Assessing a Safety Case: Bottom-up Guidance for Claims and Evidence Evaluation

David Wichner; Francesca Favaro; Holland Broce; Justin Miranda; Laura Fraade-Blanar; Scott Schnelle

REVIEW 2 major objections 4 minor 15 references

Assessing a Safety Case: Bottom-up Guidance for Claims and Evidence Evaluation

T0 review · 2 major / 4 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Every claim in an ADS safety case gets two scores, one for documented process and one for proven practice, while each evidence item gets its own status score — making credibility assessment systematic.

desk verdict A genuinely useful operational rubric for auditing safety-case documentation, but the scoring omits the validity of the evidence itself, so it measures process maturity more than credibility. read the letter →

arxiv 2506.09929 v1 pith:7IOZORQM submitted 2025-06-11 cs.SE cs.CY

Scott Schnelle , Francesca Favaro , Laura Fraade-Blanar , David Wichner , Holland Broce , Justin Miranda This is my paper · ORCID

classification cs.SEcs.CY

keywords safetycaseclaimsevidenceautomateddrivingsystemsassurancecredibilityassessmentproceduralsupportimplementation

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper is trying to establish that the credibility of an automated driving system's safety case can be assessed from the bottom up: score how well each individual claim is supported by its evidence, and score each piece of evidence on its own. Existing standards and auditing frameworks require a safety case to present a structured argument backed by evidence, but they do not say how to judge whether each claim is actually supported. This paper supplies the missing operational step: every claim receives two separate scores from 0 to 3, one for procedural support and one for implementation support, and every evidence artifact receives its own status score for recency, ownership, and document control. The two claim scores together answer the question 'do we say what we do, and do we do what we say.' If the approach holds, safety-case review becomes a repeatable process whose results can drive internal improvement and inform regulatory assessment of an ADS safety case; the paper itself frames the method as a starting point rather than a complete solution.

What carries the argument

The load-bearing mechanism is the two-axis claim support score together with the independent evidence status score. Procedural support formalizes process specification, while implementation support demonstrates process application; separating the two makes visible the classic assurance gap between documented intent and demonstrated practice. The scoring guidance, adapted from maturity assessment models, disambiguates levels by coverage (which aspects of the claim the evidence addresses), relevance, and governance (level of oversight and alignment with company goals). Aggregation from child claims to a parent claim uses qualitative weighting by the assessor's judgement rather than strict averaging, because sub-claims do not all carry equal logical weight. The evidence status score is deliberately decoupled from claim scores, so a well-managed piece of evidence can still fail to support the claim it is attached to.

What would settle it

A controlled inter-rater reliability study would settle the matter: have two or more trained assessors independently score the same set of claims and evidence items using the provided tables, and measure their agreement, for instance with a kappa statistic. Systematic disagreement would show that the process does not yield repeatable scores. A complementary test would check whether the scores track independently audited safety deficiencies, so that cases judged weak by the rubric are the ones where real problems later surface.

Watch

Extended reading notes

Core claim

On the paper's own terms, the contribution is a method: the bottom-up portion of a Case Credibility Assessment can be operationalized as two independent scoring layers. The first layer scores each claim's support through the provided evidence, split into procedural support (how well the evidence articulates a process specification) and implementation support (how well the evidence demonstrates that the process was actually applied). The second layer scores every piece of evidence in the safety case library independently of any claim, judging documentation maturity by age, active status, ownership, review history, and controlled storage. Both layers use a 0 to 3 scale anchored on coverage, relevance, and governance, with detailed scoring tables as assessor guidance. The paper reports that this process was applied to an actual Level 4 ADS safety case by a separate team of safety experts, and positions the bottom-up scores as necessary but not sufficient for overall case credibility, with top-down argument completeness and robustness left out of scope.

Load-bearing premise

The rubrics in the scoring tables can be applied consistently enough across different assessors that the resulting scores are reliable and meaningful; the paper acknowledges that subjectivity is intrinsic to assessor judgement, provides no inter-rater reliability data or calibration examples, and leaves the weighting of child-claim scores toward parent scores to 'best judgement.'

