@article {19104,
	title = {Evidence Management for Compliance of Critical Systems with Safety Standards: A Survey on the State of Practice},
	journal = {Information and Software Technology},
	volume = {60},
	year = {2015},
	month = {April 2015},
	pages = {1-15},
	publisher = {Elsevier},
	address = {Science Direct},
	abstract = {Context: Demonstrating compliance of critical systems with safety standards involves providing convincing evidence that the requirements of a standard are adequately met. For large systems, practitioners need to be able to effectively collect, structure, and assess substantial quantities of evidence.Objective: This paper aims to provide insights into how practitioners deal with safety evidence management for critical computer-based systems. The information currently available about how this activity is performed in the industry is very limited.Method: We conducted a survey to determine practitioners{\textquoteright} perspectives and practices on safety evidence management. A total of 52 practitioners from 15 countries and 11 application domains responded to the survey. The respondents indicated the types of information used as safety evidence, how evidence is structured and assessed, how evidence evolution is addressed, and what challenges are faced in relation to provision of safety evidence.Results: Our results indicate that (1) V\&amp;V artefacts, requirements specifications, and design specifications are the most frequently used safety evidence types, (2) evidence completeness checking and impact analysis are mostly performed manually at the moment, (3) text-based techniques are used more frequently than graphical notations for evidence structuring, (4) checklists and expert judgement are frequently used for evidence assessment, and (5) significant research effort has been spent on techniques that have seen little adoption in the industry. The main contributions of the survey are to provide an overall and up-to-date understanding of how the industry addresses safety evidence management, and to identify gaps in the state of the art.Conclusion: We conclude that (1) V\&amp;V plays a major role in safety assurance, (2) the industry will clearly benefit from more tool support for collecting and manipulating safety evidence, and (3) future research on safety evidence management needs to place more emphasis on industrial applications.},
	keywords = {safety assurance, safety certification, safety evidence, Safety-critical systems, state of the practice.},
	doi = {doi:10.1016/j.infsof.2014.12.002},
	url = {http://www.sciencedirect.com/science/article/pii/S0950584914002560},
	author = {Nair, Sunil and Jose Luis {de la Vara} and Sabetzadeh, Mehrdad and Falessi, Davide}
}
@article {IST2014,
	title = {An Extended Systematic Literature Review on Provision of Evidence for Safety Certification},
	journal = {Information and Software Technology},
	volume = {56},
	number = {7},
	year = {2014},
	pages = {689-717},
	publisher = {Elsevier},
	abstract = {Context: Critical systems in domains such as aviation, railway, and automotive are often subject to a formal process of safety certification. The goal of this process is to ensure that these systems will operate safely without posing undue risks to the user, the public, or the environment. Safety is typically ensured via complying with safety standards. Demonstrating compliance to these standards involves providing evidence to show that the safety criteria of the standards are met. Objective: In order to cope with the complexity of large critical systems and subsequently the plethora of evidence information required for achieving compliance, safety professionals need in-depth knowledge to assist them in classifying different types of evidence, and in structuring and assessing the evidence. This paper is a step towards developing such a body of knowledge that is derived from a large-scale empirically rigorous literature review. Method: We use a Systematic Literature Review (SLR) as the basis for our work. The SLR builds on 218 peer-reviewed studies, selected through a multi-stage process, from 4,963 studies published between 1990 and 2012. Results: We develop a taxonomy that classifies the information and artefacts considered as evidence for safety. We review the existing techniques for safety evidence structuring and assessment, and further study the relevant challenges that have been the target of investigation in the academic literature. We analyse commonalities in the results among different application domains and discuss implications of the results for both research and practice. Conclusion: The paper is, to our knowledge, the largest existing study on the topic of safety evidence. The results are particularly relevant to practitioners seeking a better grasp on evidence requirements as well as to researchers in the area of system safety. As a major finding of the review, the results strongly suggest the need for more practitioner-oriented and industry-driven empirical studies in the area of safety certification.},
	author = {Nair, Sunil and Jose Luis {de la Vara} and Sabetzadeh, Mehrdad and Briand, Lionel Claude}
}
@article {Simula.simula.1990,
	title = {Traceability and SysML Design Slices to Support Safety Inspections: a Controlled Experiment},
	journal = {ACM Transactions on Software Engineering and Methodology},
	volume = {23},
	number = {9},
	year = {2014},
	publisher = {ACM},
	address = {New York},
	abstract = {Certifying safety-critical software and ensuring its safety requires checking the conformance between safety requirements and design. Increasingly, the development of safety-critical software relies on modeling, and the System Modeling Language (SysML) is now commonly used in many industry sectors. Inspecting safety conformance by comparing design models against safety requirements requires safety inspectors to browse through large models and is consequently time consuming and error-prone. To address this, we have devised a mechanism to establish traceability between (functional) safety requirements and SysML design models to extract design slices (model fragments) that filter out irrelevant details but keep enough context information for the slices to be easy to inspect and understand. In this paper, we report on a controlled experiment assessing the impact of the traceability and slicing mechanism on inspectors\&$\#$39; conformance decisions and effort. Results show a significant decrease in effort and an increase in decisions\&$\#$39; correctness and level of certainty.},
	author = {Briand, Lionel and Falessi, Davide and Nejati, Shiva and Sabetzadeh, Mehrdad and Yue, Tao}
}
@inproceedings {Simula.simula.1656,
	title = {Classification, Structuring, and Assessment of Evidence for Safety: a Systematic Literature Review},
	journal = {2013 IEEE Sixth International Conference on Software Testing, Verification and Validation (ICST 2013)},
	year = {2013},
	publisher = {IEEE},
	type = {Conference},
