Avionics Domain Research Articles

Model-driven development for functional correctness of avionics systems: a verification framework for SysML specifications

AbstractCurrently, the most widespread software quality assurance methods in the avionics domain are semi-automated reviews and testing. However, their effort grows disproportionately to the size of the system under development. Also, these methods cannot achieve exhaustive coverage due to the complexity of today’s avionics systems and their potentially infinite set of combinations of possible inputs and system states. Furthermore, the later software issues are detected in the development process, the more expensive it is to fix them. To overcome these issues, a model-driven verification approach for modeling and analyzing avionics systems in early phases of the development is presented. To this end, semantics is given to SysML v2 models by a mapping to a theorem prover encoding. The development of a dedicated SysML v2 profile supporting event-driven data flow specifications, the encoding of corresponding structures in the theorem prover Isabelle, and a generator creating theorems from SysML v2 models are presented. The approach is evaluated by formally proving a representative liveness property of a hierarchical system model from the avionics domain. Since liveness properties can be negated only by infinite data sequences and thus cannot be covered exhaustively by testing, this case study demonstrates the added value for meeting typical safety requirements in the avionics domain. The results can be transferred from avionics to other domains, as well.

Qualification of Avionic Software Based on Machine Learning: Challenges and Key Enabling Domains

Advances in machine learning (ML) open the way to innovating functions in the avionic domain, such as navigation/surveillance assistance (e.g., vision-based navigation, obstacle sensing, virtual sensing), speech-to-text applications, autonomous flight, predictive maintenance, and cockpit assistance. Current standards and practices, which were defined and refined over decades with classical programming in mind, do not, however, support this new development paradigm. This paper provides an overview of the main challenges raised by the use of ML in the demonstration of compliance with regulatory requirements (i.e., software qualification) and an overview of literature relevant to these challenges, with particular focus on the issues of robustness, provability, and explainability of ML results.

Monitoring with verified guarantees

AbstractRuntime monitoring is generally considered a light-weight alternative to formal verification. In safety-critical systems, however, the monitor itself is a critical component. For example, if the monitor is responsible for initiating emergency protocols, as proposed in a recent aviation standard, then the safety of the entire system critically depends on the correctness of the monitor. In this paper, we present a verification extension to the Lola monitoring language that extends the efficient specification of the monitor with Hoare-style annotations that guarantee the correctness of the monitor specification. We add two new operators, assume and assert, which specify assumptions of the monitor and expectations on its output, respectively. The validity of the annotations is established by an integrated SMT solver. We report on experience in applying the approach to specifications from the avionics domain, where the annotation with assumptions and assertions has lead to the discovery of safety-critical errors in specifications. The errors range from incorrect default values in offset computations to complex algorithmic errors that result in unexpected temporal patterns. We also report how verified specifications can be monitored efficiently at runtime.

Secure communication technology between network domains based on virtualization avionics platform

In the information interconnection scenario of the new generation wide-body aircraft, there is a large amount of real-time bi-directional data exchange between aircraft control domain and airline information services domain in civil aircraft avionics system, and its security isolation and information flow protection are facing increasingly serious information security threats. Therefore, a bi-directional secure communication architecture based on virtualization avionics platform is proposed in this study. The attribute-based access control for multiple avionics domain is modeling and the designs of protection for contract security critical data and real-time monitoring for security critical component effectiveness are given. Physical implementation and verification results based on the domestic ACoreOS operating system and avionics hardware platform show that the bi-directional secure communication method based on virtualization avionics platform achieves the spatial isolation of security critical components, the data transmit and receive time of ACD network is less than 50 ms, and the message transmit and receive rate of ACD network is greater than 70 Mb/s. These results can meet the performance requirements of secure communication between avionics network domains of wide-body aircraft, which have high practical value.

Knowledge-Assisted Reasoning of Model-Augmented System Requirements with Event Calculus and Goal-Directed Answer Set Programming

We consider requirements for cyber-physical systems represented in constrained natural language. We present novel automated techniques for aiding in the development of these requirements so that they are consistent and can withstand perceived failures. We show how cyber-physical systems' requirements can be modeled using the event calculus (EC), a formalism used in AI for representing actions and change. We also show how answer set programming (ASP) and its query-driven implementation s(CASP) can be used to directly realize the event calculus model of the requirements. This event calculus model can be used to automatically validate the requirements. Since ASP is an expressive knowledge representation language, it can also be used to represent contextual knowledge about cyber-physical systems, which, in turn, can be used to find gaps in their requirements specifications. We illustrate our approach through an altitude alerting system from the avionics domain.

