Safety-critical Software Development Research Articles

How to Enable Ambidexterity in Safety-Critical Software Development

Overview: In a competitive environment, continually improving new products and services requires new knowledge and novel solutions. Managing projects also requires the careful control of resources for effective delivery. Ambidexterity, the simultaneous achievement of novelty through exploration and efficiency through exploitation, is challenging to achieve in practice. The ways in which companies can achieve ambidexterity are context dependent. It is especially hard to promote new and uncertain concepts in situations where lives are at stake. This article reports on a case study of a safety-critical IT development project that successfully achieved ambidexterity. Leadership behaviors that support ambidexterity in this setting are critical. We highlight four leadership behaviors key to developing an environment where creative solutions can flourish.

Weaving Agility in Safety-Critical Software Development for Aerospace: From Concerns to Opportunities

Weaving Agility in Safety-Critical Software Development for Aerospace: From Concerns to Opportunities

C2AADL_Reverse: A Model-Driven Reverse Engineering Approach for Development and Verification of Safety-Critical Software

The safety-critical system communities have been struggling to manage and maintain their legacy software systems because upgrading such systems has been a complex challenge. To overcome or reduce this problem, reverse engineering has been increasingly used in safety-critical systems. This paper proposes C2AADL_Reverse, a model-driven reverse engineering approach for safety-critical software development and verification. C2AADL_Reverse takes multi-task C source code as input, and generates AADL (Architecture Analysis and Design Language) model of the legacy software systems. Compared with the existing works, this paper considers more reversed construction including AADL component structure, behavior, and multi-threaded run-time information. Moreover, two types of activities are proposed to ensure the correctness of C2AADL_Reverse. First, it is necessary to validate the reverse engineering process. Second, the generated AADL models should conform to desired critical properties. We propose the verification of the reverse-engineered AADL model by using UPPAAL to establish component-level properties and the Assume Guarantee REasoning Environment (AGREE) to perform compositional verification of the architecture. This combination of verification tools allows us to iteratively explore design and verification of detailed behavioral models, and to scale formal analysis to large models. In addition, the prototype tool and the evaluation of C2AADL_Reverse using a real-world aerospace case study are presented.

Automatically generating test cases for safety-critical software via symbolic execution

Automated test generation based on symbolic execution can be beneficial for systematically testing safety-critical software, to facilitate test engineers to pursue the strict testing requirements mandated by the certification standards, while controlling at the same time the costs of the testing process. At the same time, the development of safety-critical software is often constrained with programming languages or coding conventions that ban linguistic features which are believed to downgrade the safety of the programs, e.g., they do not allow dynamic memory allocation and variable-length arrays, limit the way in which loops are used, forbid recursion, and bound the complexity of control conditions. As a matter of facts, these linguistic features are also the main efficiency-blockers for the test generation approaches based on symbolic execution at the state of the art.This paper contributes new evidence of the effectiveness of generating test cases with symbolic execution for a significant class of industrial safety critical-systems. We specifically focus on Scade, a largely adopted model-based development language for safety-critical embedded software, and we report on a case study in which we exploited symbolic execution to automatically generate test cases for a set of safety-critical programs developed in Scade. To this end, we introduce an original test generator that we developed in a recent industrial project on testing safety-critical railway software written in Scade, and we report on our experience of using this test generator for testing a set of Scade programs that belong to the development of an on-board signaling unit for high-speed rail. The results provide empirically evidence that symbolic execution is indeed a viable approach for generating high-quality test suites for the safety-critical programs considered in our case study.

