High-integrity Software Development Research Articles

What can agile methods bring to high-integrity software development?

Considering the issues and opportunities raised by Agile practices in the development of high-integrity software.

Trusted Product Lines

ContextThe paper addresses the use of a Software Product Line approach in the context of developing software for a high-integrity, regulated domain such as civil aerospace. The success of a Software Product Line approach must be judged on whether useful products can be developed more effectively (lower cost, reduced schedule) than with traditional single-system approaches. When developing products for regulated domains, the usefulness of the product is critically dependent on the ability of the development process to provide approval evidence for scrutiny by the regulating authority. ObjectiveThe objective of the work described is to propose a framework for arguing that a product instantiated using a Software Product Line approach can be approved and used within a regulated domain, such that the development cost of that product would be less than if it had been developed in isolation. MethodThe paper identifies and surveys the issues relating the adoption of Software Product Lines as currently understood (including related technologies such as feature modelling, component-based development and model transformation) when applied to high-integrity software development. We develop an argument framework using Goal Structuring Notation to structure the claims made and the evidence required to support the approval of an instantiated product in such domains. Any unsubstantiated claims or missing/sub-standard evidence is identified, and we propose potential approaches or pose research questions to help address this. ResultsThe paper provides an argument framework supporting the use of a Software Product Line approach within a high-integrity regulated domain. It shows how lifecycle evidence can be collected, managed and used to credibly support a regulatory approval process, and provides a detailed example showing how claims regarding model transformation may be supported. Any attempt to use a Software Product Line approach in a regulated domain will need to provide evidence to support their approach in accordance with the argument outlined in the paper. ConclusionProduct Line practices may complicate the generation of convincing evidence for approval of instantiated products, but it is possible to define a credible Trusted Product Line approach.

A framework for software safety in safety-critical systems

Software for safety-critical systems must deal with the hazards identified by safety analysis in order to make the system safe, risk-free, and fail-safe. Because human lives may be lost and tremendous economic costs may result if the software fails, the development of high-integrity software adopts practices that impose greater rigor on the software development processes. Software safety is a composite of many factors. Existing software quality models like McCall's and Boehm's and ISO 9126 are inadequate in addressing the software safety issues of real time safety-critical embedded systems. At present there does not exist any standard framework that comprehensively addresses the factors, criteria and metrics (FCM) approach of the quality models in respect of software safety. The safety of a software component must be considered within the context of both the overall system of which it is a component and the environment in which this system operates. It is not useful to investigate the safety of a software component in isolation. This paper proposes a new framework for software safety based on the McCall's software quality model that specifically identifies the criteria corresponding to software safety in safety critical applications. The criteria in the proposed software safety framework pertains to system hazard analysis, completeness of requirements, identification of software-related safety-critical requirements, safety-constraints based design, run-time issues management, and software safety-critical testing. This framework is then applied to a prototype safety-critical system viz. a software--based Railroad Crossing Control System (RCCS) to validate its utility.

3 Collaborative Software Process Data Collection: BAe and Roll‐Royce's Experience of Sharing a Measurement Philosophy

AbstractAs the Aerospace Industry increasingly moves to an environment where the development of its processes and products take place across company boundaries, the need for an understanding of how they will share process and product data is vital. BAe and Rolls‐Royce are collaborating on such an enterprise and this paper reports on a pilot collaboration from an engineering perspective. As a result of exchanging best practice in Software Metrics between BAe MA&A and Rolls‐Royce, a decision was made to begin to use the Process Engineering Language (PEL) across the two companies to gather metrics in a consistent format. The goal was to find out if the same measurement philosophy could be used to assess differing Real Time High Integrity Software development strategies and to see if different working practices produce similar costs and results.

High integrity software development: process and tool issues

YSE and BAe Defence have recently completed an unclassified study for MoD (PE) specifically concerned with high integrity software development process and tool issues. The overall objective of the project was to produce guidance for MoD project managers on the sorts of processes and toolsets which their suppliers should be expected to deploy on projects being conducted in the context of Interim Defense Standard (IDS) 00-55 and IDS 00-56. A wide-ranging survey of industrial practice underpinned the project. This paper reports the main areas of work of the project and its results. The topics covered include: • ⊗ ideal high integrity software development including tool support requirements; • ⊗ a review of current high integrity software development practice; • ⊗ available tool support (COTS and proprietary); • ⊗ a minimum acceptable process and associated tool support; • ⊗ process and toolset hazard analysis; • ⊗ process and toolset safety cases; • ⊗ building better toolsets; • ⊗ process and toolset assessment.

Applying Programmable Gate Arrays to Provide Diversity in Safety Relevant Systems

Although there are already a number of established methods and guidelines, which have proven their usefulness for the development and verification of high integrity software employed for the control of safety related technical processes, these measures cannot ultimately guarantee the correctness of larger programs with mathematical rigour, yet, and, hence, corresponding safety licences are generally denied. As a remedy for this unsatisfactory situation, a novel approach based on the utilisation of programmable gate arrays is presented. The hard-wired discrete logic built of relays or LSI/MSI-chips, which operates in many safety related control systems in parallel to computers, is replaced by programmable logic constructed from PGAs. Thus, the flexibility of programmable electronic systems is combined with the long established and generally accepted rigorous certify ability of hardwired sequential circuits, since in both cases the same design and verification procedures are employed. A PGA is programmed to perform certain Boolean or sequential functions by loading appropriate bit patterns into internal static memory cells. A method for the verification of their contents is detailed, which is based on diverse backward analysis and which can easily be automated. The utilisation of PGAs is not only advantageous for re-placing hard-wired by programmable logic, but also as a novel means of providing diverse redundancy in programmable electronic systems comprising computers and programmable logic controllers.

A Concept of a Computer System for the Execution of Safety Critical Licensable Software Programmed in a High Level Language

There are already a number of established methods and guidelines, which have proven their usefulness for the development of high integrity software employed for the control of safety critical technical processes. Prior to its application, such software is still subjected to appropriate measures for its verification and validation. However, according to the present state of the art, these measures cannot guarantee the correctness of larger programs with mathematical rigour. Therefore, the licencing authorities do not approve safety relevant systems yet, whose behaviour is exclusively program controlled. In order to provide a remedy for this unsatisfactory situation, the concept of a special computer system is developed, which can carry out safety related functions within the framework of distributed process control systems or programmable logic controllers. It explicitly supports sequence controls, since many automation programs including safety relevant tasks are of that kind. The architecture features full temporal predictability, determinism, and supervision of the program execution and of all other activities of the computer system and supports the software verification method of diverse inverse documentation. The system can be programmed in a high level language and is based on a library of function modules, whose correctness can be mathematically proved. The concept utilises an operating system and a compiler only in a very rudimentary form. Hence, it enables the safety licencing of the software running on the computer system. In the microprogram of this computer, which may be based on the VIPER chip, a minimum operating system is provided, whose only task is to start the execution of runnable subroutines, which are marked in a ready list. As the elementary units of application programming, the set of basic function modules is provided in RaMs. These modules are of application specific nature and generally different for each application area. For the formulation of safety related automation programs these basic functions are only interconnected with each other. The prototype of a tool has been developed allowing to carry through this kind of programming in graphical form.