Auth-AIS: Secure, Flexible, and Backward-Compatible Authentication of Vessels AIS Broadcasts

Automatic Identification System (AIS) is the de-facto communication standard used by vessels to broadcast identification and position information. However, being AIS communications neither encrypted nor authenticated, they can be eavesdropped and spoofed by adversaries, leading to potentially threatening scenarios. Existing solutions, including the ones conceived in the avionics domain, do not consider integration with the AIS standard, and they do not provide protection against rogue messages flooding. In this article, we propose Auth-AIS, a secure, flexible, standard-compliant, and backward-compatible authentication framework to secure AIS broadcast messages. Auth-AIS leverages existing sound cryptographic tools, including TESLA and Bloom Filters, inheriting their security properties while contextualizing them in the AIS technology. Auth-AIS is a software-only solution, that can be seamlessly integrated into existing AIS deployments, without requiring any hardware replacement. Its innovative design also provides backward-compatibility—i.e., Auth-AIS messages can be received also by AIS users not adopting Auth-AIS, while renouncing at its security guarantees. Auth-AIS can work in either two configuration modes: Deterministic Security Configuration, able to achieve low-delay authentication with a message overhead of 75 percent, or Probabilistic Security Configuration, reducing the message overhead down to 35.71 percent, while experiencing a marginal increase in the authentication delay. All these security configurations guarantee an 80 bits equivalent security level and false-positive rate less than 2 <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">--40</sup> . Note that these latter security parameters can easily be tuned to fit different security requirements. Finally, the source code of Auth-AIS in the GNURadio ecosystem has been released as open-source, to foster research activities from both Industry and Academia on secure AIS communications.

Model-based Safety Assessment of a Triple Modular Generator with xSAP

Abstract The system design process needs to cope with the increasing complexity and size of systems,motivating the replacement of labor intensivemanual techniques with automated and semi-automated approaches.Recently, formal methods techniques, such as model-based verification and safety assessment, have been increasingly used to model systems under fault and to analyze them, generating artifacts such as fault trees and FMEA tables. In this paper, we show how to apply model-based techniques to a realistic case study from the avionics domain: a high integrity power distribution system, the Triple Modular Generator (TMG). The TMG is composed of a redundant and reconfigurable plant and a controller that must guarantee a high level of reliability. The case study is a significant challenge, from the modeling perspective, since it implements a complex reconfiguration policy, specified via a number of requirements in natural language, including a set of mutually dependent and potentially conflicting priority constraints. Moreover, from the verification standpoint, the controller must be able to handle an exponential number of possible faulty configurations. Our contribution is twofold. First, we formalize and validate the requirements and, using a constraint-based modeling style, we synthesize a correct by construction controller, avoiding the enumeration of all possible fault configurations, as is currently done by manual approaches. Second, we describe a comprehensive methodology and process, supported by the xSAP safety analysis platform that targets the modeling and safety assessment of faulty systems. Using xSAP, we are able to automatically extract minimal cut sets for the TMG. We demonstrate the scalability of our approach by analyzing a parametric version of the TMG case study that contains more than 700 variables and 90 faults.

Software product-line evaluation in the large

Software product-line engineering is arguably one of the most successful methods for establishing large portfolios of software variants in an application domain. However, despite the benefits, establishing a product line requires substantial upfront investments into a software platform with a proper product-line architecture, into new software-engineering processes (domain engineering and application engineering), into business strategies with commercially successful product-line visions and financial planning, as well as into re-organization of development teams. Moreover, establishing a full-fledged product line is not always possible or desired, and thus organizations often adopt product-line engineering only to an extent that deemed necessary or was possible. However, understanding the current state of adoption, namely, the maturity or performance of product-line engineering in an organization, is challenging, while being crucial to steer investments. To this end, several measurement methods have been proposed in the literature, with the most prominent one being the Family Evaluation Framework (FEF), introduced almost two decades ago. Unfortunately, applying it is not straightforward, and the benefits of using it have not been assessed so far. We present an experience report of applying the FEF to nine medium- to large-scale product lines in the avionics domain. We discuss how we tailored and executed the FEF, together with the relevant adaptations and extensions we needed to perform. Specifically, we elicited the data for the FEF assessment with 27 interviews over a period of 11 months. We discuss experiences and assess the benefits of using the FEF, aiming at helping other organizations assessing their practices for engineering their portfolios of software variants.

