A Comprehensive Safety Engineering Approach for Software-Intensive Systems Based on STPA

Ensuring safety-critical software safety requires strict verification of the conformance between safety requirements and programs. Formal verification techniques, such as model checking and theorem proving, can be used to partially realize this objective. DO-178C, a standard for airborne systems, allows formal verification techniques to replace certain forms of testing. My research is concerned with applying model checking to verify the conformance between safety requirements and programs. First, a formal language for specifying software safety requirements which are relevant to event sequences is introduced. Second, the traceability information models between formalized safety requirements and programs are built. Third, the checking of a program against a safety requirement is decomposed into smaller model checking problems by utilizing traceability information model between them.

Software safety requirements elicitation is a key element of a successful software safety process and the underpinnings of the following software safety work. Though there are many relevant standards, we still could not elicit software safety requirements sufficiently in actual aeronautic projects, because the approaches mentioned are unpractical due to our weak foundation in this area. This article suggests a practical method for software safety requirements elicitation based on the work done by NASA to solve this problem. In this research work, software safety requirements elicitation method consists of generic requirements tailoring and specific software safety requirements developing. The generic safety requirements tailoring process and F-F method that is used to develop specific safety requirements are mainly introduced in this paper. At last, we illustrate the practicability of this method with an application in aircraft de-icing system monitor software.

Electronic checklist is the key guidance document that the crew of the flight can rely on, which plays an important role in the safe flight. Therefore, the safety analysis and the capture and verification of safety requirements of the electronic checklist system is very important. Traditional safety analysis methods pay less attention to the interaction between the electronic checklist system and the external environment, failing to capture the safety requirements that arise in the interaction, and there is no strict verification of safety requirements of the electronic checklist system. To this end, this paper combines the system theoretic process analysis and the lightweight formalization method, and analysis the safety of electronic checklist system and validates the safety requirement. Firstly, analyzing the risk of the electronic checklist system. Then according to the principle of the implementation of the electronic checklist, constructing the control structure of the electronic checklist system, and identifying the unsafe control behavior of each control loop which could lead to the a hazardous state, then obtaining the safety requirements, and determining how each potential hazardous control action could occur. Finally, we use the lightweight formalization method to formalize the safety requirements and use tools to automatically verify the safety requirements.

A systematic co-engineering of safety and security analysis in requirements engineering process

Safety requirements describe risk mitigations against failures that may cause catastrophic consequences on human life, environment and facilities. To be able to implement the correct risk mitigations, it is fundamental that safety requirements are defined based on the results issued from the safety analysis. In this paper, we introduce a heuristic approach to elicit safety requirements based on the knowledge about hazard's causes, hazard's sources and hazard's consequences (i.e. hazard's components) acquired during the safety analysis. The proposed approach is based on a Hazard Ontology that is used to structure the knowledge about the hazards identified during the safety analysis in order to make it available and accessible for requirements elicitation. We describe how this information can be used to elicit safety requirements, and provide a guidance to derive the safety requirements which are appropriate to deal with the hazards they mitigate.

This article presents a systematic mapping study on the model‐driven engineering of safety and security concerns in software systems. Combined modeling and development of both safety and security concerns is an emerging field of research as both concerns affect one another in unique ways. Our mapping study provides an overview of the current state of the art in this field. This study carefully selected 143 publications out of 27,259 relevant papers through a rigorous and systematic process. This study then proposes and answers questions such as frequently used methods and tools and development stages where these concerns are typically investigated in application domains. Additionally, we identify the community's preference for publication venues and trends. The discussion on obtained results also features the gained insights and future research directions.

