Requirements Of Safety-critical Systems Research Articles

Family-Based and Product-Based Development of Correct-by-Construction Software Product Lines

Software product lines provide systematic software reuse to implement whole product families efficiently. Therefore, they are increasingly used to handle the growing demand of custom-tailored software variants including safety-critical systems as a domain of application. The requirements for safety-critical systems are generally higher and often demand for behavioral correctness to reduce the risk of dangerous situations in-field. However, the high variability of software product lines is still a big challenge for formal methods in general. We argue that the stepwise development approach correctness-by-construction is beneficial compared to post-hoc verification approaches in dealing with the growing variability. Correctness-by-construction uses a set of refinement rules to incrementally create a correct program from a formal specification. In previous work, we already introduced variational correctness-by-construction to develop correct-by-construction software product lines in a product-based way. In this article, we extend our approach in three directions. First, we propose a feature-based specification technique matching the fine-grained specifications of correctness-by-construction. Second, we propose a family-based development approach to show the correctness of the product line as an alternative to the previous product-based approach. Third, we present our usability-improved tool VarCorC implementing our approach. In the evaluation, we compare the product-based development approach to the family-based approach using two case studies implemented with VarCorC.

Formally verifying consistency of sequence diagrams for safety critical systems

• Automated transformation from sequence diagrams to Clock Constraint Specification Language constraints. • SMT based consistency verification. • Clock graph based consistency verification. UML interactions, aka sequence diagrams, are frequently used by engineers to describe expected scenarios of good or bad behaviors of systems under design, as they provide allegedly a simple enough syntax to express a quite large variety of behaviors. This paper uses them to express safety requirements for safety critical systems in an incremental way, where the scenarios are progressively refined after checking the consistency of the requirements. The semantics of these scenarios are expressed by transforming them into an intermediate semantic model amenable to formal verification. In this paper, we rely on the Clock Constraint Specification Language (CCSL) as the intermediate semantic language. In some sense, sequence diagrams and CCSL constraints both express a family of acceptable infinite traces that must include the behaviors given by the finite set of finite execution traces against which we validate. We compare these requirements to actual execution traces to prove the validity of our transformation. As to check the consistency of the sequence diagrams, we present two verification methods based on SMT and clock graphs respectively. The SMT based method relies on our analysis tool called MyCCSL to analyze CCSL constraints. The clock graph based method transforms CCSL constraints into a clock graph, and does the analysis through traversing the clock graph. Finally, these two methods are evaluated against real cases from the railway transit systems. The results show that the SMT based method provides accurate but slow analysis, while the clock graph based method dramatically increases the verification efficiency aiming at two kinds of typical inconsistencies found by the SMT based method.

Job-shifting: An algorithm for online admission of non-preemptive aperiodic tasks in safety critical systems

Abstract Modern safety critical systems require certification in order to guarantee correct operation before system deployment. The certification process requires rigorous verification and validation, the efforts for which can be greatly reduced by using resource partitioning. However, Lackorzynski et al. demonstrated that bandwidth reservation for event-triggered (ET) activities in partitioned systems may lead to significant bandwidth loss. In contrast, the online admission of ET activities can prevent bandwidth losses. However, the state-of-the-art approaches for online admission of ET activities fail to fulfill the requirements of safety critical systems as they do not support (i) partitioning, (ii) the industrial mixed-criticality task model or (iii) non-preemptive task execution. In this paper, we present job-shifting algorithm for online admission of non-preemptive aperiodic tasks in partitioned time-triggered environment. Our approach circumvents the bandwidth loss issue with partitioning, and provides guarantees similar to the bandwidth reservation technique such that the certification process of safety critical systems need not be modified. Our approach can be implemented on top of variety of hypervisors and can provide lower response-times for aperiodic tasks. Through evaluation, we demonstrate that our approach efficiently utilizes processor bandwidth and only incurs small scheduling overheads.

U2Z Framework for Improving the Readability of Requirements of Safety Critical Systems

U2Z Framework for Improving the Readability of Requirements of Safety Critical Systems