C2AADL_Reverse: A model-driven reverse engineering approach to development and verification of safety-critical software

The safety-critical system communities have been struggling to manage and maintain their legacy softwaresystems because upgrading such systems has been a complex challenge. To overcome or reduce this problem, reverse engineering has been increasingly used in safety-critical systems. This paper proposes C2AADL_Reverse , a model-driven reverse engineering approach for safety-critical software development and verification. C2AADL_Reverse takes multi-task C source code as input, and generates AADL (Architecture Analysis and Design Language) model of the legacy software systems. Compared with the existing works, this paper considers more reversed construction including AADL component structure, behavior, and multi-threaded run-time information. Moreover, two types of activities are proposed to ensure the correctness of C2AADL_Reverse . First, it is necessary to validate the reverse engineering process. Second, the generated AADL models should conform to desired critical properties. We propose the verification of the reverse-engineered AADL model by using UPPAAL to establish component-level properties and the Assume Guarantee REasoning Environment (AGREE) to perform compositional verification of the architecture. This combination of verification tools allows us to iteratively explore design and verification of detailed behavioral models, and to scale formal analysis to large models. In addition, the prototype tool and the evaluation of C2AADL_Reverse using a real-world aerospace case study are presented.

Towards a continuous certification of safety-critical avionics software

Many industries use safety-critical systems and software, the failure of which may result in the loss of human lives. This article investigates the development and certification of safety-critical software, with a focus on the avionics industry. It highlights the problems encountered in companies to demonstrate compliance with the certification requirements and indicates current industrial practices. It demonstrates the interest and importance of closely and continuously integrating certification requirements in the software development process. It underlines a very recent trend in industry that consists in taking inspiration from agile principles in order to ensure that certification requirements applicable to software development are met as early as possible. It presents some successful industrial experiments and concludes on practical lessons that could be transferred to other projects.

Test-Driven Approach for Safety-Critical Software Development

Nowadays software control large majority of systems that humankind use. Systems that software is used widely, such as transportation, military, medicine and avionics must be safe during operation. Fail in these critical systems may cause catastrophic results (i.e. loss of human life, loss or severe damage to environment or equipment etc.). In order to avoid failure on safety critical systems or at least mitigate risks detailed testing is required. Many safety critical systems are developed with sequential phases and tested with test last approach. But test last approach is not sufficient when requirements are unclear or changed. To overcome weaknesses of test last approach we propose test driven approach for safety critical software development, regulated by IEC 61508 standard. A systematic analysis of IEC 61508 software requirements against proposed approach showed that the approach directly supports some objectives and partially supports some of them. Supported objectives are safety requirement identification, simple and testable software design, verification and validation. In general introduced approach suits regulated software development well and this paper outlines these details.

Safety Critical Software Development Methodologies in Avionics

Abstract This article summarizes avionics safety-critical software development methodologies and implications of the DO-178C standard from an Agile application perspective. We explain the safety-critical software categorization. It also outlines the main differences and advantages of different approaches to the development process, from Waterfall through the V-model to Iterative and Incremental. Agile principles are explained as well as a Scrum – which is a popular framework in the non-safety-critical software industry. The application of Agile, for safety-critical software considerations, is based on the practical knowledge of the authors, and looks at the potential solution from a DO-178C standard, size of the project, scalability, and organizational culture points of view. Definition of the Agile type of framework, consistent with the certification process and existing standards, has been highlighted as a potential game-changer for the avionics industry.

Meshing agile and plan-driven development in safety-critical software: a case study

Organizations developing safety-critical software are increasingly seeking to create better practices by meshing agile and plan-driven development processes. Significant differences between the agile and the plan-driven processes make meshing difficult, and very little empirical evidence on using agile processes for safety-critical software development exists. There are four areas of concern, in particular, for meshing the development of safety-critical software concerning: documentation, requirements, life cycle and testing. We report on a case study of a pharmaceutical organization in which a Scrum process was implemented to support agile software development in a plan-driven safety-critical project. The purpose was to answer the following research question: For safety-critical software, what can a software team do to mesh agile and plan-driven processes effectively? The main contribution of the paper is an elaborated understanding of meshing in the four areas of concern and how the conditions for safety-critical software influence them. We discuss how meshing within the four areas of concern is a contribution to existing research.