Safety critical systems are becoming more complex, both in the type of functionality they provide and in the way they are demanded to interact with their environment. Such growing complexity requires an adequate increase in the capability of safety engineers to assess system safety, including analyzing the bahaviour of a system in degraded situations. Formal verification techniques, like symbolic model checking, have the potential of dealing with such a complexity and are more often being used during system design. In this paper we present the FSAP/NuSMV-SA platform, based on the NuSMV2 model checker, that implements known and novel techniques to help safety engineers perform safety analysis. The main functionalities of FSAP/NuSMV-SA include: failure mode definition based on a library of failure modes, fault injection, automatic fault tree construction for monotonic and non-monotonic systems, failure ordering analysis. The goal is to provide an environment that can be used both by design engineers to formally verify a system and by safety engineers to automate certain phases of safety assessment. The platform is being developed within the ESACS project (Enhanced Safety Analysis for Complex Systems), an European-Union-sponsored project in the avionics sector, whose goal is to define a methodology to improve the safety analysis practice for complex systems development.

Software and System Product Lines (SSPL) are the state-of-the-art for systematically reusing a common set of core assets in the development of similar products in a product family. A large number of SSPL success stories have been published in the last decade and commercial tool support is also available. SSPLs promise to reduce cost, to shorten time-to-market for new features, and to increase product quality by systematically reusing core assets in the development of three or more systems. However, an open challenge is SSPL engineering for safety-relevant systems such as automotive, avionic, or industrial automation systems. Safety-relevant systems have to be developed, analyzed, and certified according to safety standards such as IEC 61508. These standards demand the application of safety analyses such as Fault Tree Analysis and Failure Mode and Effect Analysis. Starting the safety analysis of each product variant of a SSPL from scratch is complex and very time-consuming. However, there are only few convincing cases, where SSPL approaches have been followed in safety engineering. To pave the way for a broader adoption of SSPL approaches, this paper reports practical experiences with industrial-strength methods and tools along an adaptive cruise control SSPL. The paper demonstrates how commercial tools can be used (i) to analyze safety-related aspects already in the architectural design, (ii) to model the results as component integrated component fault trees (C2FT), and (iii) to systematically reuse C2FT in the safety analysis of a concrete product. The results of the case study show that C2FT (i) can be easily integrated into a feature-oriented development process of SSPL, (ii) facilitate early consideration of safety in domain engineering, and (iii) reduce effort and complexity of safety analyses in application engineering.

Improper and incorrect safety requirements specification can lead to severe accidents. The proper application of safety risk assessment techniques (SRATs) helps the safety and requirements engineers identify and assess the hazards and risks that may occur in the safety-related software systems. Thus, by integrating appropriate SRATs into the requirements elicitation activity, a more complete and correct set of software safety requirements can be elicited. This research proposes a framework and develops a web-based system that facilitates the integration of safety activities and techniques into requirements elicitation process. The web-based system is evaluated by a group of software engineers and postgraduate students. The evaluation results show that the web-based system provides a more comprehensible and effective way to integrate safety risk assessment techniques and activities into requirements elicitation, compared to the ad hoc integration performed by the development teams.

Communication channels in safety analysis: An industrial exploratory case study

Verification of safety requirements is one important task during the development of safety critical systems. The increasing complexity of systems makes manual analysis almost impossible. This paper introduces a new methodology for formal verification of technical systems with smartIflow (State Machines for Automation of Reliability-related Tasks using Information FLOWs). smartIflow is a new modeling language that has been especially designed for the purpose of automating the safety analysis process in early product life cycle stages. It builds up on experience with existing approaches. As is common practice in current approaches, components are modeled as finite state machines. However, new concepts are introduced to describe component interactions. Events play a major role for internal interactions between components as well as for external (user) interactions. Our approach to the verification of formally specified safety requirements is a two-step method. First, an exhaustive simulation creates knowledge about a great variety of possible behaviors of the system, especially including reactions on suddenly occurring (possibly intermittent) faults. In the second step, safety requirements specified in CTL (Computation Tree Logic) are verified using model checking techniques, and counterexamples are generated if these are not satisfied. The practical applicability of this approach is demonstrated based on a Java implementation using a simple Two-Tank-Pump-Consumer system.

