Safety Argument Categories

• Safety Argument Categories are defined classes of claims, strategies, and evidence structures used to justify low risk in engineered systems.
• They employ modular patterns such as Goal Structuring Notation and CAE templates to trace hazards, processes, standards, and ethical trade-offs.
• These categories enable systematic safety case audits and reuse across domains, integrating evidence from FTA, FMEA, STPA, and other analyses.

A safety argument category is a formally identifiable class of claims, strategies, and supporting evidence structures by which one justifies the acceptably low risk of hazardous outcomes in engineered systems, particularly those demanding rigorous assurance such as autonomous vehicles, advanced AI, and safety-critical infrastructure. Safety argument categories provide the means to decompose, organize, and audit safety cases in a manner that is traceable with respect to hazards, processes, standards, stakeholder acceptances, uncertainty quantification, and ethical trade-offs. These categories are instantiated in modular patterns across multiple assurance frameworks, including Product, Process, Compliance, Confidence, Hazard Analysis–based, Balanced, Integrated, Grounded, and AI-specific assurance arguments.

1. Principal Taxonomies of Safety Argument Categories

Over the past decade, a consensus has emerged around several high-level taxonomies, primarily originating from pattern catalogues and safety assurance surveys for embedded, cyber-physical, and learning-enabled systems (Gleirscher et al., 2019, Gleirscher et al., 2017, Habli et al., 12 Mar 2025, Clymer et al., 2024, Loba et al., 6 May 2025, Wagner et al., 2024, Cieslik et al., 2023, Bloomfield et al., 2021, Burton, 2022). The four archetypal categories, as synthesized from Luo et al.’s pattern analysis and subsequent works, are:

• Product-Based Argument Patterns: Claim that the delivered product (hardware, software, run-time behaviour) satisfies specified safety requirements as demonstrated by evidential artifacts such as tests, verification, and structured analysis.
• Process-Based Argument Patterns: Argue that the product was developed and validated under correct, auditable processes, reducing systematic faults.
• Compliance Argument Patterns: Establish that the system and its processes are conformant to external standards or regulatory requirements, mapping evidence to mandated specifications.
• Confidence Argument Patterns: Meta-arguments over all other categories, quantifying completeness, fallacy-avoidance, uncertainty, and residual risk using techniques analogous to assurance claim points and argument deficiency identification.

Extensions for frontier AI systems include Balanced, Integrated, and Grounded arguments (Habli et al., 12 Mar 2025), as well as Inability, Control, Trustworthiness, and Deference arguments (Clymer et al., 2024).

Category	Argument Focus	Example Evidence Types
Product-Based	System design/implementation	FTA/FMEA, tests, proofs
Process-Based	Development process	Review logs, audits
Compliance	Standards/regulation adherence	Compliance matrices, certs
Confidence	Argument soundness/uncertainty	Peer reviews, belief metrics

2. Modular Argument Structures and Formalization

Each category admits modular instantiation in Goal Structuring Notation (GSN), Claims-Argument-Evidence (CAE), or equivalent patterns. Product-based safety arguments structure top-level claims (system meets Spec) into contract verification, decomposition into subsystems/components, and hazard elimination via FTA/FMEA/STPA (Gleirscher et al., 2019, Gleirscher et al., 2017).

For example, fault-tree-based safety arguments employ a risk-level classifier map:

$\mathrm{RL}: [0,1] \times [a, b] \to \mathbb{N}$

mapping probability and severity to ordinal risk levels, with sub-arguments showing that post-mitigation probabilities fall below acceptable thresholds.

Process-based arguments decompose assurances over requirements, design, verification, and validation into verifiable activities logged in audits. Compliance arguments use standards-driven mappings—e.g., IEC 61508 clause matrices, ISO 26262 traceability—to show that each mandated requirement is met by the system’s product and process arguments.

Confidence argument patterns meta-analyze the sufficiency and robustness of product, process, and compliance claims, with explicit sub-cases for completeness (“all GSN edges validated”), assumption listing, and evidence quantification (see belief-measure templates from [Luo et al. 2017 in (Gleirscher et al., 2019)]).

Hazard-analysis-based argumentation (Gleirscher et al., 2017) instantiates all four categories in three reusable modules: Mitigation, Causal Reasoning, and Hazard Countermeasures, integrating FTA, FMEA, and STPA results. Each hazard triggers requirement derivation, design revision, and verification, enabling full traceability.

