Integration Between Requirements Engineering and Safety Analysis: a Systematic Literature Review
Total Page:16
File Type:pdf, Size:1020Kb
The Journal of Systems and Software 125 (2017) 68–92 Contents lists available at ScienceDirect The Journal of Systems and Software journal homepage: www.elsevier.com/locate/jss Integration between requirements engineering and safety analysis: A systematic literature review ∗ Jéssyka Vilela a, , Jaelson Castro a, Luiz Eduardo G. Martins b, Tony Gorschek c a Centro de Informática, Universidade Federal de Pernambuco, Recife-PE, Brazil b Departamento de Ciência e Tecnologia, Universidade Federal de São Paulo, São José dos Campos, Brazil c Blekinge Institute of Technology (BTH), Sweden a r t i c l e i n f o a b s t r a c t Article history: Context: Safety-Critical Systems (SCS) require more sophisticated requirements engineering (RE) ap- Received 27 June 2016 proaches as inadequate, incomplete or misunderstood requirements have been recognized as a major Revised 18 October 2016 cause in many accidents and safety-related catastrophes. Objective: In order to cope with the complexity Accepted 21 November 2016 of specifying SCS by RE, we investigate the approaches proposed to improve the communication or inte- Available online 22 November 2016 gration between RE and safety engineering in SCS development. We analyze the activities that should be Keywords: performed by RE during safety analysis, the hazard/safety techniques it could use, the relationships be- Safety-critical systems tween safety information that it should specify, the tools to support safety analysis as well as integration Requirements engineering benefits between these areas. Method: We use a Systematic Literature Review (SLR) as the basis for our Safety analysis work. Results: We developed four taxonomies to help RE during specification of SCS that classify: tech- Integration niques used in (1) hazard analysis; (2) safety analysis; (3) safety-related information and (4) a detailed Communication set of information regarding hazards specification. Conclusions: This paper is a step towards developing Systematic literature review a body of knowledge in safety concerns necessary to RE in the specification of SCS that is derived from a large-scale SLR. We believe the results will benefit both researchers and practitioners. ©2016 Elsevier Inc. All rights reserved. 1. Introduction ( Leveson, 2011; Wilikens et al., 1997 ). The system requirements definition corresponds to the activity that focus on what the Safety-critical systems are those systems composed by a set system should do and it may contain elements of design ( Ivarsson of hardware, software, process, data and people ( Du et al., 2014 ) and Gorschek, 2011 ). It is most efficient to consider safety con- whose failure could result in accidents that cause damage to the cerns as early as possible during software development in order to environment, financial losses, injury to people and even the loss of ensure that safety problems do not propagate through subsequent lives ( Leveson, 2011; Hatcliff et al., 2014 ). phases of development ( Saeed et al., 1995; Wilikens et al., 1997 ). The use of software in SCS, in particular in control systems, According to Leveson (2011) , separating safety engineering from has increased to such an extent that failures in the software can the RE process is almost guaranteed to make the effort and re- impair system safety ( Saeed et al., 1995 ). Investigations into the sources expended a poor investment and possibly the development causes of accidents indicate that more rigor is required in set- of a system that is not safe ( Leveson, 2011 ). Safety engineering is ting the requirements and specification of safety-related systems effective when it participates in and provides input to the RE pro- ( Simpson and Stoker, 2002 ) since inadequate or misunderstood re- cess and to the system design, not when it focuses on making ar- quirements ( Ratan et al., 1996 ) have been recognized as the ma- guments about the artifacts created after the major safety-related jor cause (not coding or implementation Guillerm et al., 2010 ) of a decisions have been made. significant proportion of accidents ( Simpson and Stoker, 2002 ) and In the context of SCS development, a tighter integration of safety-related catastrophes ( Leveson, 2002 ). safety engineering concerns into the RE process is desired by Therefore, safety cannot be assured without its al- academia and industry ( Leveson, 2011; Lutz, 20 0 0; Martins and ready being part of the RE process and the system design Gorschek, 2016; Heimdahl, 2007; Sikora et al., 2012; Hatcliff et al., 2014 ). A systematic integration of safety engineering ( Navarro et al., 2006; El Ariss et al., 2011 ) with the requirements engineer- ∗ Corresponding author. ing and a common nomenclature ( Zoughbi