Arguing from Hazard Analysis in Safety Cases: A Modular Argument Pattern

TL;DR

This work tackles the problem of overly abstract and hard-to-trace safety arguments derived from hazard analysis. It introduces a modular pattern with three interacting modules (M, CR, HC) that integrate FTA, FMEA, and STPA with hazard-reduction reactions (design increments, countermeasures) and demonstrates the approach on a train door control system. The pattern supports top-down argument construction, enhances semantic traceability, and aligns HA evidence with verification and modeling activity, as shown by a student-lab evaluation. The study points to practical paths for formalizing and computer-assisted construction of safety cases, paving the way for more trustworthy, reusable safety arguments across domains.

Abstract

We observed that safety arguments are prone to stay too abstract, e.g. solutions refer to large packages, argument strategies to complex reasoning steps, contexts and assumptions lack traceability. These issues can reduce the confidence we require of such arguments. In this paper, we investigate the construction of confident arguments from (i) hazard analysis (HA) results and (ii) the design of safety measures, i.e., both used for confidence evaluation. We present an argument pattern integrating three HA techniques, i.e., FTA, FMEA, and STPA, as well as the reactions on the results of these analyses, i.e., safety requirements and design increments. We provide an example of how our pattern can help in argument construction and discuss steps towards using our pattern in formal analysis and computer-assisted construction of safety cases.

Figures (15)

• Figure 1: Module overview and main module M
• Figure 2: GSN legend. Nodes contain element descriptions.
• Figure 3: Refinements of \ref{['fig:pattern:m']} for FTA, STPA, and FMEA
• Figure 4: Module CR argument pattern for FTA
• Figure 5: Module CR argument pattern for FMEA