	abstract = {Safety assurance and certification are amongst the most expensive and time-consuming tasks in the development of safety-critical systems. Demonstration of compliance with safety standards involves providing evidence that the standards\&$\#$39; safety criteria are met. To handle large collections of evidence effectively, safety professionals need knowledge of how to classify different types of evidence, how to structure the evidence, and how to assess it. This paper takes a step towards developing such a body of knowledge by conducting a Systematic Literature Review (SLR). Specifically, the SLR identifies and classifies the information and artefacts considered as evidence for safety, examines existing techniques for evidence structuring and assessment, and summarizes the challenges noted in the literature in relation to safety evidence. The paper, to our knowledge, is the first systematic review on the topic of safety evidence. The results we present are particularly relevant to practitioners seeking to better understand the evidence requirements for safety certification, as well as to researchers conducting research in this area. Keywords: safety-critical systems; safety standards; safety compliance; safety certification; safety evidence; systematic literature review.},
	keywords = {Conference},
	author = {Nair, Sunil and Jose Luis {de la Vara} and Sabetzadeh, Mehrdad and Briand, Lionel},
	editor = {Baudry, Benoit and Orso, A. and Le Traon, Yves}
}
@techreport {25311,
	title = {An Extended Systematic Literature Review on Provision of Evidence for Safety Certification},
	number = {2013-02},
	year = {2013},
	note = {This technical report is an early version of a published journal article. The published article can be found here:https://www.simula.no/publications/extended-systematic-literature-review-provision-evidence-safety-certification},
	publisher = {Simula Research Laboratory},
	author = {Nair, Sunil and Jose Luis {de la Vara} and Sabetzadeh, Mehrdad and Falessi, Davide}
}
@article {Simula.simula.2028,
	title = {A Goal-Based Approach for Qualification of New Technologies: Foundations, Tool Support, and Industrial Validation},
	journal = {Reliability Engineering and System Safety (RESS)},
	number = {119},
	year = {2013},
	publisher = {Elsevier},
	abstract = {New technologies typically involve innovative aspects that are not addressed by the existing normative standards and hence are not assessable through common certification procedures. To ensure that new technologies can be implemented in a safe and reliable manner, a specific kind of assessment is performed, which in many industries, e.g., the energy sector, is known as Technology Qualification (TQ). TQ aims at demonstrating with an acceptable level of confidence that a new technology will function within specified limits. Expert opinion plays an important role in TQ, both to identify the safety and reliability evidence that needs to be developed, and to interpret the evidence provided. Since there are often multiple experts involved in TQ, it is crucial to apply a structured process for eliciting expert opinions, and to use this information systematically when analyzing the satisfaction of a technology\&$\#$39;s safety and reliability objectives. In this article, we present a goal-based approach for TQ. Our approach enables analysts to quantitatively reason about the satisfaction of a technology\&$\#$39;s overall goals and further to identify the aspects that must be improved to increase goal satisfaction. The approach is founded on three main components: goal models, expert elicitation, and probabilistic simulation. We describe a tool, named Modus, that we have developed in support of our approach. We provide an extensive empirical validation of our approach through two industrial case studies and a survey.},
	doi = {10.1016/j.ress.2013.05.005},
	author = {Sabetzadeh, Mehrdad and Falessi, Davide and Briand, Lionel and Di Alesio, Stefano}
}
@techreport {RESSJ2013,
	title = {Management of Evidence for Compliance With Safety Standards: a Survey on the State of Practice},
	number = {2012-27},
	year = {2013},
	publisher = {Simula Research Laboratory},
	abstract = {In many domains such as avionics, railway, and automotive, safety-critical systems must comply with prescribed measures for safety, usually presented in the form of safety standards. Demonstrating compliance with a safety standard involves providing convincing evidence that the requirements envisaged by the standard are adequately met. Real systems are large and thus require collecting and managing large quantities of evidence throughout their lifecycle. Lack of knowledge on how to collect, structure, and assess evidence can lead to certification risks. This paper aims to provide insights into how practitioners deal with safety evidence management. Specifically, we report on a survey conducted with the goal of determining practitioners\&$\#$39; practices and perspectives on safety evidence management. A total of 52 practitioners from 15 countries and 11 application domains responded to the survey, indicating what types of information constitute evidence for safety, how evidence is structured and assessed, how evidence evolution is addressed, and what challenges they face with regards to providing evidence. The paper further analyses the commonalities across different application domains and compares the results against the state of the art. The results notably indicate that practitioners currently undertake an extensive amount of manual work while collecting and manipulating evidence information. This can be both costly and error-prone, thus suggesting the need for better tool-support for evidence management.},
	author = {Nair, Sunil and Jose Luis {de la Vara} and Sabetzadeh, Mehrdad and Falessi, Davide}
}
@article {24491,
	title = {Supporting the verification of compliance to safety standards via model-driven engineering: Approach, tool-support and empirical validation},
	journal = {Information and Software Technology},
	volume = {55},
	year = {2013},
	pages = {836-864},
	publisher = {Elsevier},
	author = {Rajwinder Kaur {Panesar-Walawege} and Sabetzadeh, Mehrdad and Briand, Lionel}
}
@techreport {25251,
	title = {An Extended Systematic Literature Review on Classification, Structuring and Assessment of Evidence for Safety Compliance},
	number = {2012-23},
	year = {2012},
	publisher = {Simula Research Laboratory},
	author = {Nair, Sunil and Jose Luis {de la Vara} and Sabetzadeh, Mehrdad and Briand, Lionel}
}
@article {Simula.simula.1066,
	title = {Matching and Merging of Variant Feature Specifications},
	journal = {IEEE Transactions on Software Engineering},
	volume = {38},
	number = {6},
	year = {2012},
	pages = {1355-1375},
	publisher = {IEEE},
	abstract = {Model Management addresses the problem of managing an evolving collection of models, by capturing the relationships between models and providing well-defined operators to manipulate them. In this article, we describe two such operators for manipulating feature specifications described using hierarchical state machine models: Match, for finding correspondences between models, and Merge, for combining models with respect to known or hypothesized correspondences between them. Our Match operator is heuristic, making use of both static and behavioural properties of the models to improve the accuracy of matching. Our Merge operator preserves the hierarchical structure of the input models, and handles differences in behaviour through parameterization. This enables us to automatically construct merges that preserve the semantics of hierarchical state machines. We report on tool support for our Match and Merge operators, and illustrate and evaluate our work by applying these operators to a set of telecommunication features built by AT\&amp;T.},
