DO-178B Level Research Articles

Industrial experience with SPARK

This paper considers a number of large, real-world projects that are using SPARK---an annotated sublauguage of Ada that is appropriate for the development of high-integrity systems. Three projects are considered in some detail where SPARK has made a contribution to meeting the most stringent software engineering standards. The projects are the Ship/Helicopter Operational Limits Instrumentation System (UK Interim Defence Standard 00-55), the MULTOS CA (a high-security system developed to the standards of ITSEC level E6), and the Lockheed C130J Mission Computer (DO-178B Level A). A less successful project is also described. The lessons learnt from these projects show that SPARK offers a cost-effective approach for the construction of high-integrity software when it is deployed judiciously within an appropriate software development process.

Independent validation and verification of the TCAS II collision avoidance subsystem

This paper describes the specification-based testing, analysis tools, and associated processes used to independently validate, verify, and ultimately, provide for certifying safety-critical software developed for the Traffic Alert and Collision Avoidance System (TCAS II) program. These tools and processes comprise an effective and Independent Validation and Verification (IV and V) activity applied to the Collision Avoidance Subsystem (GAS) software development process. A requirements specification language called the Requirements State Machine Language (RSML), originally developed by the University of California, Irvine (UCI), was employed for the specification of GAS. The end result is the next generation of TCAS II collision avoidance logic, referred to as Version 7, that is of a higher quality than its predecessors, meets the certification requirements of DO-178B Level B (Ref. 1), and can be shown to satisfy the new operational requirements it was developed to address.

The Ravenscar Tasking Profile—experience reporting

The Ravenscar Profile was defined at the 18 th International Real-Time Ada Workshop as a simple subset of the tasking features of Ada, in order to support efficient, high integrity applications that need to be analysed for their timing properties. Ada compiler vendor Aonix subsequently implemented the Profile via its Raven product line, and is currently engaged in producing the formal certification material for qualifying the runtime system to the most stringent set of guidelines --- DO-178B Level A. This paper describes some of the experiences in implementing and qualifying the Profile, and some early indications from the user community of its value to address the application domains that it was intended for.

Achieving high integrity at low cost: a constructive approach

The paper presents a development process, delivering high-quality software at exceptionally low cost, and its application to the mission computer software for the new Lockheed C-130J (Hercules) aircraft. For this safety-critical application, the software process requirements were: • a rigorously verified, error-free end product, right first time, • modularity, portability, ease of functional modification and extension of software components, essential for an aircraft with a long life, • rapid, low-cost development. These aims were met by investing in “correctness by construction”: • integration of the US Software Productivity Consortium's CoRE requirements expression method, the graphical Domain-Specific Design Language (DSDL), and multi-level design in Ada to strict rules, enforced by templates and mechanical checks, • use of SPARK Ada, allowing mechanical code verification against CoRE specifications. Large savings in V & V were achieved, through: • reduced cost of testing to DO-178B Level A requirements, and • mechanisation of semantic analysis (as required by MoD).