Deriving Safety Cases for the Formal Safety Certification of Automatically Generated Code

We present an approach to systematically derive safety cases for automatically generated code from information collected during a formal, Hoare-style safety certification of the code. We use a generic safety case that is instantiated with respect to the certified safety property and the program. It is complemented by a static system safety case that argues the safety of the framework itself, in particular the correctness of the safety policy (i.e., Hoare rules) with respect to the safety property (i.e., safety claims) and the integrity of the certification system and its individual components. However, the safety case only makes explicit the formal and informal reasoning principles, and reveals the top-level assumptions and external dependencies that must be taken into account; the evidence still comes from the formal safety proofs.