	author = {Nejati, Shiva and Sabetzadeh, Mehrdad and Chechik, Marsha and Easterbrook, Steve and Zave, Pamela}
}
@inproceedings {16146,
	title = {Modeling and Analysis of CPU Usage in Safety-Critical Embedded Systems to Support Stress Testing},
	journal = {The ACM/IEEE 15th International Conference on Model Driven Engineering Languages \& Systems (MODELS 2012)},
	year = {2012},
	type = {Conference},
	abstract = {Software safety certification needs to address non-functional constraints with safety implications, e.g., deadlines, throughput, and CPU and memory usage. In this paper, we focus on CPU usage constraints and provide a framework to support the derivation of test cases that maximize the chances of violating CPU usage requirements. We develop a conceptual model specifying the generic abstractions required for analyzing CPU usage and provide a mapping between these abstractions and UML/MARTE. Using this model, we formulate CPU usage analysis as a constraint optimization problem and provide an implementation of our approach in a state-of-the-art optimization tool. We report an application of our approach to a case study from the maritime and energy domain. Through this case study, we argue that our approach (1) can be applied with a practically reasonable overhead in an industrial setting, and (2) is effective for identifying test cases that maximize CPU usage.},
	doi = {10.1007/978-3-642-33666-9_48},
	author = {Nejati, Shiva and Di Alesio, Stefano and Sabetzadeh, Mehrdad and Briand, Lionel Claude}
}
@inproceedings {researchbased,
	title = {Research-Based Innovation: a Tale of Three Projects in Model-Driven Engineering},
	journal = {Model Driven Engineering Languages and Systems, 15th International Conference, MODELS 2012},
	volume = {7590},
	year = {2012},
	pages = {793-809},
	publisher = {Springer Berlin Heidelberg},
	type = {Conference},
	abstract = {In recent years, we have been exploring ways to foster a closer collaboration between software engineering research and industry both to align our research with practical needs, and to increase awareness about the importance of research for innovation. This paper outlines our experience with three research projects conducted in collaboration with the industry. We examine the way we collaborated with our industry partners and describe the decisions that contributed to the effectiveness of the collaborations. We report on the lessons learned from our experience and illustrate the lessons using examples from the three projects. The lessons focus on the applications of Model-Driven Engineering (MDE), as all the three projects we draw on here were MDE projects. Our goal from structuring and sharing our experience is to contribute to a better understanding of how researchers and practitioners can collaborate more effectively and to gain more value from their collaborations.},
	keywords = {Conference},
	doi = {10.1007/978-3-642-33666-9\_50},
	author = {Falessi, Davide and Nejati, Shiva and Sabetzadeh, Mehrdad and Yue, Tao},
	editor = {Briand, Lionel}
}
@techreport {SLR-Full-Extracted-Data,
	title = {SLR on Evidence Classification, Structuring and Assessment for Safety. Extracted Data, Technical Report},
	number = {2012-13},
	year = {2012},
	publisher = {Simula Research Laboratory},
	abstract = {Context: Critical systems in domains such as avionics, railway, and automotive are often subject to a formal process of safety certification. The goal of this process is to ensure that these systems will operate safely without posing undue risks to the user, the public, or the environment. Safety is typically ensured via complying with safety standards. Demonstrating compliance to these standards involves providing evidence to show that the safety criteria of the standards are met. Objective: In order to cope with the complexity of large critical systems and subsequently the large plethora of evidence information required for achieving compliance, safety professionals need in-depth knowledge to assist them in classifying different types of evidence, and in structuring and assessing the evidence. This paper is a step towards developing such a body of knowledge that is derived from a large-scale empirically rigorous literature review. Method: We use a Systematic Literature Review (SLR) as the basis for our work. The SLR builds on 217 peer-reviewed studies, selected through a multi- stage process, from 4,963 studies published between 1990 and 2012. Results: We develop a taxonomy that classifies the information and artefacts considered as evidence for safety. We review the existing techniques for safety evidence structuring and assessment, and further study the relevant challenges that have been the target of investigation in the academic literature. We analyse commonalities in the results among different application domains and discuss implications of the results for both research and practice. Conclusion: The paper is, to our knowledge, the largest existing study on the topic of safety evidence. The results are particularly relevant to practitioners seeking a better grasp on evidence requirements as well as to researchers in the area of system safety. As a major finding of the review, the results strongly suggest the need for more practitioner-oriented and industry-driven empirical studies in the area of safety certification.},
	author = {Nair, Sunil and Jose Luis {de la Vara} and Sabetzadeh, Mehrdad and Briand, Lionel}
}
@article {Simula.simula.1122,
	title = {A SysML-Based Approach to Traceability Management and Design Slicing in Support of Safety Certification: Framework, Tool Support, and Case Studies},
	journal = {Information and Software Technology},
	volume = {54},
	number = {6, June 2012},
	year = {2012},
	pages = {569-590},
	publisher = {Butterworth-Heinemann/ Elsevier },
	abstract = {Traceability is one of the basic tenets of all safety standards and a key prerequisite for software safety certification. In the current state of practice, there is often a significant traceability gap between safety requirements and software design. Poor traceability, in addition to being a non-compliance issue on its own, makes it difficult to determine whether the design fulfills the safety requirements, mainly because the design aspects related to safety cannot be clearly identified. The goal of this article is to develop a framework for specifying and automatically extracting design aspects relevant to safety requirements. This goal is realized through the combination of two components: (1) A methodology for establishing traceability between safety requirements and design, and (2) an algorithm that can extract for any given safety requirement a minimized fragment (slice) of the design that is sound, and yet easy to understand and inspect. We ground our framework on System Modeling Language (SysML). The framework includes a traceability information model, a methodology to establish traceability, and mechanisms for model slicing based on the recorded traceability information. The framework is implemented in a tool, named SafeSlice. We prove that our slicing algorithm is sound for temporal safety properties, and argue about the completeness of slices based on our practical experience. We report on the lessons learned from applying our approach to two case studies, one benchmark and one industrial case. Both studies indicate that our approach substantially reduces the amount of information that needs to be inspected for ensuring that a given (behavioral) safety requirement is met by the design.},
