Safety-Critical Software [Guest editors' introduction

There is an increased use of software in safety-critical systems; a trend that is likely to continue in the future. Although traditional system safety techniques are applicable to software intensive systems, there are new challenges emerging. In this report we will address four issues we believe will pose challenges in the future. First, the nature of safety is continuing to be widely misunderstood and known system safety techniques are not applied. Second, our ability to demonstrate (certify) that safety requirements have been met is inadequate. Third, modeling and automated tools, for example, code generation and automated testing, are introduced in a hope to increase productivity; this reliance on tools rather than people, however, introduces new and poorly understood problems. Finally, safety-critical systems are increasingly relying on data (configuration data or databases), incorrect data could have catastrophic and widespread consequences.

Increased use of software in safety-critical systems has created the need to adequately validate the design and implementation of these systems. Current practice depends on extensive testing which is limited in terms of effectiveness and is very costly. Formal methods have been difficult to apply to the wide range of system architectures and have seldom addressed the system's dynamic characteristics and behaviour in the presence of faults. Recent developments in formalization of software architecture, definition of safe-set run-time standards and the availability of modeling and analytical tools, make it possible to formally model practical applications that are constrained by well-defined architectures and run-time environments. In particular, the Dynamic Flowgraph Methodology (DFM), developed to model safety-related behaviours of nuclear reactor and aerospace control systems, is especially promising when applied to properly constrained environments. Toolsets to model the architecture and the worst-case schedulability of tasking provide supporting methods. System safety analysis methodologies such as DFM, used in concert with these other developments, provide increased confidence in the validation of safety-critical, software intensive systems. Tools which are available to support DFM, are a graphic model editor with an integrated database and an analysis engine. Schedulability analysis is supported by a Rate Monotonic Analysis (RMA) toolset and a safe-set architecture has been implemented by an Ada run-time environment conforming to the Ada standard.

Issues in developing software for safety critical systems

Software engineering has devised several project management metrics to optimize implementation and obtain a product with high efficiency, at less time and cost. Inventors faced many challenges to find measurements that able to anticipate accurate results that help avoid errors and risks in the advanced stages of the project. The systems most affected by any errors during the development process are Safety-Critical systems (SCS), as 60% of failures during operation are due to errors during development. This paper proposes a metric that uses weight and milestones to predict implementation in advanced stages of a project. The proposed metric is called Weighted Test Metric (WTM). WTM enhance the reliability assessment and reduce failures during project development by predicting Standards Achievement (SA) in the next test. WTM results showed that faults can be reduced during the development of a petroleum drilling project to 0.67% and enhance the overall reliability to 99.16% while actual results (98.30%). This paper focuses on “How to enhance reliability assessment and reduce failures during project development activities?”. This research raises the question through the application of WTM in the stages of development of the Petroleum Drilling Project.KeywordsSafety-Critical System (SCS)Safety-Critical System Development (SCSD)Area: software project management metricsDevelopment metrics

Validation and Verification are necessary in the life cycle of any safety-critical software system. It answers the question of “are we building the right product?” It's very important to be able to decide if its outputs are correct and system meets specifications, failing to do so can result in loss of human lives or huge financial loss. V&V process and its planning must start early in SDLC (Software Development Life Cycle). Both aspects are essential, If specifications are met that doesn't mean it's correct and vice versa. There are different V&V techniques available for different stages of the SDLC. In this paper I will analyze different V&V techniques available for critical software systems and will conduct a survey, which will produce results showing which techniques are best for safety-critical software systems.

Evidence-Based Software Engineering (EBSE) focuses on understanding and delivering software engineering practices, tools and techniques that qualitatively and quantitatively provide value. The principles of EBSE underpin safety critical software engineering practices: when we build a safety critical software system, we must, in parallel, deliver evidence that the steps we have taken and the artefacts that we build will lead to an acceptably safe system. In safety critical software engineering, traceability plays a vital role. This talk will explore some of the different applications and uses of traceability in this context, and will suggest ways in which Model-Driven Engineering can provide solutions (e.g., through standardised approaches for describing safety arguments and evidence), as well as new challenges.

This book is a practical guide for the development and qualification of safety-critical systems, standards compliance, and use of formal methods and tools.

The failure of such systems leads to the catastrophic effects, including injury or death to humans, and harm to the environment. Petri nets (PNs) have been widely used for verification and validation of real-time systems. However, the existing approaches do not consider the critical aspects of reliability and safety that include nonliveness, deadlock, stability, and throughput. In this paper, we introduce these as metrics of reliability and safety for safety critical real-time systems. This paper also proposes an innovative methodology for analysis of nonliveness, deadlock, stability, and throughput metrics by linear programming using PN modeling. The application of the proposed techniques has been validated by applying it on four different safety critical systems, running in six nuclear power plants and shown for reactor protection system.

