Criterion 2 Sample Clauses

Criterion 2. Percentage of unresolved safety and security related conflicts in relationship to overall safety and security related architecture in end product developed in the use cases (similar to metrics in existing standards that measure percentage of certain types of failures in overall product architectures).

Criterion 2. After combining all the individual results of the use cases the average requirement coverage is cal- culated as presented in Table 2-2 and Figure 2-2. The average percentage over all use cases is 28% while the SESAMO goal was defined by less than 10%. The table clearly shows one obvious weakness of the approach, which results from the small amount of conflicts and the representation of the individual results in percentages. Percentages don’t “scale”, especially in the downward direction. The Avionic use case has two unresolved con- flicts out of only three conflicts, which results in 67%. This value seems extremely high, but in real- ity it results only from two unresolved conflicts. Both conflicts base on a security requirement, that realisation reduce the system performance and violate the timing limits of the safety function. With further detailed WCET analysis it could be possible to optimize the system performance and resolve one unresolved conflict. This would mean a reduction of 33% of the individual Avionics result value. Obviously, the number of high-level requirements considered limits the number of potential conflicts. For most use cases, only a small number of conflicts were already visible from the top- level perspective. It is worth noting that for some use cases where the requirements were defined at a lower level, a significant number of conflicts could be identified. While both automotive E-Motor and Medical Use Case may seem unsuccessful at the first glance, the starting position needs to be kept in mind: For e.g. automotive available technologies have been fully exploited to meet safety goals, such as described in ISO 26262. Making the step from ‘safety only’ to ‘combined safety and security’ leads to situations where (new) security requirements vio- late (existing) safety features. On the other hand, a detailed description of unresolved conflicts will provide guidance for future development, especially by addressing such conflicts in early development phases. The target value of criterion 2 was not reached, but with further refinement of requirements and further analysis better result values can be reached.