On the integration of requirements engineering and assurance case development

Abstract

Assurance Case Development (ACD) is an emerging approach for demonstrating that a system is safe. Assurance cases (ACs) comprise various project information, including require- ments and their traceability to other artefacts. It is challenging for teams to build ACs as they have to identify and gather the project information relevant to the argumentation and assess its consistency and completeness. Moreover, regular project information (e.g., require- ments, design, rationale) and assurance-related information (e.g., hazard, causes, mitigation strategies) are likely managed separately. In this context, software and assurance teams lack a shared information repository on which they can cross-collaborate, integrate artefacts, and review traceability. Motivated by this scenario, we propose a framework called AssuRance CAse DEvelopment (ARCADE) to support teams in managing assurance information inside regular project management tools and to provide automated assessment and AC generation. This research was performed in four steps. First, a Systematic Mapping Study to investigate the existing approaches for incremental ACD. Second, a practitioners’ survey to understand how requirements engineering (RE) and ACD activities currently interplay. Third, the devel- opment of the framework. Fourth, ARCADE evaluation through a) illustrative scenarios; and b) a qualitative study with practitioners. The first step resulted in the identification of 16 approaches for incremental development of ACs through the development lifecycle. The sec- ond step resulted in new evidence that integration between RE and ACD occurs across all RE activities, and that practitioners perceive benefits such as raising safety assurance awareness, early traceability development, and early identification of assurance evidence needs. Moreover, practitioners see requirements specification and change request analysis as the most suitable activities for integrating ACD and RE. In the third step, ARCADE framework was designed and implemented to address some of the research and practice gaps identified in the previous studies. The core of the framework is an operational ontology that interrelates concepts from RE and AC domains. The framework tool automates the retrieval of data from project man- agement tools, to ingest into an ontology reasoner. The framework automation encompasses the extraction of data from the tools, the data mapping into semantic triples, the ingestion of the triples into an ontology reasoner, the quality analysis, and the collection of data items to generate the AC fragments. In the fourth step, ARCADE was evaluated through two illustrative scenarios based on publicly available datasets. The analysis of reports and ACs generated for the datasets resulted in identification of traceability gaps and AC fragments based on different argumentation patterns. In the qualitative study with practitioners, we gather their perceptions on the ARCADE tool features. As evidenced in the evaluations, ARCADE has the potential to help teams to collaborate across requirements and assurance artefacts using regular project management tools, thus fostering early and continuous review of safety assurance aspects of the system under development.