Introduction to Sassur 2012

Safety assurance and certification are amongst the most expensive and time-consuming activities in the development of safety-critical systems. Deeming a system to be safe involves gathering convincing evidence to argue the safe operation of the system, usually according to the requirements of some safety standard. To handle large collections of safety evidence effectively, practitioners need knowledge of how to classify different types of evidence, how to structure the evidence to show fulfilment of standards' requirements, and how to assess the evidence. However, the notion of evidence is vague and safety standards' requirements can be ambiguous and difficult to understand. Major problems also arise when a system evolves, as the body of safety evidence has to be adequately maintained in order to ensure system safety and allow its demonstration. In this context, this PhD aims to propose a framework for safety evidence management in evolutionary scenarios. The thesis work will concentrate on devising a model-based and customizable infrastructure for storage, manipulation, reuse, and analysis of evolving safety evidence. The infrastructure will be developed and evaluated in the scope of OPENCOSS a large-scale European research project.

Safety assurance and certification are amongst the most expensive and time-consuming tasks in the development of safety-critical systems. Demonstration of compliance with safety standards involves providing evidence that the standards' safety criteria are met. To handle large collections of evidence effectively, safety professionals need knowledge of how to classify different types of evidence, how to structure the evidence, and how to assess it. This paper takes a step towards developing such a body of knowledge by conducting a Systematic Literature Review (SLR). Specifically, the SLR identifies and classifies the information and artefacts considered as evidence for safety, examines existing techniques for evidence structuring and assessment, and summarizes the challenges noted in the literature in relation to safety evidence. The paper, to our knowledge, is the first systematic review on the topic of safety evidence. The results we present are particularly relevant to practitioners seeking to better understand the evidence requirements for safety certification, as well as to researchers conducting research in this area.

Multi-core devices are envisioned to support the development of next-generation safety-critical systems, enabling the on-chip integration of functions of different criticality. This integration provides multiple system-level potential benefits such as cost, size, power, and weight reduction. However, safety certification becomes a challenge and several fundamental safety technical requirements must be addressed, such as temporal and spatial independence, reliability, and diagnostic coverage. This survey provides a categorization and overview at different device abstraction levels (nanoscale, component, and device) of selected key research contributions that support the compliance with these fundamental safety requirements.

This book is a practical guide for the development and qualification of safety-critical systems, standards compliance, and use of formal methods and tools.

Cyber-Physical Systems (CPS) harbor the enormous potential for societal improvement in terms of safety, comfort and economic efficiency. However, these benefits will only be unlocked if the safety of these systems can be assured with a sufficient level of confidence. Traditional safety engineering and assurance approaches alone cannot address the CPS-inherent uncertainties and unknowns induced by openness and adaptivity. Runtime safety assurance approaches such as Conditional Safety Certificates (ConSerts) represent novel means to cope with CPS assurance challenges by introducing modular and formalized safety arguments with variant support, thereby shifting the final safety certification step to runtime. However, the systematic engineering of ConSerts at design-time is a complex task which, up to now, has not been sufficiently addressed. Without systematic safety assurance at both design-time and runtime, CPS will hardly be assurable with acceptable confidence given the uncertainties and unknowns. In this paper, we present an engineering method for synthesizing ConSerts based on Digital Dependability Identities (DDI). The approach is demonstrated for a cooperative vehicle platooning function (CACC) from an industrial case study.

Basically, aircraft engines can be divided into a control embedded system and a controlled system with its environment. The behaviour of the controlled system is given a priori, while the control system still needs to be designed in a way guaranteeing the correct overall behaviour under all operational conditions depending on the flight domain. A large quantity of functions in control systems can be described by a formal system expressed in block diagrams and state-based representations. These representations can be translated to formal based tools relying on the synchronous languages Signal and Statecharts. SACRES is a tool set supporting the design of safety-critical embedded control systems. It integrates the tools and specification techniques Statemate, Sildex, and Timing Diagrams with tool components for automatic code generation, formal verification based on model checking techniques, and an innovative approach for automatic code validation for target code generated from DC+. Technical achievements are The main benefits of the SACRES approach are reduced risks for design errors and decreased design times and costs for the development of dependable (safety critical) embedded systems. SACRES is an attempt to avoid unpredictability (particularly that arising from late feedback from testing) associated with development of safety critical systems, through the use of the maximum degree of automation, especially in respect of code generation and verification. An outstanding property of SACRES is the combination of specification styles and specification tools being applied in practice with automatic tools to establish provable correctness with respect to required properties. Both dependability and productivity are increased by automatic code generation from high-level specifications such that the generated code can be validated against higher levels by rigorous proofs. These techniques allow traditional tests by sampling to be replaced by rigorous checking techniques which correspond to 100% coverage of test cases. In order to address a global innovative approach in the near future which match the whole software configuration, the SACRES tool set should be interfaced with asynchronous techniques matching the operating system development. This raises an open question in the software development future new process.

This paper provides a novel method of identifying a set of design faults in Simulink\TargetLink models and production code generation well before generating the test cases. These models can be used for development of safety critical systems. We have developed stand-alone application which transforms TargetLink model to EA compatible UML (Unified Modeling Language) model represented as packages and composite structure diagrams. The entire process makes use of dSPACE and MathWorks tools.