N-version programming approach with implicit safety guarantee for complex dynamic system stabilization applications

Safety-critical systems are widely used in many sectors to prevent fatal accidents and prevent loss of life, damage of property, or deterioration of the environment. Implementation of software safety standards as part of the development of safety-critical software is generally considered an essential element of any safety program. Therefore, it has become more critical to produce highly reliable software to meet the safety requirements established by functional safety standards, such as IEC 61508, ISO 26262, and EN 50128. IEC 61508 supports well-known safety mechanisms such as design diversity like N-version (multi-version) programming. N-version (multi-version) programming is a method where multiple functionally equivalent programs are independently developed from the same software specifications. N-version (multi-version) programming is particularly an effective approach to increase the quality of software in a safety-critical system. In this paper, one of the well-known and widely used algorithms in the field of N-version (multi-version) programming, the majority voting algorithm, has been modified with an online stability checker where the decisions of the voter are judged against the stability of the underlying system. The plant where all the theoretical results are implemented is a tilt-rotor system with the proposed N-version (multi-version) programming–based controller. The experimental results show that the modified majority voter-based N-version (multi-version) programming controller provides more reliable control of the plant.

Szoftvertervezés

Software development is an extremely complex, and complicated process due to the extraordinary complexity of the products. Considering this testing cannot be complete fully at any level. The desired quality lies in the regulation of the development process and its strict monitoring. Planning is one of the most important steps in this process. Design is always based on a standard and a set of rules in all security-critical cases. It is the DO-178C standard for safety-critical software development that covers the entire software process. This paper deals with the key questions of software development and their main features.

Safety Critical Software Effort Estimation using COCOMO II: A Case Study in Aeronautical Industry

This paper provides a case study of a real aeronautical safety-critical software development project under the DO-178C process, where the COCOMO II method was applied as an estimation technique for the required software development effort. The main goal and contribution of the case study is to support the research on software effort estimation and provide software practitioners with useful data based on a real project. We collected the actual required effort for the project and then compared to the estimated values. The rationales for each scale factor and effort multiplier selection were also described in details. We found a Magnitude of Relative Error (MRE) of 31% and provided alternatives for future work in order to increase the effort estimation accuracy in safety critical software projects.

Using language workbenches and domain-specific languages for safety-critical software development

Language workbenches support the efficient creation, integration, and use of domain-specific languages. Typically, they execute models by code generation to programming language code. This can lead to increased productivity and higher quality. However, in safety-/mission-critical environments, generated code may not be considered trustworthy, because of the lack of trust in the generation mechanisms. This makes it harder to justify the use of language workbenches in such an environment. In this paper, we demonstrate an approach to use such tools in critical environments. We argue that models created with domain-specific languages are easier to validate and that the additional risk resulting from the transformation to code can be mitigated by a suitably designed transformation and verification architecture. We validate the approach with an industrial case study from the healthcare domain. We also discuss the degree to which the approach is appropriate for critical software in space, automotive, and robotics systems.

Safety critical software ground rules

Safety critical software development field is one of the active research areas in many industries like automotive, medical, railways, nuclear and aerospace are placing increased value on safety and reliability. Safety critical software systems are those systems whose failure could result in the death or a serious injury to the people’s life, security is one of the important topics in the field of safety-critical systems and it must be addressed completely in order to operate safety critical software successfully. In this paper we present a study about the set of standards and different ground rules to be followed in critical software development practices in different industries and the challenges in applying these standards. We also discuss the role of static analysis and software integrity levels in these standards, similarities in these standards and the set of activities followed in the development process of these standards.