et al., 2011 ) are re- E-mail addresses: [email protected] (J. Vilela), [email protected] (J. Castro), quired in order to satisfy system correctness and safety require- [email protected] (L.E.G. Martins), [email protected] (T. Gorschek). http://dx.doi.org/10.1016/j.jss.2016.11.031 0164-1212/© 2016 Elsevier Inc. All rights reserved. J. Vilela et al. / The Journal of Systems and Software 125 (2017) 68–92 69 ments ( Thramboulidis and Scholz, 2010 ) as well as to provide a 2.1. Related work framework for effective cooperation between experts ( Scholz and Thramboulidis, 2013; Zoughbi et al., 2011 ). Catastrophic accidents continue to occur despite advances Catastrophic safety incidents continue to occur despite ad- in the understanding of the underlying causes over the years vances in the understanding of the underlying causes over the ( Mannan et al., 2015 ). This may constitute an evidence that the years ( Mannan et al., 2015 ). Hence, in order to cope with the com- traditional development process of SCS must be changed in or- plexity of performing hazard/safety analysis and specifying SCS, we der to consider the safety concerns early in the RE process. There- are investigating, through a SLR, the approaches proposed to im- fore, the system safety analysis is the first phase to identify soft- prove the requirements communication and integration between ware safety requirements necessary to support the development of RE and Safety Engineering in the development of SCS. the software requirements specification ( Medikonda and Panchu- In this paper, we analyze the activities that should be per- marthy, 2009 ). formed by requirements engineering during safety analysis, the In this context, the integration between RE and safety engineer- hazard/safety techniques they could use, the relationships between ing is well desired by academia and industry. We noticed a ten- safety information that they should specify, the tools that can be dency in RE and safety research in trying to join these two areas used to support safety analysis as well as the benefits of the inte- by different research lines. gration between RE and safety engineering. From the point of view of RE, the model-driven paradigm has The results of this paper are a step towards developing a body been used to some works to reduce the gap between these two of knowledge in safety concerns necessary to be handled to re- areas by the use of shared models that includes safety character- quirements engineers in the specification of SCS that were derived istics ( Leveson, 2002; Murali et al., 2015 ) or system engineering from a large-scale rigorous literature review. As part of our work, best practices ( Guillerm et al., 2010 ). In this context, UML ( Beckers we developed four taxonomies to help the requirements engineers et al., 2013; Briones et al., 2007; Zoughbi et al., 2011 ) or SysML in the specification of SCS that classify (1) the techniques used in ( Scholz and Thramboulidis, 2013; Biggs et al., 2016 ) profiles have the hazard analysis; (2) the techniques used in the safety analysis; been proposed. (3) the safety-related information and (4) a detailed set of infor- From the safety engineering, safety analysis tools ( Ratan et al., mation regarding the specification of hazards. 1996 ), methodologies ( Kelly and Weaver, 2004 ) and metamod- This paper is organized as follows. Section 2 presents back- els ( OMG, 2016; Panesar-Walawege et al., 2010; de la Vara and ground and related work. The research methodology adopted to Panesar-Walawege, 2013; de la Vara et al., 2016 ) for the con- conduct the SLR is presented in Section 3 . The results and the anal- struction of assurance safety cases have been developed. However, ysis related to our research questions are presented in Section 4 . many of these studies are partially or not compliant with safety Our conclusions are presented in Section 5 . standards and it is unclear whether these approaches can cope with the complexity of the large-scale development of software- 2. Background and related work intensive systems, taking inter-departmental and multi-disciplinary aspects into account ( Pernstål et al., 2015 ). Hence, further research Safety-critical systems are those systems whose failure could is necessary to investigate the extent that these approaches inte- result in harm (generally meaning injury or death) ( Hatcliff et al., grate these engineers as well as their compliance with safety stan- 2014 ). Loss may involve human death and injury, but it may also dards. involve other major losses, including mission, equipment, financial, Another research line in the safety area is improving the con- and information losses ( Leveson, 2011 ). struction of assurance safety cases. They should communicate a During the development of SCS, safety engineers typically re- clear, comprehensive and defensible