Adaptive Testing for Specification Coverage in CPS Models

Abstract Ensuring correctness of cyber-physical systems (CPS) is a challenging task that is in practice often addressed with simulation-based testing. Formal specification languages, such as Signal Temporal Logic (STL), are used to mathematically express CPS requirements and thus render the simulation activity more principled. We propose a novel method for adaptive generation of tests with specification coverage for STL. To achieve this goal, we devise cooperative reachability games that we combine with numerical optimization to create tests that explore the system in a way that exercise various parts of the specification. To the best of our knowledge our approach is the first adaptive testing approach that can be applied directly to MATLAB™ Simulink/Stateflow models. We implemented our approach in a prototype tool and evaluated it on several illustrating examples and a case study from the avionics domain, demonstrating the effectiveness of adaptive testing to (1) incrementally build a test case that reaches a test objective, (2) generate a test suite that increases the specification coverage, and (3) infer what part of the specification is actually implemented.

Worst-Case Timing Analysis of AFDX Networks With Multiple TSN/BLS Shapers

This paper addresses the problem of worst-case timing analysis of extended Avionics Full Duplex Switched Ethernet (AFDX) networks, incorporating Time-Sensitive Networking (TSN) shapers called Burst Limiting Shapers (BLS), to enable the interconnection of different avionics domains with mixed-criticality levels, e.g., current AFDX traffic, Flight Control and In-Flight Entertainment. Conducting such an analysis is a challenging issue when considering multiple BLS-shaped traffic classes, due to the sophisticated inter-dependencies between the different shapers sharing the same output capacity. We tackle this problem through extending the applicability domain of our previous work for computing maximum delay bounds using Network Calculus and considering only one BLS class, called Continuous Credit-based Approach (CCbA), to handle multiple TSN/BLS classes. We provide further insights into the sensitivity and tightness issues of worst-case delay bounds yielded with the Generalized CCbA (GCCbA). Our assessments show that the tightness ratio is up to 85%, with reference to Achievable Worst-Case delays. We also show the improvements against recent state-of-the-art approaches in terms of tightness and complexity, where the computation time is up to 105 faster. Finally, we evaluate the efficiency of GCCbA for realistic avionics case studies, e.g., adding A350 flight control traffic to the AFDX. Results show the good applicability of GCCbA and confirm the efficiency of the extended AFDX, which decreases the delay bounds of the existing AFDX traffic by up to 49.9%, in comparison with the current AFDX standard.

Formal methods for transport systems

Formal methods and verification tools have been in use in the engineering of safety-critical transport systems for well over 30 years. In both the railway and the avionics domain, for instance, formal methods are specifically recommended in current international certification standards for ultra-dependable systems and for products at the highest integrity level. In fact, traditionally, the applications of formal methods and tools to such transport systems concern demonstrating, with the highest levels of assurance, the correct functioning of the software systems involved, such as train signalling systems to avoid collisions. More recently, however, formal methods and verification tools have started to be applied also to the scheduling and management of transport systems or networks, for instance to optimise the exploitation of a railway line or to improve the operational efficiency of a bus network. In this introduction to the special issue on “Formal Methods for Transport Systems”, we outline some recent achievements for each of the above-mentioned types of application of formal methods and tools. These achievements are represented by three selected papers: one was selected from the “Formal Methods and Safety Certification: Challenges in the Railways Domain” track at the seventh International Symposium On Leveraging Applications of Formal Methods, Verification and Validation (ISoLA 2016); another one was selected from the 21st International Workshop on Formal Methods for Industrial Critical Systems and the 16th International Workshop on Automated Verification of Critical Systems (FMICS-AVoCS 2016); a final one was selected after an open call for contributions.

Forward End-to-End Delay for AFDX Networks

Packet switched networks and message multiplexing have been a major upgrade for industrial systems communications. In the avionics domain, this evolution was brought by the introduction of avionics full duplex switched ethernet (AFDX). Guaranteed upper bounds of end-to-end delays for messages transmitted over an AFDX network are mandatory for certification reasons. In this article, we present the forward end-to-end delay analysis (FA), which is scalable to both large and heavily loaded configurations. A formal proof of FA is detailed and the approach is compared with alternative methods (network calculus and the trajectory approach) on two types of AFDX configurations (including a real industrial architecture).

