Developing Compelling Safety Cases
Richard Hawkins
TL;DR
The paper addresses persistent weaknesses in safety-case practice, including confirmation bias, post-hoc assurance, and safety-case as paperwork. It proposes a six-stage method that extends established safety-argument practices to integrate challenge, mitigation, and lifecycle monitoring. The approach explicitly separates risk arguments from confidence and operational arguments, uses dialectic reasoning and independent reviews, and ties safety reasoning to design and operation. Its infusion-pump example demonstrates how the method supports risk-focused, decision-driven safety assurance across system lifecycles, with relevance for increasingly complex, autonomous, and interconnected systems.
Abstract
This paper describes a method for creating compelling safety cases. The method seeks to help improve safety case practice in order to address the weaknesses identified in current practice, in particular confirmation bias, after-the-fact assurance and safety cases as a paperwork exercise. Rather than creating new notations and tools to address these issues, we contend that it is improvements in the safety case process that will make the most significant improvement to safety case practice. Our method builds upon established approaches and best practice to create an approach that will ensure safety cases are risk-focused, seek to identify ways in which the system may not be safe (rather than just assuming it is), drive safe design and operation of the system (influencing the system itself rather than just documenting what's there), are used to support decisions made throughout the life of the system, including system operation and change, and encourage developers and operators to think about and understand why their system is safe (and when it isn't). A simple example of an infusion pump system is used to illustrate how the new method is applied in practice.