The presentation provides a high level overview of the safety assurance activities undertaken for, and the issues arising from, the introduction of the Alstom Smartlock 400 interlocking into the UK to its current status in revenue service, following a successful period of pilot running. The presentation provides a brief introduction to the concept and a system overview of the Alstom Smartlock 400 interlocking system. The presentation follows the safety assurance process from the development and assurance of the individual sub-systems to their integration into the overall Smartlock 400 System. The issues associated with the application of ISAs for the sub-systems and system to the release of the UK generic application safety cases are explored and summarised as lessons learnt. The case study finishes by briefly reviewing some of the ongoing issues that a modern high integrity product like Smartlock 400 will be subject to, in order to maintain its approved safety assurance status. (31 pages)

Software engineering has devised several project management metrics to optimize implementation and obtain a product with high efficiency, at less time and cost. Inventors faced many challenges to find measurements that able to anticipate accurate results that help avoid errors and risks in the advanced stages of the project. The systems most affected by any errors during the development process are Safety-Critical systems (SCS), as 60% of failures during operation are due to errors during development. This paper proposes a metric that uses weight and milestones to predict implementation in advanced stages of a project. The proposed metric is called Weighted Test Metric (WTM). WTM enhance the reliability assessment and reduce failures during project development by predicting Standards Achievement (SA) in the next test. WTM results showed that faults can be reduced during the development of a petroleum drilling project to 0.67% and enhance the overall reliability to 99.16% while actual results (98.30%). This paper focuses on “How to enhance reliability assessment and reduce failures during project development activities?”. This research raises the question through the application of WTM in the stages of development of the Petroleum Drilling Project.KeywordsSafety-Critical System (SCS)Safety-Critical System Development (SCSD)Area: software project management metricsDevelopment metrics

Many real-time systems are also safety-critical, that is they are used in applications where their inappropriate behaviour, or failure, could lead to loss of life, or severe environmental damage. Examples include the flying control systems for aircraftl, reactor protection systems, and anti-lock braking systems for cars. The primary difference between the development of non-critical real-time systems and safety-critical real-time systems is that we are concerned with failures, both of the computer system and the wider system in which it is embedded. Our discussion will focus on the issue of identifying failure modes and showing that safety requirements are met, despite the fact that failures can occur.

Metrics design for safety assessment

Context. Development of safety-critical systems is mostly governed by process-heavy paradigms, while increasing demands on flexibility and agility also reach this domain. Objectives. We wanted to explore in more detail the industrial needs and challenges when facing this trend. Method. We launched a qualitative survey, interviewing engineers from four companies in four different industry domains. Results. The survey identifies human factors (skills, experience, and attitudes) being key in safety-critical systems development, as well as good documentation. Certification cost is related to change frequency, which is limiting flexibility. Component reuse and iterative processes were found to increase adaptability to changing customer needs. Conclusions. We conclude that agile development and flexibility may co-exist with safety-critical software development, although there are specific challenges to address.

In recent years, the UK Health and Safety Executive, the Institution of Electrical Engineers and the British Computer Society have collaborated in the management of a project to produce a set of competencies for engineers working in the sensitive area of safety-critical or safety-related systems. The resulting document owed much to the existence of the international standard IEC 61508. The development of competency descriptors for those involved in the design and development of safety-critical systems has led to some consideration of the properties of these competencies and to principles that may be applied in a more general setting. This article aims to capture these thoughts.

In the United Kingdom, there are more than 9000 reports of adverse events involving medical devices annually. The regulatory processes in Europe and in the United States have been challenged as to their ability to protect patients effectively from unreasonable risk and harm. Two of the major shortcomings of current practice include the lack of transparency in the safety certification process and the lack of involvement of service providers. We reviewed recent international standardisation activities in this area, and we reviewed regulatory practices in other safety-critical industries. The review showed that the use of safety cases is an accepted practice in UK safety-critical industries, but at present, there is little awareness of this concept in health care. Safety cases have the potential to provide greater transparency and confidence in safety certification and to act as a communication tool between manufacturers, service providers, regulators and patients.

Software Product Line Engineering (SPLE) has been proven to reduce development and maintenance costs, improving the time-to-market, and increasing the quality of product variants developed from a product family via systematic reuse of its core assets. SPLE has been successfully used in the development of safety-critical systems, especially in automotive and aerospace domains. Safety-critical systems have to be developed according to safety standards, which demands safety analysis, Fault Tree Analysis (FTA), and assurance cases safety engineering artefacts. However, performing safety analysis, FTA, and assurance case construction activities from scratch and manually for each product variant is time-consuming and error-prone, whereas variability in safety engineering artefacts can be automatically managed with the support of variant management techniques. As safety is context-dependent, context and design variation directly impact in the safety properties changing hazards, their causes, the risks posed by these hazards to system safety, risk mitigation measures, and FTA results. Therefore, managing variability in safety artefacts from different levels of abstraction increases the complexity of the variability model, even with the support of variant management techniques. To achieve an effective balance between benefits and complexity in adopting an SPLE approach for safety-critical systems it is necessary to distinguish between reusable safety artefacts, whose variability should be managed, and those that should be generated from the reused safety artefacts. On the other hand, both industry and safety standards have recognized the use of model-based techniques to support safety analysis and assurance cases. Compositional safety analysis, design optimization, and model-based assurance cases are examples of techniques that have been used to support the generation of safety artefacts required to achieve safety certification. This thesis aims to propose a model-based approach that integrates modelbased development, compositional safety analysis, and variant management techniques to support the systematic reuse and generation of safety artefacts in safety-critical software product line engineering. The approach contributes to reduce the effort and costs of performing safety analysis and assessment for a particular product variant, since such analysis is performed from the reused safety artefacts. Thus, variant-specific fault trees, Failure Modes and Effects Analysis (FMEA), and assurance case artefacts required to achieve safety certification can be automatically generated with the support the model-based safety analysis and assurance case construction techniques.