Criticality-cognizant Clustering-based Task Scheduling on Multicore Processors in the Avionics Domain

Scheduling of mixed-criticality systems (MCS) on a common computational platform is challenging because conventional scheduling approaches may cause inefficient utilization of shared computing resources. In this paper, we propose an approach called Clustering-based Partitioned Earliest Deadline First (C-PEDF) algorithm to schedule dual-criticality implicit-deadline sporadic tasks on a homogeneous multicore system. Our C-PEDF scheduling approach exploits (i) a Clustering-based bin-packing algorithm that explicitly accounts the demands of tasks based on their levels of confidence; and (ii) an Enhanced dual-mode scheduling policy to schedule tasks within a core. The proposed C-PEDF integrates every single high-level workload with a group of low-level workloads and coalesces them into a cluster. Within each cluster, tasks are scheduled under our Enhanced dual-mode scheduling policy to improve the service level of high-level tasks without jeopardizing the schedulability of low-level tasks. Clusters are scheduled under Earliest Deadline First (EDF) scheduling approach. We conduct a schedulability test for the proposed technique, and we demonstrate how workloads can be clustered by means of Mixed Integer Nonlinear Programming (MINLP) model. Extensive simulation results reveal that our algorithm significantly outperforms other existing approaches both in acceptance ratio and the impact factor of low-level tasks.

From use case maps to executable test procedures: a scenario-based approach

Testing embedded systems software has become a costly activity as these systems become more complex to fulfill rising needs. Testing processes should be both effective and affordable. An ideal testing process should begin with validated requirements and begin as early as possible so that requirements defects can be fixed before they propagate and become more difficult to address. Furthermore, the testing process should facilitate test procedures creation and automate their execution. We propose a novel methodology for testing functional requirements. The methodology activities include standard notations, such as UCM for modeling scenarios derived from requirements, TDL for describing test cases and TTCN-3 for executing test procedures; other test scripting languages can also be used with our methodology. Furthermore, the automation of the methodology generates test artifacts through model transformation. The main goals of this test methodology are to leverage requirements represented as scenarios, to replace the natural language test case descriptions with test scenarios in TDL, and to generate executable test procedures. Demonstration of the feasibility of the proposed approach is based on a public case study. An empirical evaluation of our approach is given using a case study from the avionics domain.

An Error-Detection and Self-Repairing Method for Dynamically and Partially Reconfigurable Systems

Reconfigurable systems are gaining an increasing interest in the domain of safety-critical applications, for example in the space and avionic domains. In fact, the capability of reconfiguring the system during run-time execution and the high computational power of modern Field Programmable Gate Arrays (FPGAs) make these devices suitable for intensive data processing tasks. Moreover, such systems must also guarantee the abilities of self-awareness, self-diagnosis and self-repair in order to cope with errors due to the harsh conditions typically existing in some environments. In this paper we propose a self-repairing method for partially and dynamically reconfigurable systems applied at a fine-grain granularity level. Our method is able to detect correct and recover errors using the run-time capabilities offered by modern SRAM-based FPGAs. Fault injection campaigns have been executed on a dynamically reconfigurable system embedding a number of benchmark circuits. Experimental results demonstrate that our method achieves full detection of single and multiple errors, while significantly improving the system availability with respect to traditional error detection and correction methods.

Design of Embedded Architecture for Integrated Diagnostics in Avionics Domain

The resent paper introduces a multi-level decision-making approach for design of optimal embedded integrated diagnostic architecture that combines maintenance decisions at the k-levels of system architecture and integration with health and usage monitoring systems (HUMS) mechanisms for achieving efficient system for level maintenance and lowering life-cycle cost of Integrated Modular Avionics (IMA). HUMS can be implemented in software or directly on an integrated circuit. The effectiveness of such an approach is investigated through the optimization of embedded HUMS architecture for known reliability and economic dependence during life cycle of IMA.