Two factors influencing the design and development of avionics software are: (1) the cost of verification, validation and certification; (2) migration of avionics functionality from hardware to software, to decrease the weight and power consumption of the avionics. These two factors are inherently at odds. Lowering the development costs of engineering software for safety critical systems, while providing the abstractions necessary to build systems of ever increasing complexity, is key to achieving these two goals. Middleware seems to be the ideal vehicle to reach these goals. Middleware is used to isolate the core application from the underlying distributed system and is constructed using object-oriented techniques. This has the benefit of increasing software reuse and minimizing the code that is verified to various safety criticality levels when the underlying system microprocessor and network are changed. The middleware that meets the criteria placed on safety critical software is faced with many challenges.

Ontario Hydro has had experience in designing and qualifying safety critical software used in the reactor shutdown systems of its nuclear generating stations. During software design, an analysis of system level hazards and potential hardware failure effects provide input to determining what safeguards will be needed. One form of safeguard, called software self checks, continually monitor the health of the computer on line. The design of self checks usually is a trade off between the amount of computing resources required, the software complexity, and the level of safeguarding provided. As part of the software verification activity, a software hazards analysis is performed, which identifies any failure modes that could lead to the software causing an unsafe state, and which recommends changes to mitigate that potential. These recommendations may involve a re-structuring of the software to be more resistant to failure, or the introduction of other safeguarding measures. This paper discusses how Ontario Hydro has implemented these aspects of software design and verification into safety critical software used in reactor shutdown systems. >

Context. Development of safety-critical systems is mostly governed by process-heavy paradigms, while increasing demands on flexibility and agility also reach this domain. Objectives. We wanted to explore in more detail the industrial needs and challenges when facing this trend. Method. We launched a qualitative survey, interviewing engineers from four companies in four different industry domains. Results. The survey identifies human factors (skills, experience, and attitudes) being key in safety-critical systems development, as well as good documentation. Certification cost is related to change frequency, which is limiting flexibility. Component reuse and iterative processes were found to increase adaptability to changing customer needs. Conclusions. We conclude that agile development and flexibility may co-exist with safety-critical software development, although there are specific challenges to address.

It is difficult to demonstrate that safety-critical software is completely free of dangerous faults. Prior testing can be used to demonstrate that the unsafe failure rate is below some bound, but in practice, the bound is not low enough to demonstrate the level of safety performance required for critical software-based systems like avionics. This paper argues higher levels of safety performance can be claimed by taking account of: 1) external mitigation to prevent an accident: 2) the fact that software is corrected once failures are detected in operation. A model based on these concepts is developed to derive an upper bound on the number of expected failures and accidents under different assumptions about fault fixing, diagnosis, repair and accident mitigation. A numerical example is used to illustrate the approach. The implications and potential applications of the theory are discussed.

Basically, aircraft engines can be divided into a control embedded system and a controlled system with its environment. The behaviour of the controlled system is given a priori, while the control system still needs to be designed in a way guaranteeing the correct overall behaviour under all operational conditions depending on the flight domain. A large quantity of functions in control systems can be described by a formal system expressed in block diagrams and state-based representations. These representations can be translated to formal based tools relying on the synchronous languages Signal and Statecharts. SACRES is a tool set supporting the design of safety-critical embedded control systems. It integrates the tools and specification techniques Statemate, Sildex, and Timing Diagrams with tool components for automatic code generation, formal verification based on model checking techniques, and an innovative approach for automatic code validation for target code generated from DC+. Technical achievements are The main benefits of the SACRES approach are reduced risks for design errors and decreased design times and costs for the development of dependable (safety critical) embedded systems. SACRES is an attempt to avoid unpredictability (particularly that arising from late feedback from testing) associated with development of safety critical systems, through the use of the maximum degree of automation, especially in respect of code generation and verification. An outstanding property of SACRES is the combination of specification styles and specification tools being applied in practice with automatic tools to establish provable correctness with respect to required properties. Both dependability and productivity are increased by automatic code generation from high-level specifications such that the generated code can be validated against higher levels by rigorous proofs. These techniques allow traditional tests by sampling to be replaced by rigorous checking techniques which correspond to 100% coverage of test cases. In order to address a global innovative approach in the near future which match the whole software configuration, the SACRES tool set should be interfaced with asynchronous techniques matching the operating system development. This raises an open question in the software development future new process.

This paper provides a novel method of identifying a set of design faults in Simulink\TargetLink models and production code generation well before generating the test cases. These models can be used for development of safety critical systems. We have developed stand-alone application which transforms TargetLink model to EA compatible UML (Unified Modeling Language) model represented as packages and composite structure diagrams. The entire process makes use of dSPACE and MathWorks tools.

Despite documentation being considered the pri-mary challenge to agile methods in safety-critical software systems development [1], agile would be of particular interest to improve changeability while providing efficiency and effective-ness to all the phases of software development. In this work, we created mechanisms for automating document processing and management to improve the efficiency and effectiveness of documentation activities of safety-critical software systems development, most concretely in the aerospace domain. The implemented tools were co-designed and validated iteratively in the concrete industrial context of Critical Software (CSW) projects, within a wider research work towards continuous certification [3]. We interviewed Critical Software professionals to validate our solution, collected feedback on the implemented tools and got insights for future work. The tools were also the target of synthetic tests that allowed us to conclude that document automation is possible in the critical-safety software development industry and carries several benefits. The developed tools are not yet qualified in compliance with the DO-330 standard (Tools Qualification).