Two existing notations for the assurance case (claim, argument and evidence [CAE] and goal structuring notation [GSN]) are considered. Supporting software tools for development of the assurance case are considered. Some ways for improvement and modification are proposed for both assurance case notations (CAE and GSN). For CAE, the authors obtained annex with acceptance and coverage criteria as well as an algorithm of the assurance case update through life cycle stages. For GSN, they improve structured argumentation with support of structured text using. Recommendations for using the assurance case notations and tools for I&C systems are formulated.
TopIntroduction
Final safety and security assessment is running after completion of all development, verification and validation stages. In this section we discuss how can all project artifacts be represented for safety and security assessment, and what is the way to most effectively confirm compliance with the safety and security requirements? The answer to these questions is provided by the Assurance Case methodology, which is widely used in the practice of safety and security assessment.
The Assurance Case is a structured set of arguments and documentary evidence that justify the compliance of a system or service with specified requirements (GSN, 2011).
Licensing and certification authorities check the Assurance Case, as an integral document proving compliance with the entire set of requirements to safety and security. The Assurance Case can be either compiled by the project team or outsourced.
The Assurance Case is used to assess the safety and security of control systems in such fields as energy, automotive, railway, weapons, aviation and space technology, medicine, petrochemical, and others (Evidence, 2011). Researchers identify the following four goals to be achieved for systems (Rushby, 2015):
- 1.
Requirements meet the needs of the customer;
- 2.
Assumptions about the use of systems correctly describe the environment of use;
- 3.
The system design meets the requirements and assumptions regarding the application;
- 4.
The developed system corresponds to the documented design.
There is an international community in the area of the Assurance Case that is engaged in theoretical research and practical application of this methodology. Important acquisitions include the development of documents such as the GSN Community Standard (GSN, 2011) and the Structured Assurance Case Metamodel (SACM, 2016).
Thus, the Assurance Case is a proven methodology with a 20-year history of application, which is constantly evolving and getting support from leading safety and security experts. It seems appropriate to use the Assurance Case in the practice of certification and licensing of Instrumentation and Control (I&C) systems.
TopBackground
The historical and theoretical origins of the Assurance Case lie in the field of logical reasoning, such as operations with logical predicates, including the implication In 1958, the British philosopher Stephen Tulmin published the book “The Uses of Argument”, Toulmin, 1958, in which he expanded the operation of logical inference with the degree of confidence and additional arguments and counter-arguments. In addition, Toulmin proposed to present the argument in graphical form, and this approach has since become widespread.
The predecessor of the Assurance Case is historically the Safety Case. The concept of the Safety Case originated in the 1950s, although the term itself appeared later. The first regulatory document requiring the development of a Safety Case for hazardous industrial facilities is the European Union’s “CIMAH (Control of Major Accidents Hazards) Regulations”. The widespread introduction of the Safety Case into practice began to occur after an unprecedented accident on the Piper Alpha oil platform in the North Sea, which claimed the lives of 167 people in 1988, Cullen, 1990.
All of the above has led to new approaches in safety assessment and assurance. In the 1990s. Tulmin’s argument was used as the basis for the development of semi-formal notations to justify safety, Kelly, 1998. The work was done in the UK, at the University of York, where Goal Structuring Notation (GSN) was developed. Adelard developed the Claim, Argument and Evidence (CAE) notation in parallel. These notations are used in the present, and then we consider them in more detail, Maksimov et al., 2018.
Initially, the focus was on functional safety issues (Safety Case), then with the advent of the information security problem, a similar approach was extended to the Security Case, and with it came the understanding that it was necessary to work simultaneously on providing both safety and security features. Currently, the term Assurance Case means the justification of both safety and security.
We found the following areas of the Assurance Case applications: