Visualizing Safety Cases
Tim Kelly, one of the developers of GSN (Goal Structuring Notation), talks about the origin of GSN, its benefits, the industries adopting it and its future, in an interview with Michael Jesse Chonoles (co-author of UML 2 for Dummies).
Video Transcript
What is GSN and what is it for?
Michael: Hello. I am Michael Chonoles, and I am here at the OMG meeting in Long Beach, California, to interview Tim Kelly, one of the developers of GSN. So what is GSN, what does it stand for, and what problems does it solve?
Tim: OK, GSN stands for “Goal Structuring Notation”. It is a graphical argument notation that lets you visually represent the elements of an argument: the individual claims, the assumptions you are making and the strategies that have been used, right down to the evidence that supports your argument.
The problem it’s trying to solve is that, historically, arguments for things like safety and security were written as narrative reports, so you would write out your arguments and justifications in text. That is OK sometimes, but a lot of people complained that they couldn’t see the structure of the argument very clearly, or the individual claims and assumptions. And it was often very hard for them to trace from the claims being made right down to the evidence that was actually being used.
Michael: So it helps you organize your arguments with evidence.
Tim: Yes.
Who developed GSN?
Michael: So who are the people who came up with GSN, and what made them think of it?
Tim: The team comes from the University of York. We have a High Integrity Systems Engineering group, and a group of us came up with it. The original inspirations were, first of all, early work on argumentation, by a man called Stephen Toulmin, who wrote about how to structure informal arguments. We used that as one of our sources. At the same time, in the early 90s, when we started to develop GSN, there was work on goal-based requirements engineering. So what you see in GSN is, if you like, a fusion of the work on argumentation with the philosophy of goal-based requirements engineering. That’s how GSN came about.
Which industries use GSN?
Michael: So what industries have been picking up GSN?
Tim: Really a whole variety of industries; in fact, it’s growing every day, and I keep finding new examples. It’s been used for aerospace, medical devices, chemical plants and offshore gas platforms. Railways too: some of their safety cases are represented in GSN. Increasingly it’s used all around the world. It came from the UK, and now you can find applications everywhere, like the UK-US Joint Strike Fighter, which has a GSN-based safety case.
If you arrive at London Heathrow Terminal 5 and travel around on the personal rapid transit system, that has a GSN safety case. Even some of our really old aircraft in the UK, like the Battle of Britain Memorial Flight, apparently have GSN safety cases as well. So the range of uses is really wide.
Michael: So I’m likely to have used a system or a device that GSN was involved in making.
Tim: Yes.
How has GSN changed industry practice?
Michael: How does GSN change current industry practice? Do users really feel it’s an improvement for them?
Tim: Yes. I have been working on it for 20 years, and if you go right back to the beginning, the whole idea of using graphics to represent these arguments was quite foreign to people. One of the best-known things GSN has done is bring that into mainstream safety case arguments.
People are really using it to share arguments where they wouldn’t have done before. Now, what’s the benefit? What engineers would say is comprehension: easier understanding of their arguments, and less time to agree on them. Often safety cases are written by one group of people and accepted by another, so you want the clearest, most efficient way of communicating.
Michael: So the regulators seem to understand it and have adopted it?
Tim: There are quite a few examples of regulators that have encouraged it as an approach, because it makes their life easier when they’re given safety cases with this clear structure; they are easier to follow.
Michael: Yes, I understand the US FDA has started to look at it.
Tim: Yes. Since they started asking for assurance cases, there are examples where people use GSN to structure them clearly, which helps the reviewers, who only have a limited amount of time to review those safety cases.
The future of GSN
Michael: So what’s your vision for where it’s going to go?
Tim: Well, the core concept of GSN is pretty stable. As I mentioned, it’s been around for about 20 years, and even some of the extensions I’ve been involved in, such as modular GSN, are 10 or 15 years old. What we are looking at in York is extending it into what we call “model-based assurance cases”: how we can automatically link GSN-based arguments with other kinds of system models, such as SysML or AADL, and in some cases automatically generate the arguments from system models and the analyses performed on them.
Michael: Yes, I know the SysML committee has been thinking about using GSN for two purposes. One is to verify that they’ve met their safety requirements, and the other is to justify design decisions, such as why they picked this part over a competing one. You always have to document that, and using GSN seems very powerful for it.
Tim: Yes. Could be!
Michael: Thank you for your time, it’s been wonderful. We will see each other again, I’m sure.
To create GSN diagrams and safety cases, see Astah System Safety.