3. Extensions for AI and Autonomous Systems

AI-specific frameworks introduce additional argument categories to address non-traditional hazards, ethical dimensions, and sociotechnical complexities:

• BIG Argument Patterns: As defined in (Habli et al., 12 Mar 2025), comprise Balanced (ethical trade-offs across safety, equity, privacy), Integrated (traceability across technical and social modules), and Grounded (anchoring claims in established safety norms).
• AI Safety Case Arguments: (Clymer et al., 2024) structure cases via Inability, Control, Trustworthiness, and Deference arguments; these address scenarios where incapability, procedural controls, inherent trustworthy behavior, or deferral to expert AI advisors form the basis for catastrophic-risk negation.

Best-practice guidance emphasizes modular pattern selection, compositional traceability, living safety cases, explicit trade-offs, quantitative risk/probabilistic risk assessment (with formulas for conjunctive and disjunctive probability joins), and stakeholder-accepted proportionality.

4. Argument Categories in Automated Vehicle and Autonomy Frameworks

Automated vehicles and autonomy safety-case frameworks instantiate these categories explicitly as “topic complexes” (Loba et al., 6 May 2025, Wagner et al., 2024, Cieslik et al., 2023):

• Developed Product: Product-based; verified system residual risk (global and scenario-based).
• Underlying Process: Process-based; safety culture, system engineering process, conformance, and compliance.
• Argumentation Context: Contextualization; definitions, ODD, assumptions.
• Soundness: Confidence; completeness, independent review, uncertainty quantification.

Open Autonomy Safety Case Framework (OASCF) (Wagner et al., 2024) utilizes three pillars: Live It Right (“organization trustworthiness”), Engineer It Right (“hazard/risk mitigation”), and Operate It Right (“continuous monitoring and unknown-unknown risk detection”), united under the Positive Trust Balance (PTB) top-level argument.

5. Pattern Reuse, Interaction, and Addressing Assurance Challenges

Safety argument categories are reusable across projects, life-cycles, and domains. Product and Process arguments support systematic claim decomposition, supporting readability and modular auditability (Gleirscher et al., 2019). Generic templates (GSN modules, contract patterns) promote argument reuse.

Pattern interactions are critical:

• Compliance builds on Product and Process patterns by mapping evidence to regulatory clauses.
• Confidence interrogates all other patterns for hidden assumptions, bias, or incompleteness.
• Hazard-analysis modular patterns are naturally compositional—with FTA/FMEA/STPA feeding into Product and Process arguments.

Security and safety are increasingly co-addressed by augmenting traditional patterns with STRIDE-style subclaims and counterexample-driven confidence subcases, especially for system-of-systems and open-context deployments (Gleirscher et al., 2019).

Safety case templates for autonomous systems (Bloomfield et al., 2021) formalize argument defeat patterns (systematic treatment of doubts/defeaters), evidence trustworthiness patterns, and continual adaptation/change management to preserve argument validity under evolution.

6. Evidence Categories and Causal Models in ML Safety Cases

In machine-learning-enabled system safety cases, evidence is structurally categorized per causal assurance frameworks (Burton, 2022):

• Category 1: Direct measurement of ML-system failure rates on representative test suites.
• Category 2: Model-level measurements of known insufficiency classes (robustness, calibration, error distribution).
• Category 3: Operation-time (diagnostic coverage) measures on runtime error detection and mitigation.
• Category 4: Design-time measures suppressing root causes (data diversity, architecture selection, ODD restriction).

These evidence categories fit within an iterative bow-tie assurance argument: design-time suppression, model-level error quantification, run-time interception, and final system-level failure validation.

7. Summary Table of Safety Argument Category Archetypes

Argument Category	Main Focus	Key Evidence
Product-Based	Built system functionality	FTA/FMEA, test logs
Process-Based	Development activities	Audits, design reviews
Compliance	Regulatory standards	Certification, checklists
Confidence	Argument completeness	Peer reviews, belief scores
Hazard Analysis	Hazard/control linkage	FTA/FMEA/STPA traceability
Balanced	Societal/ethical trade-off	Stakeholder analysis
Integrated	Technical–ethical coherence	Traceability matrices
Grounded	Traditional safety norms	Hazard requirements, risk
Inability	System incapability (AI)	Red-team, proxy tasks
Control	Environmental safegaurds	Monitoring, sandboxing
Trustworthiness	Property under capability	Red-teaming, audits
Deference	Expert AI judgment	Advisor calibration

Safety argument categories structurally underpin the assurance of complex, safety-critical systems, providing a formal mechanism for modular claim decomposition, evidence marshaling, and regulator–stakeholder communication. Pragmatically oriented pattern catalogs, causal evidence frameworks, and multi-modal assurance strategies enable the systematic construction, maintenance, and auditing of safety cases across rapidly evolving technical domains.