The principled design of computer system safety analyses

Safety critical computing is a relatively young and rapidly developing technology, which nevertheless is being deployed in applications where a single accident may have extremely severe consequences. The safety record of critical systems presently in service is reasonably good, but increasing expectations of functionality and performance are challenging the capabilities of current design and assessment processes. One specific area where limitations of existing methods are becoming obvious is in the analysis techniques that are used to derive safety requirements and to provide evidence that they have been satisfied. There are significant practical problems in using existing analysis techniques to evaluate computer systems, but few viable new computerspecific methods have been developed. This thesis proposes and evaluates a set of principles for the design of effective techniques to address novel computer system safety analysis requirements. The principles are based on an appreciation of the technical concepts underlying successful existing system level analysis techniques, and of the practical qualities necessary to make a method industrially acceptable. The principles are applied in the development of two new safety analysis techniques for systems containing computers. The first new technique developed is Software Hazard Analysis and Resolution in Design (SHARD), a variant of the process industries' HAZOP technique. SHARD provides a structured approach to the identification of potentially hazardous behaviour in software systems. The second technique, Low-level Interaction Safety Analysis (LISA), implements a novel analysis approach based on a concept of system resources. It provides a method for establishing detailed evidence about the safety implications of interactions between software and the hardware upon which it is executed. The thesis describes the evaluation of the techniques through a series of large scale case studies and industrial trials.