Editorial extensions

If this is right

Safety-case review is turned from a holistic expert impression into discrete scoring acts that can be documented, re-run, and audited.
The procedural and implementation split makes a characteristic failure mode visible: a process that is thoroughly documented but never demonstrably applied will score high on the first axis and low on the second.
Evidence hygiene becomes trackable across the whole safety case library, so stale, ownerless, or uncontrolled evidence is flagged even where the claims still appear supported.
Low scores on particular claims or branches give a developer a prioritized, concrete agenda for improving both the safety case and the underlying engineering workstreams.
The same assessment output can feed internal decision-making today and can be packaged as the report of an independent assessment that a regulator might require as part of a safety case submission.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The rubric's mechanics are not tied to automated driving, so the same two-axis scoring could transfer to other safety-critical industries whose safety cases lack an agreed way to judge claim support.
The paper leaves aggregation to 'best judgement'; a natural extension is a defined weighting scheme based on each sub-claim's criticality, which could be tested against assessor judgement to see whether it reproduces or corrects it.
Because the paper reports applying the process to a real Level 4 safety case but publishes no scores, the most direct next step is a public calibration dataset: several assessors' scores on the same claims and evidence, with agreement statistics.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Bottom line: this is a useful process paper from Waymo. It gives ADS safety-case assessors something they did not have—a concrete bottom-up scoring scheme for claim support and evidence status, with the procedural/implementation split and the 0–3 rubrics in Tables 2 and 3. It is clearly written, honest about its scope, and grounds the criteria in ISO 15026, UL 4600, CMMI, and the authors' prior CCA work. The self-citation is heavy but not lazy; the criteria are anchored externally.

What is good: the procedural/implementation distinction is not just taxonomy. It forces an assessor to check both "say what we do" and "do what we say." The evidence status rubric (recency, ownership, revision control) is a practical hygiene check. The limitations section is also explicit: completeness and robustness are out of scope, top-down, and not sufficient by themselves. That is the right kind of modesty.

The soft spots, in order.

1. The load-bearing issue: Section 2.2 lists validity as a characteristic of strong evidence, but the operational rubrics do not score it. Tables 2 and 3 reward coverage, relevance, governance, implementation consistency, recency, ownership, and revision history. Nothing asks whether the underlying data, test, or analysis is scientifically valid: representative of the ODD, sufficiently powered, controlled, correctly analyzed. A well-documented safety case with technically weak evidence can score 3, and a technically strong but poorly documented one can score low. That is a construct-validity problem, not just an inter-rater reliability problem. The paper claims to evaluate credibility of claims and evidence, but the rubrics measure documentation maturity. This should be fixed or the paper reframed.

2. No empirical validation. There is no inter-rater reliability data, no calibration, no worked example of scores being applied, no evidence that scores correlate with actual credibility. The paper acknowledges subjectivity in footnote 7 and mentions group sessions, but gives no data. For a methods paper this is a notable gap; for a process meant to inform regulatory review it is a serious one.

3. The qualitative weighting of child-claim scores toward parent scores is left to "best judgement." That is defensible, but it is another place where consistency is asserted rather than shown.

The central argument—that a bottom-up scoring process is needed and this is a starting point—holds. The problem is the starting point is not yet aimed at the property named. If the authors add validity to the rubric, or explicitly position their scores as documentation maturity with validity assessed elsewhere, the paper becomes solid. For the ADS safety assurance subfield, this is the most operational guidance I have seen. I would cite it and bring it to reading group. It deserves serious peer review, with a required revision on the validity point.

Referee Report

2 major / 4 minor

Summary. The paper proposes a bottom-up process for assessing the support that claims and evidence provide in an ADS safety case, as a step toward a broader Case Credibility Assessment (CCA). It defines the anatomy of a safety case (claims, evidence, optional format-dependent elements), describes a five-stage process flow (claims creation, evidence collection, justification narratives, independent assessment, reporting/continual improvement), and presents two scoring instruments: Table 2 for claim support (procedural and implementation support, each scored 0-3) and Table 3 for evidence status (recency, ownership, review, revision history, scored 0-3). The paper also discusses timing considerations and explicitly scopes out top-down assessment attributes (completeness, robustness, logical coherence, sufficiency). The central claim is that this bottom-up scoring, when applied by independent assessors, provides a sound and operational way to evaluate the credibility of an ADS safety case's support structure, while acknowledging that it is not sufficient on its own.

