigator view, and double-click on it, so that the editor (a Modeling Diagram) in which you can model the safety case appears.

Here is an example of a modular safety case modeled in AF3:

Steps to create a safety case module
-
After creating your safety case, you can now specify the contained safety case modules. To add a safety case module (called Argument Module in AF3), drag and drop an Argument Module from the Model Elements view on the right side to your diagram; Note: To move a module, just pick the module somewhere in the middle and move. To re-size it, pick it in the lower right corner and move the mouse to re-size.
-
To specify properties of the module, go to the Safety Argument Properties view. There you can assign the safety case module an id (in the Element Identifier text box);

-
To generate intra-module connections, based on the away entities, go to your safety case, in the Model Elements view and right-click on it. Select the Generate Module Connections item from the context menu. Do consider that, if you do not have any away entities in your safety case modules, you will not have any relationship between your modules.

Here is an example of the safety argumentation structure a safety case module modeled in AF3:

Steps to specify the contained elements of a safety case module
Once you are done with specifying the modules of your safety case, you can describe the safety argument structure contained by these modules as such:
-
Go to one of your safety case modules from the Model Elements view and double-click on it, so that the editor (a Modeling Diagram) in which you can model the safety case module appears;
-
To add an Argument Element, drag and drop a Goal/Away Goal /Strategy/Solution/Away Solution/Optional Entity/Strategy /Justification/Assumption/Context/Away Context from the Model Elements view on the right side to your diagram; Note: To move an argument element, just pick the module somewhere in the middle and move. To resize it, pick it in the lower right corner and move the mouse to resize.

-
In order to create relationships between your argument elements, namely SupportedBy and InContextOf relationships, as specified in the GSN standard, press the alt-Key (ctrl-Key under Linux) on your keyboard and drag the relationship from one argument element to another. Invalid relationships (e.g., between a solution and a context) are avoided by disabling the dragging.

Setting general properties of safety argument elements
General properties of safety argument elements can be set in the Primary GSN element’s attributes tab, in the Safety Argument Properties view.
-
Give an id to your safety argumentation element in the Element identifier text box;
-
Mark your safety argumentation element as Uninstantiated entity, if necessary, by checking the corresponding check button;
-
Write the claim made by your safety argumentation element, in the Claim text box.
Note 1: Solutions do not have claims.
Note 2: You cannot set claims to away entities, as they have the same claim as the safety argument element the point to.
Setting general properties of SupportedBy and InContextOf relationships
-
As you create a safety case pattern, you can assign a multiplicity to a relationship, by writing any number higher than 0 in the Multiplicity text box. You can give a short explanation of the multiplicity in the corresponding text box;

-
You can also mark the relationship as Optional, by checking the corresponding check button.
Setting general properties of Optional Entities
-
Give an id to your optional entity in the Element identifier text box;

-
You can select the safety argument elements you want to keep for your safety argumentation structure, by pressing the Choose the argument elements you want to keep button. A wizard will appear in order to select from the optional elements.
Setting particular properties of safety argument elements
Particular properties of safety argument elements can be set in the Secondary GSN element's attributes tab, in the Safety Argument Properties view.
Setting particular properties of Goals
-
You can mark your goal as Undeveloped entity by checking the corresponding check button;

-
You can mark your goal as Private by checking the corresponding check button. A private goal should not be referenced by an away goal from another safety case module;
-
You can connect a goal to an already modeled safety requirement from the Requirements Analysis of the project, by pressing the Assign related safety requirement button. If you want to delete the connection, just press the Eliminate connection to safety requirement button. When connecting a goal to a safety requirement, the name and the claim of the goal will be the same as the name and the description of the requirement. To go directly to the requirement referenced by your goal, you can go to your goal in the Model Elements view, right-click on it and select the Go To Referenced Safety Requirement menu item.
Setting particular properties of Solutions
-
You can mark your solution as Private by checking the corresponding check button. A private solution should not be referenced by an away goal from another safety case module;
-
You can connect a solution to an already modeled AF3 element, by pressing the Select referenced AF3 element button. If you want to delete the connection, just press the Eliminate referenced AF3 element button. When connecting a solution to an AF3 element, the name the solution will be the same as the name of the AF3 element. To go directly to the AF3 element referenced by your solution, you can to your solution in the Model Elements view, right-click on it and select the Go To Referenced AF3 Element menu item.

Setting particular properties of Contexts
-
You can mark your context as Private by checking the corresponding check button. A private context should not be referenced by an away goal from another safety case module;
-
You can connect a context to an already modeled AF3 element, by pressing the Select referenced AF3 element button. If you want to delete the connection, just press the Eliminate referenced AF3 element button. When connecting a context to an AF3 element, the name the context will be the same as the name of the AF3 element. To go directly to the AF3 element referenced by your context, you can to your context in the Model Elements view, right-click on it and select the Go To Referenced AF3 Element menu item.
Setting particular properties of Away Entities
-
Press the Select a referenced entity button
-
A wizard will appear. Select from the safety argument elements that appear in the wizard, one to which you want your away entity to point to. If there is no safety argument element adequate to point to, you can create a new safety argument element, in a module of your choice, by pressing the Create new goal and connect button. If you want to delete the reference press the Eliminate referenced entity button;
-
If there is no safety case module defined, that contains the safety argumentation structure you need to support your away entity, you can create such a module, by going to the context context in the Model Elements view, right-click on it and select the Generated the referenced module if it does not exist menu item.

Setting particular properties of Optional Entities
-
You can write down in the The minimum required text box the minimum number of safety argument elements that should be selected to be kept in your safety argumentation structure.

Setting particular properties of SupportedBy and InContextOf relationships
-
You can set the relevance, support and strength levels of your relationships by selecting from the drop-down lists.

Safety Case Patterns in AF3
Steps to create a safety case pattern in AF3
-
Create a new safety case module;
-
Specify the safety argumentation structure of this module;
-
Make sure that all the safety argument elements contained by your module are marked as uninstantiated entities.
When you are done with modeling your pattern, do the following steps:
-
Go to the File on the menu bar and click on it;
-
Select New AF3 Library from the drop-down menu;

-
Go to the Model Navigator view and select the Toggle library view button;

-
Select the newly created AF3 Library from the Model Navigator view and right-click on it;
-
Select New Package (for safety argument patterns) from the drop-down menu;

-
Go to the Model Navigator view and deselect the Toggle library view button;
-
When you are done with the modeling of the safety argumentation pattern, go to the newly created Argument Module from the Model Navigator view and right-click on it;
-
Then select Add to Library from the drop-down menu;

-
From the opened dialog, select the newly created safety argument patterns package.

Steps to apply a pattern into your safety case
-
Go to your Safety Case in the Model Navigator view and double-click on it. This will open your safety case in the Modeling Diagram view;
-
Apply the pattern you created to your safety case by drag-and-drop from the Model Elements view.

Note: All the available safety case patterns in your workspace are to be found under Library -> safety argument patterns in the Model Elements view.
Instantiate a safety case pattern
-
Go to the newly imported Argument Module from the Model Navigator view and right-click on it;
-
Select Disconnect from library item from the context menu;
-
Go to the Safety Argument Properties view for each of the elements of the module and do the following steps:
-
Fill in the Element Identifier text box;
-
Replace the words in curly brackets from the claim of the safety argument element, by editing the claim or by pressing the Instantiate the words in curly brackets from the claim button;
-
Deselect the Uninstatiated entity button.