	author = {Nejati, Shiva and Sabetzadeh, Mehrdad and Falessi, Davide and Briand, Lionel Claude and Thierry, Coq}
}
@inproceedings {Simula.simula.1562,
	title = {Towards a Model-Based Evolutionary Chain of Evidence for Compliance With Safety Standards},
	journal = {Computer Safety, Reliability, and Security SAFECOMP 2012 Workshops: Sassur. Proceedings},
	year = {2012},
	publisher = {Springer Berlin / Heidelberg},
	type = {Workshop},
	abstract = {Compliance with safety standards can greatly increase the development cost and time of critical systems. Major problems arise when evolutions to a system entail reconstruction of the body of safety evidence. When changes occur in the development or certification processes, identification of the new evidence to provide, the evidence that is no longer adequate, or the evidence that can be reused poses some challenges. Therefore, practitioners need support to identify how a chain of evidence evolves as a result of the changes. Otherwise, execution of the above activities can be very costly, and it can even result in abandonment of certification efforts. This paper outlines a solution to deal with these challenges. The solution is based on the use of model-driven engineering technology, which has already been applied for safety certification but not from an evolutionary chain of evidence-based perspective. The paper also sets the background for developing the solution, describes real situations in which the solution can help industry, and discusses possible challenges for developing it. The solution will be developed as part of OPENCOSS, a research project on cross-domain evolutionary certification.},
	author = {Jose Luis {de la Vara} and Nair, Sunil and Verhulst, Eric and Studzizba, Janusz and Pepek, Piotr and Lambourg, Jerome and Sabetzadeh, Mehrdad},
	editor = {Peter Daniel Fra {Ortmeier}}
}
@inproceedings {EmpiRE2012,
	title = {Towards Customer-Based Requirements Engineering Practices},
	journal = {2012 IEEE Second International Workshop on Empirical Requirements Engineering (EmpiRE)},
	year = {2012},
	publisher = {IEEE},
	type = {Workshop},
	abstract = {Factors related to the requirements engineering process and customers have been repeatedly reported among those that most strongly influence the success of a software project. However, requirements engineering research has so far barely studied practice from a customer-based perspective. Furthermore, rigorous evidence about customers\&$\#$39; perspectives regarding requirements engineering approaches is scarce, and links between customer-based requirements engineering research and the industrial practices are necessary. This paper argues that new research is necessary to tackle the above weaknesses. Our position is that: requirements specification approaches must be validated from a customer-based perspective; the influence of customers\&$\#$39; characteristics on the requirements engineering process must be studied in more depth; and potential customer-based improvements in practice must be assessed. We also present situations in which the results from these activities would help practitioners, propose a research agenda to execute these activities, and discuss challenges that might hinder their execution.},
	author = {Jose Luis {de la Vara} and Hoyos, Luis and Collado, Enrique and Sabetzadeh, Mehrdad},
	editor = {Daneva, M. and Damian, D. and Dieste, O. and Marchetto, A. and Pastor, O.}
}
@inproceedings {Simula.simula.1098,
	title = {Challenges for an Open and Evolutionary Approach to Safety Assurance and Certification of Safety-Critical Systems},
	journal = {1st International Workshop on Software Certification (WoSoCER{\textquoteright}11)},
	year = {2011},
	publisher = {IEEE},
	type = {Workshop},
	abstract = {Safety assurance and certification are amongst the most expensive and time-consuming tasks in the development of safety-critical embedded systems. The increasing complexity and size of this kind of systems combined with the growing market demand requires the industry to implement a coherent reuse strategy. A major problem arises as typically a safetycritical product and accompanying safety evidence is monolithic, based on the whole product, and evolutions to the product become costly and time consuming because they entail regenerating the entire evidence-set. Another key difficulty appears when trying to reuse products from one application domain in another, because they are constrained by different standards and the full safety assurance certification process is applied as for a new product, thus reducing the return on investment of such reuse decision.},
	isbn = {DOI:10.1109/WoSoCER.2011.15},
	author = {Espinoza, Huascar and Ruiz, Alejandra and Sabetzadeh, Mehrdad and Panoroni, Paolo},
	editor = {Pietrantuono, R. and Silva, N.}
}
@inproceedings {19466,
	title = {Combining Goal Models, Expert Elicitation, and Probabilistic Simulation for Qualification of New Technology},
	journal = {The 13th IEEE International High Assurance Systems Engineering Symposium (HASE 2011)},
	year = {2011},
	type = {Conference},
	abstract = {New technologies typically involve innovative aspects that are not addressed by the existing normative standards and hence are not assessable through common certification procedures. To ensure that new technologies can be implemented in a safe and reliable manner, a specific kind of assessment is performed, which in many industries, e.g., the energy sector, is known as Technology Qualification (TQ). TQ aims at demonstrating with an acceptable level of confidence that a new technology will function within specified limits. Expert opinion plays an important role in TQ, both to identify the safety and reliability evidence that needs to be developed, and to interpret the evidence provided. Hence, it is crucial to apply a systematic process for eliciting expert opinions, and to use the opinions for measuring the satisfaction of a technology\&$\#$39;s safety and reliability objectives. In this paper, drawing on the concept of assurance cases, we propose a goal-based approach for TQ. The approach, which is supported by a software tool, enables analysts to quantitatively reason about the satisfaction of a technology\&$\#$39;s overall goals and further to identify the aspects that must be improved to increase goal satisfaction. The three main components enabling quantitative assessment are goal models, expert elicitation, and probabilistic simulation. We report on an industrial pilot study where we apply our approach for assessing a new offshore technology.},
	doi = {10.1109/HASE.2011.22},