Significance. If the proposed process is accepted as a sound operationalization, it would fill a concrete gap in the safety-case literature: prior standards (ISO 15026, UL 4600, CMMI) provide principles but not a detailed, claim-by-claim scoring procedure. The paper is commendable for its clear separation of procedural versus implementation support, its grounding in multiple external standards, its explicit treatment of governance and independence, and its candid enumeration of out-of-scope top-down attributes. These are genuine strengths for a practice-oriented contribution. However, the paper's significance is bounded by two factors: it provides no empirical demonstration (no worked example, no inter-rater reliability data, no calibration), and, more importantly, its operational rubric omits a characteristic that the paper itself identifies as central to strong evidence—validity. This omission means the scores measure documentation maturity and process conformance more than the technical credibility of the evidence, which weakens the claim that the process is a starting point for CCA.

major comments (2)

[Section 3 (Independent Assessment) and Section 4] The Introduction states that 'This paper details how the claims and evidence assessments were undertaken on behalf of an ADS developer in an actual Level 4 ADS safety case' and Section 3 describes an implemented process with certified assessors. Yet the paper provides no results, no worked example of scoring, no distribution of scores, no inter-rater reliability measure, and no calibration of the 0-3 scales. The only acknowledgment of subjectivity is footnote 7, and Section 4.1 mentions 'group sessions ... to improve inter-rater reliability' without reporting any such reliability. Because the paper's contribution is operational guidance, the absence of any demonstration that the guidance produces consistent or meaningful scores leaves the repeatability claim unsupported. The authors should add at least one detailed worked example (including justification of scores) and, if possible, summary reliability data, or soften the claim to a proposed process rather than one already validated in practice.
[Section 4.1 and Section 4.2 (Table 3 thresholds)] The scoring thresholds in Table 3 (e.g., evidence older than 12 months with no active re-confirmation scores 1; evidence reviewed within 6 months with full revision history scores 3) are presented without justification. These numerical cutoffs are arbitrary and will materially affect scores; the paper should either cite empirical or industry-benchmark justification for the specific values or present them as illustrative defaults that can be calibrated per organization, with guidance on how to set them.

minor comments (4)

[Section 3, fourth bullet] The text says assessors score 'per the criteria of Tables 1 and 2' but the relevant scoring tables are Table 2 (claim support) and Table 3 (evidence status). Please correct the table reference.
[Figure 3 caption] The caption for Figure 3 is identical to the caption for Figure 1, but Figure 3 is intended to illustrate evidence appended to child claims. Please revise the caption to describe the evidence attachment.
[References and author names] There are several citation inconsistencies: 'Favarò' appears as 'Favaró' in some citations; 'Gheman' should be 'Gehman'; 'Favarò et al., 2023' is inconsistently spelled across the text; and 'Holloway, C., Wasson, K., 2021' has an unusual formatting. Please harmonize all author names and reference entries.
[Abstract and Section 7] The abstract says the approach 'specifically tackles the question of judging the credibility of a safety case,' but the conclusion and Section 6 emphasize that the bottom-up assessment is not sufficient and that top-down components are out of scope. Given the major comment about the omission of validity, the wording 'tackles the question of credibility' overstates what the process actually assesses; consider using 'contributes to' or 'addresses a component of' credibility.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the bottom-up scoring rubric is a new operationalization, and the paper explicitly limits its claim to a necessary first step rather than full credibility.

full rationale

This paper does not derive quantitative predictions from fitted parameters, and no equation reduces an output to an input by construction. The central contribution is an operational scoring rubric for claim support and evidence status. That rubric is admittedly built from the authors' earlier CCA framing (Favarò et al., 2023) and from external maturity and audit standards (ISO 15026, ISO 330xx, CMMI), but the scoring criteria in Tables 2 and 3 are new operational definitions, not fitted values. The paper repeatedly limits its claim: it is a 'starting point', the bottom-up scores are 'not sufficient to establish full credibility', and Sections 4.3 and 6 explicitly defer top-down completeness and robustness. A possible construct-validity issue remains: Section 2.2 lists 'validity' as a strong-evidence characteristic, but Tables 2 and 3 score documentation coverage, governance, and recency rather than technical validity. That is a substantive limitation and a correctness concern, not a circular step under the required patterns. Self-citations are present but not load-bearing in the sense of forcing a result; they supply the CCA vocabulary and Waymo's safety-case structure, while the assessment process itself is detailed independently in this paper. Therefore no circularity step is identified.