Various well-established techniques exist for functional safety analysis of safety-critical avionics systems. Most of these techniques are based on informal models and due to this, analysis is often subjective and success is dependent on the skill of the practitioner. Various standards like DO-178B, IEC 61508 etc. that provide guidelines to perform safety analysis also propose formal verification methods as one of the techniques for functional safety analysis. This technique is based on formal models of the system under development and can be applied on requirements, design and code to get assurance of the respective artifact satisfying a wide variety of functional requirements. In this paper, we present a case study of applying formal verification methods for doing safety analysis of requirements of a generic aircraft flight control system. Flight control system is broadly specified in two parts: mode transition logic part specifies which mode the system is in and represents the function performed by the flight control system. In each mode, certain control laws are executed to implement the various flight control functions. We used a particular technique in formal verification namely that of model checking for analysis. The mode transition logic of a generic auto pilot was modeled and verified using three different open source model checking tools-SPIN, NuSMV and SAL.

The subject: This study focuses on improving the quality of Cyber-Physical System (CPS) software by eliminating incorrect usage of units of measurement and orientation in C/C++ programs. Incorrect usage often leads to critical errors that conventional systems cannot effectively prevent. Manual examination of code using dimensional and orientation analysis can detect these errors in physical equations, but these methods become impractical when dealing with complex physical computations. Objectives: As suggested by Siano, the proposed approach uses physical quantities and prefixes defined by the International System of Units and orientation operations on physical objects. The elaborated system incorporates dimensional and orientation analysis and metaprogramming techniques. The methods used are dimensional & orientational analysis and metaprogramming. The following results were obtained: ensuring consistency of the units, incorporating orientation operations into the programming model for accurately handling physical object rotations and alignments, and using Siano’s work to precisely manipulate object orientation, thereby reducing the likelihood of orientation-related errors. Checking physical dimensions and orientations during the compilation stage identifies potential software defects before code execution, thereby reducing debugging time and lowering the cost of addressing issues later in development. The elaborated system represents a crucial step towards safer and more dependable Cyber-Physical System applications. This approach allows us to identify approximately 90% of incorrect usage of program variables; additionally, it detects over 50% of erroneous operations during compilation and execution of large-scale programs in real-world conditions. Conclusions. Scientific novelty: it proposed and developed a specialized C++-type library for formal compile-time software verification of Cyber-Physical Systems software. The proposed C++-type library leverages dimensional and orientational analysis to enhance software quality, reliability, and real-time formal verification. Although the proposed method for formal verification is not tailor-made for cyber-physical objects and systems, given its primary focus on software-level concerns, it does exhibit adaptability for verifying general-purpose software that incorporates various physical parameters. This versatility extends to diverse domains such as educational, gaming, and simulation software.

Two salient issues in software engineering are the proper relationships of requirements to design and implementation and of formal to non-formal development techniques. Both of these issues are prominent in the development of software for cyber-physical systems—that is, for systems whose explicit purpose is to ensure desired effects and behaviours in the physical world. In such systems the software monitors and controls those parts of the world in which the desired effects and behaviours are located: the system behaviour is the result of this interaction between the machine and the problem world. In this paper these salient issues are addressed using the Problem Frames approach. Requirements are understood as desired properties of the system behaviour: design of the structure and content of that behaviour is the central development task. The relationship between formal and non-formal techniques is one of dependence: pre-formal development activities must precede the deployment of full formalisation and formal verification. These pre-formal activities embody the exploration, investigation and design that are an essential preliminary to formal work. They clarify the structure of system behaviour as an assemblage of constituent behaviours, separating the identification and study of those behaviours from the careful treatment of their interactions. In this way formal reasoning is accorded its proper role and an intellectual structure established within which it can play its due part in the development of dependable systems.

“The offshore installations and wells (design and construction, etc.) regulations” (DCR) requires that all safety‐critical elements in both the system and software domains be assessed and evaluated. In this paper, following a brief review of offshore system (application) safety analysis, offshore software safety analysis is introduced. It is followed by a study of combining offshore system safety analysis with software safety analysis. The typical standards for the development of safety‐critical systems in several industrial sectors are discussed with particular reference to formal methods. A generic offshore software safety analysis framework is proposed with discussions. Formal methods for producing safety requirements specifications are then discussed. A case study is used to demonstrate safety requirements modelling for safety‐critical software development. Finally recommendations for further development in offshore software safety analysis are given.