Download SafEty and Risk Evaluation using bayesian NEts

SERENE Method Manual
Version 1.0 (F) May 1999
4 Examples of using the SERENE Method to Construct Safety
Arguments
The purpose of this chapter is to provide examples of templates derived from various different
arguments, and from various different perspectives. The templates are described in terms of the
idioms of which they are comprised, with descriptions and diagrams to show how they are joined.
Various different execution scenarios are worked through to illustrate their use.
The arguments covered are:
4.1
•
Defect density
•
Reliability
•
Safety risk
The Defect-Density Argument
The goal of this argument is to predict the defect density of a piece of software. Defect density is
defined as the number of residual defects divided by the estimated size of the design. For example, a
typical defect density may be expressed as defects per KLOC (Kilo lines of code) or per FP (Function
Point).
4.1.1 Defect Density: Idiom Instances
The definition of defect density suggests the use of a definitional/synthesis idiom. Idiom instance (A)
in Figure 4-1 shows the use of this idiom to model defect density. Next we might wish to model the
process by which defects are introduced, fixed and removed. Idiom instance (B) shows another
instance of the definitional/synthesis idiom where output defects are defined as the difference between
input defects and those defects fixed during the process. The number of defects left in the software
after a number of process stages will simply be the number of defects introduced accidentally minus
the number detected and fixed (assuming a perfect fixing process).
The number of detected defects will depend on how much effort is made to find them during each
testing phase and how many defects are indeed there to be discovered. Idiom instance (C) shows how
the discovery of defects is limited by the number of input defects and testing quality.
SERENE 22187 ESPRIT Framework IV Information Technology Programme Task 1.7
Page 59 of 200