Assumptions & free parameters 2 free parameters · 5 assumptions · 0 invented entities

The method introduces no new physical or formal entities. Its key choices are the recency thresholds and the 0 to 3 rubrics, which are hand-set. The main assumptions are domain-level: that claims/evidence decomposition supports credibility assessment, that independent assessment helps, and that assessor subjectivity is acceptable. The reliance on the authors' own prior CCA papers introduces a self-referential element, though external standards anchor the rubrics.

free parameters (2)

Evidence recency threshold = 12 months
Chosen by hand in Table 3 as the boundary for 'does not meet expectations', with no empirical calibration shown.
High-scoring recency threshold = 6 months
Chosen by hand for 'exceeds expectations' in Table 3; no basis provided, affecting evidence status scores.

assumptions (5)

domain assumption A safety case consists of claims and evidence, and its credibility can be assessed bottom-up by scoring individual claims and evidence.
Introduced in Sections 2 and 4. The entire method presupposes this decomposition and that scoring individual elements meaningfully contributes to overall credibility.
domain assumption Independent assessment by a separate team of safety experts improves the credibility of the safety case.
Stated in Sections 1 and 6. No evidence is provided that independence as implemented yields reliable assessments.
domain assumption The subjective judgment of assessors applying the rubrics is natural and acceptable.
Footnotes 7 and 10 acknowledge subjectivity but proceed on the assumption that the guidance ensures adequate consistency.
domain assumption The standards referenced (ISO 15026, UL 4600, MISRA, ISO 33000) provide a valid foundation for the scoring criteria.
Section 4.1 states the criteria are adapted from maturity models like CMMI and ISO/IEC 33000, treated as authoritative without critical examination.
domain assumption The CCA framework from Favarò et al. 2023 is accepted as background for the bottom-up and top-down pillars.
Section 1 and 2.3 rely on the authors' prior CCA concept without independent support, making the method self-referential to their own framework.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Assessing a Safety Case: Bottom-up Guidance for Claims and Evidence Evaluation." pith.science (2026). https://pith.science/paper/7IOZORQM

@misc{pith2026250609929,
  author       = {Pith},
  title        = {Pith review of: Assessing a Safety Case: Bottom-up Guidance for Claims and Evidence Evaluation},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/7IOZORQM}},
  note         = {Machine review of arXiv:2506.09929}
}

read the original abstract

As Automated Driving Systems (ADS) technology advances, ensuring safety and public trust requires robust assurance frameworks, with safety cases emerging as a critical tool toward such a goal. This paper explores an approach to assess how a safety case is supported by its claims and evidence, toward establishing credibility for the overall case. Starting from a description of the building blocks of a safety case (claims, evidence, and optional format-dependent entries), this paper delves into the assessment of support of each claim through the provided evidence. Two domains of assessment are outlined for each claim: procedural support (formalizing process specification) and implementation support (demonstrating process application). Additionally, an assessment of evidence status is also undertaken, independently from the claims support. Scoring strategies and evaluation guidelines are provided, including detailed scoring tables for claim support and evidence status assessment. The paper further discusses governance, continual improvement, and timing considerations for safety case assessments. Reporting of results and findings is contextualized within its primary use for internal decision-making on continual improvement efforts. The presented approach builds on state of the art auditing practices, but specifically tackles the question of judging the credibility of a safety case. While not conclusive on its own, it provides a starting point toward a comprehensive "Case Credibility Assessment" (CCA), starting from the evaluation of the support for each claim (individually and in aggregate), as well as every piece of evidence provided. By delving into the technical intricacies of ADS safety cases, this work contributes to the ongoing discourse on safety assurance and aims to facilitate the responsible integration of ADS technology into society.

