Evidence management for compliance of critical systems with safety standards: A survey on the state of practice

in Information and Software Technology (2015), 60

Context Demonstrating compliance of critical systems with safety standards involves providing convincing evidence that the requirements of a standard are adequately met. For large systems, practitioners ... [more ▼]

Context Demonstrating compliance of critical systems with safety standards involves providing convincing evidence that the requirements of a standard are adequately met. For large systems, practitioners need to be able to effectively collect, structure, and assess substantial quantities of evidence. Objective This paper aims to provide insights into how practitioners deal with safety evidence management for critical computer-based systems. The information currently available about how this activity is performed in the industry is very limited. Method We conducted a survey to determine practitioners’ perspectives and practices on safety evidence management. A total of 52 practitioners from 15 countries and 11 application domains responded to the survey. The respondents indicated the types of information used as safety evidence, how evidence is structured and assessed, how evidence evolution is addressed, and what challenges are faced in relation to provision of safety evidence. Results Our results indicate that (1) V&V artefacts, requirements specifications, and design specifications are the most frequently used safety evidence types, (2) evidence completeness checking and impact analysis are mostly performed manually at the moment, (3) text-based techniques are used more frequently than graphical notations for evidence structuring, (4) checklists and expert judgement are frequently used for evidence assessment, and (5) significant research effort has been spent on techniques that have seen little adoption in the industry. The main contributions of the survey are to provide an overall and up-to-date understanding of how the industry addresses safety evidence management, and to identify gaps in the state of the art. Conclusion We conclude that (1) V&V plays a major role in safety assurance, (2) the industry will clearly benefit from more tool support for collecting and manipulating safety evidence, and (3) future research on safety evidence management needs to place more emphasis on industrial applications. [less ▲]

A Model-Based Framework for Probabilistic Simulation of Legal Policies

in 18th ACM/IEEE International Conference on Model Driven Engineering Languages and Systems (MODELS'15) (2015)

Legal policy simulation is an important decision-support tool in domains such as taxation. The primary goal of legal policy simulation is predicting how changes in the law affect measures of interest, e.g ... [more ▼]

Legal policy simulation is an important decision-support tool in domains such as taxation. The primary goal of legal policy simulation is predicting how changes in the law affect measures of interest, e.g., revenue. Currently, legal policies are simulated via a combination of spreadsheets and software code. This poses a validation challenge both due to complexity reasons and due to legal experts lacking the expertise to understand software code. A further challenge is that representative data for simulation may be unavailable, thus necessitating a data generator. We develop a framework for legal policy simulation that is aimed at addressing these challenges. The framework uses models for specifying both legal policies and the probabilistic characteristics of the underlying population. We devise an automated algorithm for simulation data generation. We evaluate our framework through a case study on Luxembourg's Tax Law. [less ▲]

Automated Detection and Resolution of Legal Cross References: Approach and a Study of Luxembourg's Legislation

in 22nd IEEE International Requirements Engineering Conference (2014, August 25)

An Extended Systematic Literature Review on Provision of Evidence for Safety Certification

in Information and Software Technology (2014), 56(7), 689717

Using UML for Modeling Procedural Legal Rules: Approach and a Study of Luxembourg’s Tax Law

in 17th ACM/IEEE International Conference on Model Driven Engineering Languages and Systems (MODELS'14) (2014)

Many laws, e.g., those concerning taxes and social benefits, need to be operationalized and implemented into public administration procedures and eGovernment applications. Where such operationalization is ... [more ▼]

Many laws, e.g., those concerning taxes and social benefits, need to be operationalized and implemented into public administration procedures and eGovernment applications. Where such operationalization is warranted, the legal frameworks that interpret the underlying laws are typically prescriptive, providing procedural rules for ensuring legal compliance. We propose a UML-based approach for modeling pro- cedural legal rules. With help from legal experts, we investigate actual legal texts, identifying both the information needs and sources of com- plexity in the formalization of procedural legal rules. Building on this study, we develop a UML profile that enables more precise modeling of such legal rules. To be able to use logic-based tools for compliance analysis, we automatically transform models of procedural legal rules into the Object Constraint Language (OCL). We report on an application of our approach to Luxembourg’s Income Tax Law providing initial evidence for the feasibility and usefulness of our approach. [less ▲]

RUBRIC: A Flexible Tool for Automated Checking of Conformance to Requirement Boilerplates

in 9th joint meeting of the European Software Engineering Conference and the ACM SIGSOFT Symposium on the Foundations of Software Engineering (ESEC/FSE 2013) (2013, August)

Supporting the Verification of Compliance to Safety Standards via Model-Driven Engineering: Approach, Tool-Support and Empirical Validation

in Information and Software Technology (2013), 55(1), 836-864

A Goal-Based Approach for Qualification of New Technologies: Foundations, Tool Support, and Industrial Validation

in Reliability Engineering & System Safety (2013), 119

Matching and Merging of Variant Feature Specifications.

in IEEE Transactions on Software Engineering (2012), 38(6), 1355-1375

Modeling and Analysis of CPU Usage in Safety-Critical Embedded Systems to Support Stress Testing

in 15th ACM/IEEE International Conference on Model Driven Engineering Languages & Systems (2012)