# Coloured Petri Nets-Based Modeling and Validation of Insulin Infusion Pump Systems
## 4 Model-Based Approach
### Hardware and Software Decomposition  
The _MBA/CPN_ requires manufacturers to develop assurance cases based on the requirements derived from sources such as similar systems, literature reviews, recalls, and guidelines. Claims, evidence, and other assurance cases have specific representations in the _MBA/CPN_ using the XML and the GSN. In this article, we proposed and defined the Assurance Case Exchange Standard (ACES) to assist manufacturers and regulatory agencies in specifying and exchanging assurance cases during the development and certification processes. For example, the ACES includes features that enable manufacturers to carry out the traceability of the system requirements. The usage of ACES is the starting point for the application of _MBA/CPN_, and it remains being used during the whole development process due to its connection to the CPN reference models. Thus, instead of documenting and verifying goals by applying a classical approach, such as keeping all objectives satisfied  
Figure 2: Overview of _MBA/CPN_ for quality assessment of insulin infusion pump systems. (i.e., KAOS approach), to conduct the goal-oriented requirements engineering, we propose and use ACES. The XML specification is the basis for associating all of the remaining steps of the \(MBA/CPN\). The ACES considers the main concepts of the requirements engineering process based on modular GSN. An ACES document contains, at least, the graphical notations defined in the GSN specification. Each graphical notation of the GSN elements has a representation in ACES, relating the elements to specific tags and attributes of an ACES document. For example, the evidence element contains an attribute link to enable regulatory agencies to access a design artifact provided by system manufacturers to support an argument. The usage of assurance cases based on a well-defined and independent standard platform to represent and share results obtained by manufacturers with regulatory agencies may improve the design and evaluation of systems. The start and end of an ACES document is the <assuranceCase> tag. To enable the version control, each document has a general identification named generalId, along with the version identification (versionId) and local identification (localId). The generalId attribute of the <assuranceCase> tag is a unique identifier for all the versions of the ACES document, while the versionId and localId have different identifiers for each new version to represent the modifications in the document. The beginning of the document also contains specific data about the product under development by means of the <device> tag. Considering that assurance cases contain a set of related arguments about quality attributes of a system (e.g., safety and efficacy), ACES represents them using the <parentArgument> and <childArgument> tags. The <parentArgument> tag composes the body of the <assuranceCase> tag and represents the main structure of the assurance case in modular GSN. In contrast, the <childArgument> tag represents structures that are parts of the body of the <parentArgument> tag. In this case, an ACES document only contains one <parentArgument> that may consist of multiple assurance case modules: child arguments relate to specific GSN modules. Each ACES argument contains the <legalAuthenticator> tag, aiming to record the author of modifications in the ACES document. The ACES specification includes the main GSN elements: Goal, Solution, Strategy, Context, Assumption, Justification, SupportedBy, and InContextOf. In addition, it includes the modular GSN elements: Away Goal, Module, Contract, Away Solution, Away Context, and Public Indicator. ACES structures these elements in its body using the <group> tag. This element has the attribute named type, that constrains it to group GSN elements of the same type. For instance, to represent a Goal, it is necessary to define an ACES tag to represent a specific goal in the body of the <group> tag.