Goal Structuring Notation (GSN)

GSN is a graphical notation for constructing and presenting safety arguments, defined by the GSN Community Standard. It expresses an argument through six core element types - Goals (claims), Strategies (the inference between claims), Solutions (evidence), plus Context, Assumption, and Justification attached sideways - connected by exactly two relationship types: SupportedBy, which carries the inference, and InContextOf, which scopes it. In automotive use, GSN structures the safety case that ISO 26262-2 requires, connecting lifecycle work products such as HARA results, FMEDA reports, and verification records into an explicit, reviewable argument that the item achieves acceptable safety.

No. ISO 26262-2 requires a safety case - a compiled argument connecting evidence to the claim of acceptable functional safety, progressively assembled across the lifecycle and checked by a confirmation review whose independence grows with ASIL. The standard does not mandate any notation for that argument. GSN is simply the most widely adopted way to make the argument explicit, because prose safety cases collapse under the volume of work products an ASIL D item generates, hiding gaps that a structured notation exposes.

Goals are propositions a reviewer can judge true or false - not activities or document names. Strategies name the inference used to decompose a goal, such as arguing over each fault class. Solutions are the evidence leaves, citing real work products. The three sideways elements control how the argument reads: Context fixes the meaning and scope of a claim, Assumptions state what is taken as given, and Justifications explain why an approach is adequate. Only ten element-to-element connections are legal, and the permitted-connections matrix decides whether a diagram is even well-formed GSN.

The construction loop popularized by Tim Kelly: state the claim as a falsifiable goal, fix the basis of the claim with context, choose and name a strategy for decomposing it, define the sub-goals that strategy produces, and repeat until claims can be grounded directly in evidence - then stop. The discipline it enforces is what matters: every inference is named, every claim has a fixed scope, and the decomposition stops at evidence instead of trailing off into undeveloped branches nobody flagged.

Twelve chapters covering the 6 core elements, both relationship types, the six-step construction method, modular GSN, confidence arguments and defeaters, review technique, and a catalogue of 10 pitfall patterns. The worked example builds the safety argument for an electric power steering safety goal node by node, from top claim to evidence. A free account starts you off, and the Pro and Expert plans unlock more of the library.