Goal Structuring Notation and Reading a Safety Case Diagram

Understanding Goal Structuring Notation

Goal Structuring Notation provides a visual framework for breaking down complex safety objectives into manageable components. The notation uses a hierarchical structure where top-level goals decompose into sub-goals through various relationships. In AI safety contexts, this approach helps practitioners identify what needs to be demonstrated to prove a system operates safely.

ISO 15011-1 clause 5.2.1 defines goal structures as “a set of goals and their interrelationships that represent the objectives of an organisation or system”. The notation employs specific symbols to represent different types of relationships between goals. These include decomposition relationships that split high-level goals into smaller components, and supporting relationships that show how elements contribute to achieving objectives.

• Decomposition relationships use a diamond symbol to show how a parent goal breaks down into child goals
• Supporting relationships use a triangle symbol to indicate that one goal helps achieve another
• Assumption relationships show conditions that must hold true for goals to be valid

Components of Safety Case Diagrams

A safety case diagram represents the logical structure of arguments supporting claims about system safety. The diagram shows how various elements interconnect through goal structures, evidence, and assumptions. Practitioners must understand that these diagrams form the backbone of formal safety arguments rather than merely illustrating concepts.

Each safety case diagram contains several key elements that work together to build a complete argument. The central claim or safety argument sits at the top of the diagram. Below this, supporting goals form a hierarchy that leads towards evidence.

The diagram also includes assumptions that must be true for the argument to hold validity. These assumptions often represent conditions that cannot be directly tested but must be accepted as reasonable.

Consider a scenario where an AI system controls autonomous vehicle braking. The top-level safety goal might state that the vehicle must stop safely in emergency situations. This goal decomposes into sub-goals such as sensor reliability, decision-making accuracy, and actuator response time.

Each sub-goal then connects to evidence through supporting relationships, demonstrating how these components contribute to overall safety.

Reading and Interpreting Safety Case Diagrams

Reading a safety case diagram requires understanding the flow of logical relationships from top to bottom. Practitioners should start with the main safety claim and trace how supporting goals build towards evidence. The diagram reveals which elements are most critical to the overall argument and where gaps might exist in reasoning.

When examining diagrams, look for these structural elements:

• Clear identification of the primary safety claim or objective
• Logical decomposition of high-level goals into testable sub-goals
• Explicit linking of sub-goals to supporting evidence
• Identification of underlying assumptions that must be valid
• Recognition of any gaps or missing connections in the argument

In practice, safety case diagrams often reveal that practitioners have not yet identified all necessary evidence. For example, a diagram might show that while sensor accuracy is well-documented, there is no supporting evidence for how the system handles sensor failure scenarios. This insight helps focus efforts on gathering missing information rather than assuming completeness.

The notation also helps identify when arguments become too complex or when sub-goals do not properly support the main claim. Practitioners should verify that each relationship makes logical sense and that evidence truly supports the goals it claims to validate. This process of validation ensures that safety arguments remain focused and achievable rather than sprawling or disconnected.

Effective interpretation involves asking whether each component contributes meaningfully to proving the system safe enough. If a sub-goal does not clearly support the parent goal or lacks sufficient evidence, the diagram reveals these weaknesses. This makes Goal Structuring Notation particularly valuable for practitioners who must demonstrate safety claims to regulatory bodies or internal stakeholders.