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

15 extracted references · 10 canonical work pages

[1]

Available at https://aurora.tech/vssa Barker, S., Kendall, I., Darlison, A

Aurora, Driverless Safety Report (2025). Available at https://aurora.tech/vssa Barker, S., Kendall, I., Darlison, A. (1997). Safety Cases for Software-intensive Systems: an Industrial Experience Report. In: Daniel, P. (eds) Safe Comp

work page 2025
[3]

Available at https://scsc.uk/r141C:1?t=1 Safety-Critical Systems Club (SCSC) Assurance Case Working Group (ACWG). (2021). Assurance Case Guidance ‘Challenges, Common Issues and Good Practice’ Version

work page 2021
[6]

23 Favarò F.M., Schnelle, S., Fraade-Blanar, L., Victor, T., Peña, M., Webb, N., Broce, H., Paterson, C., Smith, D

https://doi.org/10.2760/135735. 23 Favarò F.M., Schnelle, S., Fraade-Blanar, L., Victor, T., Peña, M., Webb, N., Broce, H., Paterson, C., Smith, D

work page doi:10.2760/135735
[8]

Available at: https://ntrs.nasa.gov/api/citations/20210022807/downloads/PASS-2021-10-25-1442.pdf Koopman, P

A Primer on Argument Assessment. Available at: https://ntrs.nasa.gov/api/citations/20210022807/downloads/PASS-2021-10-25-1442.pdf Koopman, P

arXiv 2021
[11]

arXiv preprint arXiv:2108.13294

The missing link: Developing a safety case for perception components in automated driving. arXiv preprint arXiv:2108.13294 . Safety-Critical Systems Club (SCSC) Assurance Case Working Group (ACWG). (2021). Goal Structuring Notation Community Standard Version

arXiv 2021
[13]

JSP 430 - Ship Safety Management System Handbook,

Available at https://scsc.uk/r159:1 Schwall, M., Daniel T., Victor T., Favarò F., Hohnhold H., (2020) Waymo Public Road Safety Performance Data. Available at https://arxiv.org/pdf/2011.00038 Underwriters Laboratories (UL) - UL 4600:2023 Standard for Safety Evaluation of Autonomous Products - Third Edition. (2023) United Kingdom (UK) Ministry of Defense (M...

arXiv 2020
[15]

ADS-08-04r1

Consolidated Draft of Common Provisions on ADS Safety. ADS-08-04r1. Available at: https://wiki.unece.org/download/attachments/271090175/ADS-08-04r1.docx?api=v2 Verband der Automobilindustrie (VDA) Qualitäts-Management-Center (QMC). (2020) Automotive Cybersecurity Management System Audit Webb, N., Smith, D., Ludwick, C., Victor, T.W., Hommes, Q., Favarò F....

work page arXiv 2020
[97]

The Public Enquiry into the Piper Alpha Disaster

Springer, London. https://doi.org/10.1007/978-1-4471-0997-6_26 CMMI Institute’s Capability Maturity Model Integration (CMMI) (2025). Available at https://cmmiinstitute.com/cmmi Cullen, W.D. “The Public Enquiry into the Piper Alpha Disaster”. Department of Energy, London, HMSO, November

work page doi:10.1007/978-1-4471-0997-6_26 2025

Show all 15 references

[1990]

and Youngblood, R., (2015)

Dezfuli, H., Benjamin, A., Everett, C., Feather, M., Rutledge, P., Sen, D. and Youngblood, R., (2015). NASA system safety handbook. Volume 2: System safety concepts, guidelines, and implementation examples (No. HQ-E-DAA-TN23550). European Union (EU) Regulation 2022/1426 - http...

2015
[1996]

United Kingdom (UK) Ministry of Defence (MoD). (2017). Defence Standard 00-56 Issue 7 (Part 1): Safety Management Requirements for Defence Systems. Available at: https://s3-eu-west-1.amazonaws.com/s3.spanglefish.com/s/22631/documents/safety-specifications/def-stan-00-056-pt1-i...

2017
[2003]

Columbia Accident Investigation Board: Volumes I-II-III-IV-V-VI International Organization for Standardization (ISO). (2015). Information technology — Process assessment - ISO/IEC 330XX Family (ISO/IEC 33001:2015, ISO/IEC 33002:2015 , ISO/IEC 33003:2015 , ISO/IEC 33004:2015, I...