	author = {Sabetzadeh, Mehrdad and Falessi, Davide and Briand, Lionel and Di Alesio, Stefano and McGeorge, Dag and {\r A}hjem, Vidar and Borg, Jonas}
}
@techreport {25316,
	title = {Combining Goal Models, Expert Elicitation, and Probabilistic Simulation for Qualification of New Technology},
	number = {2011-09},
	year = {2011},
	note = {This technical report is an early version of a published conference paper. The published paper can be found here:https://www.simula.no/publications/combining-goal-models-expert-elicitation-and-probabilistic-simulation-qualification-new},
	publisher = {Simula Research Laboratory},
	author = {Sabetzadeh, Mehrdad and Falessi, Davide and Lionel C. {Briand} and McGeorge, Dag and {\r A}hjem, Vidar and Borg, Jonas}
}
@inproceedings {Simula.simula.1120,
	title = {CRESCO: Construction of Evidence Repositories for Managing Standards Compliance},
	journal = {30th ACM International Conference on Conceptual Modeling (ER2011)},
	year = {2011},
	publisher = {Springer},
	type = {Conference},
	address = {Berlin Heidelberg},
	abstract = {We describe CRESCO, a tool for Construction of Evidence REpositories for Managing Standards COmpliance. CRESCO draws on Model Driven Engineering (MDE) technologies to generate a database repository schema from the evidence requirements of a given standard, expressed as a UML class diagram. CRESCO in addition generates a web-based user interface for building and manipulating evidence repositories based on the schema. CRESCO is targeted primarily at addressing the tool infrastructure needs for supporting the collection and management of safety evidence data. A systematic treatment of evidence information is a key prerequisite for demonstration of compliance to safety standards, such as IEC 61508, during the safety certification process.},
	isbn = {978-3-642-24574-9},
	author = {Rajwinder Kaur {Panesar-Walawege} and Torbj{\o}rn Skyberg {Knutsen} and Sabetzadeh, Mehrdad and Briand, Lionel Claude}
}
@techreport {25313,
	title = {A Model-Driven Engineering Approach to Support the Verification of Compliance to Safety Standards},
	number = {2011-15},
	year = {2011},
	note = {This technical report is an early version of a published conference paper. The published version can be found here:https://www.simula.no/publications/model-driven-engineering-approach-support-verification-compliance-safety-standards},
	publisher = {Simula Research Laboratory},
	author = {Rajwinder Kaur {Panesar-Walawege} and Sabetzadeh, Mehrdad and Lionel C. {Briand}}
}
@inproceedings {Simula.simula.716,
	title = {A Model-Driven Engineering Approach to Support the Verification of Compliance to Safety Standards},
	journal = {22th IEEE International Symposium on Software Reliability Engineering (ISSRE 2011)},
	year = {2011},
	pages = {30-39},
	publisher = {IEEE},
	type = {Conference},
	abstract = {Certification of safety-critical systems according to well-recognised standards is the norm in many industries where the failure of such systems can harm people or the environment. Certification bodies examine such systems, based on evidence that the system suppliers provide, to ensure that the relevant safety risks have been sufficiently mitigated. The evidence is aimed at satisfying the requirements of the standards used for certification, and naturally a key prerequisite for effective collection of evidence, is that the supplier be aware of these requirements and the evidence they require. This often proves to be a very challenging task because of the sheer size of the standards and the fact that the textual standards are amenable to subjective interpretation. In this paper, we propose an approach based on UML profiles and model-driven engineering. It addresses not only the above challenge but also enables the automated verification of compliance to standards based on evidence. Specifically, a profile is created, based on a conceptual model of a given standard, which provides a succinct and explicit interpretation of the underlying standard. The profile is augmented with constraints that help system suppliers with establishing a relationship between the concepts in the safety standard of interest and the concepts in the application domain. This in turn enables suppliers to demonstrate how their system development artifacts achieve compliance to the standard. We illustrate our approach by showing how the concepts in the domain of sub-sea control systems can be aligned with the evidence requirements in the IEC61508 standard, which is one of the most commonly used certification standard for control systems.},
	isbn = {978-0-7695-4568-4},
	author = {Rajwinder Kaur {Panesar-Walawege} and Sabetzadeh, Mehrdad and Briand, Lionel},
	editor = {IEEE, }
}
@article {Simula.simula.182,
	title = {Planning for Safety Evidence Collection: a Tool-Supported Approach Based on Modeling of Standards Compliance Information},
	journal = {IEEE Software},
	volume = {pp},
	number = {99},
	year = {2011},
	publisher = {IEEE},
	abstract = {Safety-critical software-dependent systems such as those found in the avionics, automotive, maritime, and energy domains often need to be certified by a licensing or regulatory body based on one or more safety standards. Safety standards often do not specify the details of the evidence that needs to be collected for the certification of a particular system because these standards need to remain generic and applicable to a wide variety of systems and domains. Without an upfront agreement between the system supplier and the certifier about the details of the evidence that needs to be collected, there will invariably be important omissions in the evidence information provided by the supplier, which need to be remedied after the fact and at significant costs. In this paper, we present a flexible and tool-supported approach for assisting suppliers and certifiers in developing an agreement about the evidence necessary to demonstrate compliance to a safety standard. Our approach is model-based; specifically, the safety standard of interest is expressed via an information model. This helps manage the complexity of safety standards, provides precise interpretation for the standards, and ensures the completeness and consistency of the generated agreement.},
	author = {Falessi, Davide and Sabetzadeh, Mehrdad and Briand, Lionel Claude and Turella, Emanuele and Coq, Thierry and Rajwinder Kaur {Panesar-Walawege}}
}
@techreport {Simula.simula.820,
	title = {Research-Based Innovation: a Tale of Three Projects in Model-Driven Engineering},
	number = {2011-18},
	year = {2011},
	month = {October},
	publisher = {Simula Research Laboratory},
	abstract = {Engineering research needs to be informed by (or based on) industrial needs to have impact, and industrial innovation depends on research to fill the gaps in knowledge and to pave the way for better tools, technologies, and services. In the past few years, we have been exploring ways to foster a closer collaboration between research and industry both to align our research with practical needs, and to further increase awareness about the important role that software engineering research plays as an enabler for innovation. This paper outlines our experiences with three recent and successful research projects conducted in collaboration with the maritime and energy industry. We take a retrospective approach to examine the way we collaborated with our industry partners and elaborate the decisions that we believe contributed to the effectiveness of the collaborations. We report the lessons learned from our experience and illustrate these lessons using examples from the three projects. The lessons focus on the applications of Model-Driven Engineering (MDE), as all the three projects we draw on here were MDE projects. Our goal from structuring and sharing our experience is to contribute to a better understanding of how researchers and practitioners can collaborate more effectively and to gain more value from their collaborations.},
