Incremental Safety Assessment: Enabling the Comparison of Safety Analysis Results

In our 2008 ISSC paper we have reviewed some pragmatic challenges of incremental system safety assessment and outlined requirements for a framework to identify, track and manage design and analysis changes introduced between iterations. This ‘follow-up’ paper reports our recent work to address these issues. The paper defines an intuitive “lightweight refinement” relation between results of the analyses (minimal cut sets) obtained at different assessment iterations and/or development milestones. The relation is used, however, not to prove conformance between successive assessments, but rather to identify emerging significant differences that require consideration and justification by the safety engineers. Naïve refinement is further extended with the notion of “equivalence mapping” to allow comparison of minimal cut sets defined over different vocabularies of failures. This extension permits comparison of analyses of models of the same system defined by different engineers, at different levels of detail, using different methods and tools. The extension also enables engineers to control the granularity of comparison. Concepts presented throughout the paper are illustrated on an example of an electrical power distribution system of a hypothetical aircraft.