Why the use of domain-specific modeling in airworthy software requires new methods and how these might look like?

Abstract

The use of domain-specific modeling (DSM) in safety-critical avionics is rare, even though the ever-increasing complexity of avionics systems makes the use of DSM reasonable. DSM shows its advantage especially capturing complex systems, data and relationships. The reason for the limited use in the (safety-critical) avionics area is mainly due to the high demands on the safety of software and systems. Everything that is to be used in flight operations and development must undergo a rigorous and complex certification process. Any data used in operations must be verified. A reduction of this effort can be achieved by using qualified tools. A qualified tool can either replace or support certification activities. This paper elaborates different use cases of how DSM could be used in relation to airworthy software. For those use cases we review the effort of a certification and retrieve the major shortcomings and showstoppers of available frameworks, e.g. infeasible qualification of DSM runtimes and the inavailability of qualification artifacts. Finally, we elaborate possible ways of mitigation.