	author = {Briand, Lionel and Falessi, Davide and Nejati, Shiva and Sabetzadeh, Mehrdad and Yue, Tao}
}
@inproceedings {Simula.simula.970,
	title = {SafeSlice: a Model Slicing and Design Safety Inspection Tool for SysML.},
	journal = {SIGSOFT/FSE{\textquoteright}11 19th ACM SIGSOFT Symposium on the Foundations of Software Engineering (FSE-19) and ESEC{\textquoteright}11: 13rd European Software Engineering Conference (ESEC-13)},
	year = {2011},
	publisher = {ACM},
	type = {Conference},
	abstract = {Software safety certification involves checking that the software design meets the (software) safety requirements. In practice, inspections are one of the primary vehicles for ensuring that safety requirements are satisfied by the design. Unless the safety-related aspects of the design are clearly delineated, the inspections conducted by safety assessors would have to consider the entire design, although only small fragments of the design may be related to safety. In a model-driven development context, this means that the assessors have to browse through large models, understand them, and identify the safety-related fragments. This is time-consuming and error-prone, specially noting that the assessors are often third party regulatory bodies who were not involved in the design. To address this problem, we describe in this paper a prototype tool called, SafeSlice, that enables one to automatically extract the safety-related slices (fragments) of design models. The main enabler for our slicing technique is the traceability between the safety requirements and the design, established by following a structured design methodology that we propose. Our work is grounded on SysML, which is being increasingly used for expressing the design of safety-critical systems. We have validated our work through two case studies and a control experiment which we briefly outline in the paper.},
	isbn = {978-1-4503-0443-6},
	author = {Falessi, Davide and Nejati, Shiva and Sabetzadeh, Mehrdad and Briand, Lionel and Messina, Antonio},
	editor = {Andreas Zeller Tib {Gyim{\'o}thy}}
}
@techreport {Simula.simula.193,
	title = {A SysML-Based Approach to Traceability Management and Design Slicing in Support of Safety Certification: Framework, Tool Support, and Case Studies},
	number = {2011-01},
	year = {2011},
	month = {January},
	publisher = {Simula Research Laboratory},
	abstract = {Context: Traceability is one of the basic tenets of all software safety standards and a key prerequisite for certification of software. Despite this, the safety-critical software industry is still suffering from a chronic lack of guidelines on traceability. An acute traceability problem that we have identified through observing software safety certification processes has to do with the link between safety requirements and software design. In the current state of practice, this link often lacks sufficient detail to support the systematic inspections conducted by the certifiers of the software safety documentation. As a result, the suppliers often have to remedy the traceability gaps after the fact which can be very expensive and the outcome often is far from satisfactory. Objective: The objective of this article is developing a framework to enable systematic and efficient software design inspections during safety certification. In particular, the framework enables safety engineers and certifiers to extract design slices (model fragments) that filter out irrelevant details but keep enough context information for the slices to be easy to inspect and understand. This helps reduce cognitive load and thus makes it less likely that serious safety issues would be overlooked. Method: Our framework is grounded on SysML which is rapidly becoming the notation of choice for developing safety-critical systems. The framework includes a traceability information model, a methodology to establish traceability, and mechanisms to use traceability for extracting slices of models relevant to a particular safety requirement. The framework is implemented in a tool, named SafeSlice, that supports establishing the traceability links envisaged by the methodology, automated consistency checking of these links, and automated generation of SysML design slices. Results: We provide a formal proof that our slicing algorithm is sound for temporal safety properties, and argue about the completeness of the slices based on our practical experience. We report on the lessons learned from applying our approach to two case studies, one benchmark case and one industrial case. Both case studies indicate that our approach offers benefits by substantially reducing the amount of information that needs to be inspected in order to ensure that a given safety requirement is met by the design.},
	author = {Nejati, Shiva and Sabetzadeh, Mehrdad and Falessi, Davide and Briand, Lionel Claude and Coq, Thierry}
}
@inproceedings {Simula.simula.1132,
	title = {Using Model-Driven Engineering for Managing Safety Evidence: Challenges, Vision and Experience},
	journal = {The 1st Intentional Workshop on Software Certification (WoSoCER) at 22th IEEE International Symposium on Software Reliability Engineering.},
	year = {2011},
	publisher = {Springer},
	type = {Workshop},
	abstract = {Certification is a major prerequisite for most safety-critical systems before they can be put into operation. During certification, system suppliers often have to present a coherent body of evidence demonstrating that the developed systems are safe for operation. Regardless of the certification approach taken (process-based or product-based), collection of proper evidence at the proper stage of development is critical for successful certification. Currently, system suppliers and certification bodies alike are facing various challenges in relation to safety evidence collection. Notably, they find it hard to interpret the evidence requirements imposed by the safety standards within the domain of application; little support exists for recording, querying, and reporting evidence in a structured manner; and there is a general absence of guidelines on how the collected evidence supports the safety objectives. This paper states our position on how safety evidence should be characterized and managed. Specifically, we propose the application of Model-Driven Engineering as an enabler for performing the various tasks related to safety evidence management. We outline our current work on the specification of safety evidence requirements, upfront planning of evidence collection activities, tailoring of evidence information to domain-specific needs, and storage of evidence information. Based on this work, we identify a number of challenges that need further investigation and provide a future research agenda for managing safety evidence for software safety certification.},