Safety Critical Software Development: A Modeling Approach

Safety Critical Software Development: A Modeling Approach

Combining Theorem Proving and Model Checking in the Safety-Critical Software Development through Translating Event-B to SMV

Model checking and theorem proving are two key vertification techniques in the formal method, but each has its advantages and disadvantages. In this paper, we first try to present the general model transformation rules from Event-B to SMV in order to realize complementary advantages, and then design the model converter of Event-B to SMV according to the rules. ProB is the only tool to implement Event-B model checking, but it lacks the real-time property verification, while nuXmv is able to verify temporal logic formulas with the real-time property for SMV models. After completing the model transformation, we use ProB and nuXmv to make the verification of LTL and CTL formulas for two equivalent models respectively. Compared to the experimental results, in solving the same problem, nuXmv has more advantages over memory consumption, time efficiency and so on than ProB, especially when the formula to be verified is very complex. Therefore, if complex verifications of system models need to be performed, it is necessary to implement the model transformation between Event-B and SMV by using our translation rules, which is of great significance for the development, design and verification of safety-critical system softwares.

Approach to the development of a Unified Framework for Safety Critical Software Development

Software is increasingly being used to provide functionality in safety critical domains. The complexity involved in the development of software for these domains can bring challenges concerned with safety. International standards are published, providing information on practices which must be implemented in order to satisfy the regulations. This paper details an investigation of the relevant standards that companies need to implement in order to satisfy the regulatory requirements. A literature review was conducted which examines the relevant Quality Management System, Risk Management and Software Development standards across the safety critical domains; and examines the challenges faced by software development organizations with standard and multiple standard implementation. The existing approaches to standards consolidation, integration and harmonization were also examined. To investigate the challenges in implementing these standards, interviews were conducted with a medical device software development company having a Quality Management System in place and beginning to implement the relevant Software Development standards. In addition, an interview was conducted with a consultancy company who has experience in the implementation and maintenance of Quality Management Systems in small and medium enterprises. Following the literature review and interviews conducted, a comparison of the standards was conducted to investigate the similarities and differences in the structure of sections and subsections and to estimate the potential for the further consolidation of these standards. Following the results of the comparisons, a detailed mapping of standard requirements was conducted, mapping requirements of generic and domain specific Quality Management System standards. Future work will focus on the consolidation and integration of standards practices which need to be implemented by companies developing safety critical software and development of Unified Framework that incorporates all necessary requirements to comply with regulatory requirements.

Proceedings on the 1st Workshop on Agile Methods Applied to Development and Certification of Safety-critical Software

The first international workshop on agile methods applied to development and certification of safety-critical software (ASCS) was organized as part of the XP 2015 conference on May 25th 2015. The workshop gathered 17 experts from industry and academia to share recent industrial experience and research on applications of agile methods in the safety critical software domain. The workshop was organized as a series of talks and discussions to share experience and ideas. The workshop audience also provided guidelines for future research needed to advance the field.

Notes On Agile and Safety-Critical Development

Agile approaches have been highly influential to the software engineering practices in many organizations, and are increasingly being applied in larger companies, and for developing systems outside the pure software domain. To understand more about the current state of agile, its applications to safety-critical systems, and the consequences on innovation and large organizations, a seminar was organized in Stockholm in 2014. This paper gives an overview of the topics discussed at that seminar, a summary of the main results and suggestions for future work as input to a research agenda for agile development of safety-critical software.

From Place/Transition Petri nets to B abstract machines for safety critical systems

Fulfilling the safety requirements is one of the most serious and problematic issues in critical systems design and safety critical software development. In this context, thanks to their analysis power, formal methods have been widely used in the various stages of the design and the implementation of safety critical systems. However, some methods such as the B method, although well adapted to safety issues, are still poorly used in large scale industrial environment. The purpose of this paper is to present a methodology of Place/Transition Petri nets transformation into B abstract machines enabling an interesting combination of the graphical modeling power of Petri nets and the verification tools of the B method. In fact, translating a Petri net to a B abstract machine can have many advantages such as the generation of code, the integration of safety invariants or the aggregation with other formal models. Therefore, the B verification will enlarge the scope of its applicability by having a new modeling alternative and passing through model transformation. An illustrative example of the transformation is presented for a railway study case.