Architecture Level Safety Analyses for Safety-Critical Systems

The dependency of complex embedded Safety-Critical Systems across Avionics and Aerospace domains on their underlying software and hardware components has gradually increased with progression in time. Such application domain systems are developed based on a complex integrated architecture, which is modular in nature. Engineering practices assured with system safety standards to manage the failure, faulty, and unsafe operational conditions are very much necessary. System safety analyses involve the analysis of complex software architecture of the system, a major aspect in leading to fatal consequences in the behaviour of Safety-Critical Systems, and provide high reliability and dependability factors during their development. In this paper, we propose an architecture fault modeling and the safety analyses approach that will aid in identifying and eliminating the design flaws. The formal foundations of SAE Architecture Analysis &amp; Design Language (AADL) augmented with the Error Model Annex (EMV) are discussed. The fault propagation, failure behaviour, and the composite behaviour of the design flaws/failures are considered for architecture safety analysis. The illustration of the proposed approach is validated by implementing the Speed Control Unit of Power-Boat Autopilot (PBA) system. The Error Model Annex (EMV) is guided with the pattern of consideration and inclusion of probable failure scenarios and propagation of fault conditions in the Speed Control Unit of Power-Boat Autopilot (PBA). This helps in validating the system architecture with the detection of the error event in the model and its impact in the operational environment. This also provides an insight of the certification impact that these exceptional conditions pose at various criticality levels and design assurance levels and its implications in verifying and validating the designs.

Handling heterogeneous partitioned systems through ARINC-653 and DDS

Many cyber-physical systems in the avionics domain are mission- or safety-critical systems. In this context, standard distribution middleware has recently emerged as a potential solution to interconnect heterogeneous partitioned systems, as it would bring important benefits throughout the software development process. A remaining challenge, however, is reducing the complexity associated with current distribution middleware standards which leads to prohibitive certification costs. To overcome this complexity, this work explores the use of the DDS distribution middleware standard on top of a software platform based on the ARINC-653 specification. Furthermore, it discusses how both technologies can be integrated in order to apply them in mission and safety-critical scenarios.

An experimental Study using ACSL and Frama-C to formulate and verify Low-Level Requirements from a DO-178C compliant Avionics Project

Safety critical avionics software is a natural application area for formal verification. This is reflected in the formal method's inclusion into the certification guideline DO-178C and its formal methods supplement DO-333. Airbus and Dassault-Aviation, for example, have conducted studies in using formal verification. A large German national research project, Verisoft XT, also examined the application of formal methods in the avionics domain. However, formal methods are not yet mainstream, and it is questionable if formal verification, especially formal deduction, can be integrated into the software development processes of a resource constrained small or medium enterprise (SME). ESG, a Munich based medium sized company, has conducted a small experimental study on the application of formal verification on a small portion of a real avionics project. The low level specification of a software function was formalized with ACSL, and the corresponding source code was partially verified using Frama-C and the WP plugin, with Alt-Ergo as automated prover. We established a couple of criteria which a method should meet to be fit for purpose for industrial use in SME, and evaluated these criteria with the experience gathered by using ACSL with Frama-C on a real world example. The paper reports on the results of this study but also highlights some issues regarding the method in general which, in our view, will typically arise when using the method in the domain of embedded real-time programming.

Formal validation of domain-specific languages with derived features and well-formedness constraints

Despite the wide range of existing tool support, constructing a design environment for a complex domain-specific language (DSL) is still a tedious task as the large number of derived features and well-formedness constraints complementing the domain metamodel necessitate special handling. Such derived features and constraints are frequently defined by declarative techniques (such graph patterns or OCL invariants). However, for complex domains, derived features and constraints can easily be formalized incorrectly resulting in inconsistent, incomplete or ambiguous DSL specifications. To detect such issues, we propose an automated mapping of EMF metamodels enriched with derived features and well-formedness constraints captured as graph queries in EMF-IncQuery or (a subset of) OCL invariants into an effectively propositional fragment of first-order logic which can be efficiently analyzed by back-end reasoners. On the conceptual level, the main added value of our encoding is (1) to transform graph patterns of the EMF-IncQuery framework into FOL and (2) to introduce approximations for complex language features (e.g., transitive closure or multiplicities) which are not expressible in FOL. On the practical level, we identify and address relevant challenges and scenarios for systematically validating DSL specifications. Our approach is supported by a tool, and it will be illustrated on analyzing a DSL in the avionics domain. We also present initial performance experiments for the validation using Z3 and Alloy as back-end reasoners.