	isbn = {978-0-7695-4568-4},
	author = {Rajwinder Kaur {Panesar-Walawege} and Sabetzadeh, Mehrdad and Briand, Lionel}
}
@inproceedings {Simula.simula.804,
	title = {Using SysML for Modeling of Safety-Critical Software-Hardware Interfaces: Guidelines and Industry Experience},
	journal = {13th IEEE International High Assurance Systems Engineering Symposium (HASE{\textquoteright}11)},
	year = {2011},
	publisher = {IEEE},
	type = {Conference},
	address = {Boca Raton, FL},
	abstract = {Safety-critical embedded systems often need to undergo a rigorous certification process to ensure that the safety risks associated with the use of the systems are adequately mitigated. Interfaces between software and hardware components (SW/HW interfaces) play a fundamental role in these systems by linking the systems{\textquoteright} control software to either the physical hardware components or to a hardware abstraction layer. Subsequently, safety certification of embedded systems necessarily has to cover the SW/HW interfaces used in these systems. In this paper, we describe a Model Driven Engineering (MDE) approach based on the SysML language, targeted at facilitating the certification of SW/HW interfaces in embedded systems. Our work draws on our experience with maritime and energy systems, but the work should also apply to a broader set of domains, e.g., the automotive sector, where similar design principles are used for (SW/HW) interface design. Our approach leverages our previous work on the development of SysML-based modeling and analysis techniques for safety-critical systems. Specifically, we tailor the methodology developed in our previous work to the development of safety-critical interfaces, and provide step-by-step and practical guidelines aimed at providing the evidence necessary for arguing that the safety-related requirements of an interface are properly addressed by its design. We describe an application of our proposed guidelines to a representative safety-critical interface in the maritime and energy domain.},
	author = {Sabetzadeh, Mehrdad and Nejati, Shiva and Briand, Lionel Claude and Anne-Heidi Evensen {Mills}}
}
@techreport {Simula.simula.600,
	title = {Using UML Profiles for Sector-Specific Tailoring of Safety Evidence Information},
	number = {2011-10},
	year = {2011},
	month = {April},
	publisher = {Simula Research Laboratory},
	address = {P.O.Box 134, 1325 Lysaker, Norway},
	abstract = {Safety-critical systems are often subject to certification as a way to ensure that the safety risks associated with their use are sufficiently mitigated. A key requirement of certification is the provision of evidence that a system complies with the applicable standards. The way this is typically organized is to have a generic standard that sets forth the general evidence requirements across different industry sectors, and then to have a derived standard that specializes the generic standard according to the needs of a specific industry sector. To demonstrate standards compliance, one therefore needs to precisely specify how the evidence requirements of a sector-specific standard map onto those of the generic parent standard. Unfortunately, little research has been done to date on capturing the relationship between generic and sector-specific standards and a large fraction of the issues arising during certification can be traced to poorly-stated or implicit relationships between a generic standard and its sector-specific interpretation. In this paper, we propose an approach based on UML profiles to systematically capture how the evidence requirements of a generic standard are specialized in a particular domain. To demonstrate our approach, we apply it for tailoring IEC61508 - one of the most established standards for functional safety - to the Petroleum industry.},
	author = {Rajwinder Kaur {Panesar-Walawege} and Sabetzadeh, Mehrdad and Briand, Lionel}
}
@inproceedings {Simula.simula.666,
	title = {Using UML Profiles for Sector-Specific Tailoring of Safety Evidence Information},
	journal = {30th ACM International Conference on Conceptual Modeling (ER)},
	volume = {6998/2011},
	year = {2011},
	pages = {362-378},
	publisher = {ACM},
	type = {Conference},
	abstract = {Safety-critical systems are often subject to certification as a way to ensure that the safety risks associated with their use are sufficiently mitigated. A key requirement of certification is the provision of evidence that a system complies with the applicable standards. The way this is typically organized is to have a generic standard that sets forth the general evidence requirements across different industry sectors, and then to have a derived standard that specializes the generic standard according to the needs of a specific industry sector. To demonstrate standards compliance, one therefore needs to precisely specify how the evidence requirements of a sector-specific standard map onto those of the generic parent standard. Unfortunately, little research has been done to date on capturing the relationship between generic and sector-specific standards and a large fraction of the issues arising during certification can be traced to poorly-stated or implicit relationships between a generic standard and its sector-specific interpretation. In this paper, we propose an approach based on UML profiles to systematically capture how the evidence requirements of a generic standard are specialized in a particular domain. To demonstrate our approach, we apply it for tailoring IEC61508 - one of the most established standards for functional safety - to the Petroleum industry},
	isbn = {978-3-642-24605-0},
	author = {Rajwinder Kaur {Panesar-Walawege} and Sabetzadeh, Mehrdad and Briand, Lionel}
}
@inproceedings {Simula.se.687,
	title = {Characterizing the Chain of Evidence for Software Safety Cases: a Conceptual Model Based on the IEC 61508 Standard},
	journal = {Third IEEE International Conference on Software Testing, Verification and Validation (ICST)},
	year = {2010},
	publisher = {IEEE Computer Society},
	type = {Conference},
	abstract = {Increasingly, licensing and safety regulatory bodies require the suppliers of software-intensive, safety-critical systems to provide an explicit software safety case - a structured set of arguments based on objective evidence to demonstrate that the software elements of a system are acceptably safe. Existing research on safety cases has mainly focused on how to build the arguments in a safety case based on available evidence; but little has been done to precisely characterize what this evidence should be. As a result, system suppliers are left with practically no guidance on what evidence to collect during software development. This has led to the suppliers having to recover the relevant evidence after the fact - an extremely costly and sometimes impractical task. Although standards such as the IEC 61508 - which is widely viewed as the best available generic standard for managing functional safety in software - provide some guidance for the collection of relevant safety and certification information, this guidance is mostly textual, not expressed in a precise and structured form, and is not easy to specialize to context-specific needs. To address these issues, we present a conceptual model to characterize the evidence for arguing about software safety. Our model captures both the information requirements for demonstrating compliance with IEC 61508 and the traceability links necessary to create a seamless chain of evidence. We further describe how our generic model can be specialized according to the needs of a particular context, and discuss some important ways in which our model can facilitate software certification.},
