Architecting and generalizing a safety case for critical condition detection software an experience report

Safety cases and, specifically, software safety cases, have had virtually no presence in engineering practice in the US. Recent interest, in addition to an early attempt to introduce them into practice in the NASA Constellation Program, motivated us to develop a partial safety case for a safety critical subsystem for the Ares I vehicle, namely the abort detection, notification and response (AFDNR) system. This paper relates our experience applying the safety case concept to AFDNR, particularly from the perspective of generalizing the safety issues to similar fault management systems. We also provide lessons learned, including a discussion of issues that led to our current refactoring of our initial safety case.