The Illusion of Method: Challenges of Model-Based Safety Assessment

Model-based and automated safety assessment has attracted significant academic and industrial interest over the past two decades. The research into such novel methods has focused on exploitation of design models, new compositional notations for model specification and algorithms for automated model analysis such as minimal cut set generation or fault tree synthesis. Many automated approaches are designed to generate results in the same format as traditional safety analysis methods. This similarity can mislead. Model-based safety assessment introduces an unprecedented dependency of different analyses on a single modelling artefact. Whilst clearly posing potential risk as a 'single point of failure' in the safety engineering process, the issues of automated analysis and the associated confidence that can be claimed in the results of such analysis are rarely addressed. This paper discusses some of the challenges associated with justifying the validity of model-based safety assessment and presents some possible mitigations.