2015
[2021]

Positive Risk Balance

Exploring the Relationship Between" Positive Risk Balance" and" Absence of Unreasonable Risk". arXiv preprint arXiv:2110.10566. Favarò, F., Fraade-Blanar, L., Schnelle, S., Victor, T., Peña, M., Engstrom, J., Scanlon, J., Kusano, K. and Smith, D.,

arXiv
[2022]

*arXiv preprint arXiv:2212.08148*

Collision avoidance testing of the Waymo automated driving system. *arXiv preprint arXiv:2212.08148*. https://doi.org/10.48550/arXiv.2212.08148 Gehman, H.W.,

doi arXiv
[2023]

arXiv preprint arXiv:2306.01917

Building a Credible Case for Safety: Waymo's Approach for the Determination of Absence of Unreasonable Risk. arXiv preprint arXiv:2306.01917. Favaro, F.M., Victor, T., Hohnhold, H. and Schnelle, S. (2023). Interpreting Safety Outcomes: Waymo's Performance Evaluation in the Con...

2023 arXiv
[2025]

Railway Safety Cases - Railway (Safety Case) Regulations 1994 - Guidance on Regulations,

Determining Absence of Unreasonable Risk: Approval Guidelines for an Automated Driving System Deployment. arXiv preprint available at: https://arxiv.org/pdf/2505.09880 Health and Safety Executive (HSE), “Railway Safety Cases - Railway (Safety Case) Regulations 1994 - Guidance ...

1994 arXiv

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.

[1] [1]

Available at https://aurora.tech/vssa Barker, S., Kendall, I., Darlison, A

Aurora, Driverless Safety Report (2025). Available at https://aurora.tech/vssa Barker, S., Kendall, I., Darlison, A. (1997). Safety Cases for Software-intensive Systems: an Industrial Experience Report. In: Daniel, P. (eds) Safe Comp

work page 2025

[2] [3]

Available at https://scsc.uk/r141C:1?t=1 Safety-Critical Systems Club (SCSC) Assurance Case Working Group (ACWG). (2021). Assurance Case Guidance ‘Challenges, Common Issues and Good Practice’ Version

work page 2021

[3] [6]

23 Favarò F.M., Schnelle, S., Fraade-Blanar, L., Victor, T., Peña, M., Webb, N., Broce, H., Paterson, C., Smith, D

https://doi.org/10.2760/135735. 23 Favarò F.M., Schnelle, S., Fraade-Blanar, L., Victor, T., Peña, M., Webb, N., Broce, H., Paterson, C., Smith, D

work page doi:10.2760/135735

[4] [8]

Available at: https://ntrs.nasa.gov/api/citations/20210022807/downloads/PASS-2021-10-25-1442.pdf Koopman, P

A Primer on Argument Assessment. Available at: https://ntrs.nasa.gov/api/citations/20210022807/downloads/PASS-2021-10-25-1442.pdf Koopman, P

arXiv 2021

[5] [11]

arXiv preprint arXiv:2108.13294

The missing link: Developing a safety case for perception components in automated driving. arXiv preprint arXiv:2108.13294 . Safety-Critical Systems Club (SCSC) Assurance Case Working Group (ACWG). (2021). Goal Structuring Notation Community Standard Version

arXiv 2021

[6] [13]

JSP 430 - Ship Safety Management System Handbook,

Available at https://scsc.uk/r159:1 Schwall, M., Daniel T., Victor T., Favarò F., Hohnhold H., (2020) Waymo Public Road Safety Performance Data. Available at https://arxiv.org/pdf/2011.00038 Underwriters Laboratories (UL) - UL 4600:2023 Standard for Safety Evaluation of Autonomous Products - Third Edition. (2023) United Kingdom (UK) Ministry of Defense (M...

arXiv 2020

[7] [15]

ADS-08-04r1

Consolidated Draft of Common Provisions on ADS Safety. ADS-08-04r1. Available at: https://wiki.unece.org/download/attachments/271090175/ADS-08-04r1.docx?api=v2 Verband der Automobilindustrie (VDA) Qualitäts-Management-Center (QMC). (2020) Automotive Cybersecurity Management System Audit Webb, N., Smith, D., Ludwick, C., Victor, T.W., Hommes, Q., Favarò F....

work page arXiv 2020

[8] [97]

The Public Enquiry into the Piper Alpha Disaster

Springer, London. https://doi.org/10.1007/978-1-4471-0997-6_26 CMMI Institute’s Capability Maturity Model Integration (CMMI) (2025). Available at https://cmmiinstitute.com/cmmi Cullen, W.D. “The Public Enquiry into the Piper Alpha Disaster”. Department of Energy, London, HMSO, November

work page doi:10.1007/978-1-4471-0997-6_26 2025