Building a Preliminary Safety Case: An Example from Aerospace

The phased production of safety cases, in step with an evolving design, is an increasingly common approach to managing the potential risk associated with certification. The Preliminary Safety Case, the first safety case to be issued, is prepared during the initial stages of project development. An important part of the Preliminary Safety Case involves defining the safety argument approach that is being adopted for the system. Such an argument can make clear the principal safety objectives and constraints of the project, and outline how they will be interpreted and addressed. In this paper we describe the production of these ‘Preliminary Safety Arguments’. In particular, we show how we have used the Goal Structuring Notation as the basis for presenting the Preliminary Safety Argument for a distributed computing platform for aero-engine control. Through such an approach, we argue that certification risk can be reduced by deriving safety objectives in advance of system development rather than ‘discovering’ them after significant functional design commitments have already been made.