	isbn = {978-0-7695-3990-4},
	author = {Rajwinder Kaur {Panesar-Walawege} and Briand, Lionel and Sabetzadeh, Mehrdad and Coq, Thierry},
	editor = {Gaudel, Marie-Claude and Ana Rosa {Cavalli} and Ghosh, Sudipto}
}
@inproceedings {Simula.approve.58,
	title = {Reasoning About Consistency in Model Merging},
	journal = {3rd Workshop on Living With Inconsistency in Software Development},
	year = {2010},
	publisher = {CEUR Workshop Proceedings},
	type = {Workshop},
	abstract = {Models undergo a variety of transformations throughout development. One of the key transformations is merge, used when developers need to combine a set of models with respect to the overlaps between them. A major question about model transformations in general, and merge in particular, is what consistency properties are preserved across the transformations and what consistency properties may need to be re-checked (and if necessary, re-established) over the result. In previous work, we developed a technique based on category-theoretic colimits for merging sets of inter-related models. The use of category theory leads to the preservation of the algebraic structure of the source models in the merge; however, this does not directly provide a characterization of the (in)consistency properties that carry over from the source models to the result, because consistency properties are predominantly expressed as logical formulas. Hence, an investigation of the connections between the {\textquoteleft}{\textquoteleft}algebraic{\textquoteright}{\textquoteright} and {\textquoteleft}{\textquoteleft}logical{\textquoteright}{\textquoteright} properties of model merging became necessary. In this paper, we undertake such an investigation and use techniques from finite model theory to show that the use of colimits indeed leads to the preservation of certain logical properties. Our results have implications beyond our merge framework in and are potentially useful for the broad range of techniques in the graph transformation and algebraic specification literature that use colimits as the basis for model manipulations.},
	isbn = {urn:nbn:de:0074-661-4},
	author = {Sabetzadeh, Mehrdad and Nejati, Shiva and Chechik, Marsha and Easterbrook, Steve},
	editor = {Egyed, A. and Lopez-Herrejon, R. and Nuseibeh, B. and Botterweck, G. and Chechik, M. and Hu, Z.}
}
@inbook {Simula.SE.685,
	title = {Viewpoints},
	booktitle = {Encyclopedia of Software Engineering},
	volume = {2},
	year = {2010},
	pages = {1318-1329},
	publisher = {Auerbach Publications},
	organization = {Auerbach Publications},
	chapter = {54},
	abstract = {The construction of any sizable software system involves many agents, each with their own perspective of the system being built. Viewpoints provide a framework for guiding and managing development in a multiple-perspective setting, where a variety of agents with different areas of concern collaborate towards building a system. In this article, we explain the main concepts and techniques underlying viewpoint-based development and illustrate them using a number of examples.},
	isbn = {1420059777},
	author = {Sabetzadeh, Mehrdad and Finkelstein, Anthony and Goedicke, Michael},
	editor = {Phillip A. {Laplante}}
}
@inproceedings {19096,
	title = {A Manifesto for Model Merging},
	journal = {1st International Workshop on Global Integrated Model Management (GaMMa{\textquoteright}06) at the 28th International Conference on Software Engineering},
	year = {2006},
	publisher = {IEEE},
	address = {unknown},
	abstract = {If a modeling task is distributed, it will frequently be neces- sary to merge models developed by di erent team members. Existing approaches to model merging make assumptions about the types of model to be merged, and the nature of the relationship between them. This makes it hard to compare approaches. In this paper, we present a manifesto for re- search on model merging. We propose a framework for com- paring di erent approaches to merging, by treating merge as an algebraic operator over models and model relationships. We specify the algebraic properties of an idealized merge operator, as well as related operators such as match, di , split, and slice. We then show how our framework can be used to compare existing approaches by applying it to two of our own research projects on model merging. We show how this analysis permits a detailed comparison of approaches, reveals the key features of each, and identi es weaknesses that require further research. Most importantly, the frame- work emphasizes the need to make explicit all assumptions about the relationships between models, and indeed to treat model relationships as rst class objects.},
	author = {Brunet, Greg and Chechik, Marcha and Easterbrook, Steve and Nejati, Shiva and Niu, Nan and Sabetzadeh, Mehrdad}
}
@article {Simula.simula.466,
	title = {View Merging in the Presence of Incompleteness and Inconsistency},
	journal = {Requirements Engineering},
	volume = {11},
	number = {3},
	year = {2006},
	pages = {174-193},
	abstract = {View merging, also called view integration, is a key problem in conceptual modeling. Large models are often constructed and accessed by manipulating individual views, but it is important to be able to consolidate a set of views to gain a unified perspective, to understand interactions between views, or to perform various types of analysis. View merging is complicated by incompleteness and inconsistency: Stakeholders often have varying degrees of confidence about their statements. Their views capture different but overlapping aspects of a problem, and may have discrepancies over the terminology being used, the concepts being modeled, or how these concepts should be structured. Once views are merged, it is important to be able to trace the elements of the merged view back to their sources and to the merge assumptions related to them. In this paper, we present a framework for merging incomplete and inconsistent graph-based views. We introduce a formalism, called annotated graphs, with a built-in annotation scheme for modeling incompleteness and inconsistency. We show how structure-preserving maps can be employed to express the relationships between disparate views modeled as annotated graphs, and provide a general algorithm for merging views with arbitrary interconnections. We provide a systematic way to generate and represent the traceability information required for tracing the merged view elements back to their sources, and to the merge assumptions giving rise to the elements.},
	author = {Sabetzadeh, Mehrdad and Easterbrook, Steve}
}
