Managing architectural design decisions for safety-critical software systems

In this paper, we propose a negative scenario framework along with a mitigation action model as the linkage between safety quality attribute and architecture definition. The scenario framework provides an effective means of formulating safety concerns. The mitigation action model facilitates exploitation and codification of existing safety-critical system design knowledge. Finally, we present a series of steps that enable the justification of architectural design decisions that refine both requirements and architectures. We demonstrate and discuss the application of our framework by means of a case study.