{"title":"Rationale for the development of the UK defence standards for safety-critical computer software","authors":"M.J.D. Brown","doi":"10.1109/62.63161","DOIUrl":"https://doi.org/10.1109/62.63161","url":null,"abstract":"Developments leading to the publication of the UK Ministry of Defence (MOD) draft standards, specifically directed toward the development and certification of safety-critical computer applications are discussed. Highlights of the draft UK standards are presented, although they are working documents that are liable to change and do not represent settled MOD policy. The use of ADA for safety-critical software is also discussed. This discussion includes a list of programming design practices that, according to the draft standards, are to be avoided.<<ETX>>","PeriodicalId":122768,"journal":{"name":"Fifth Annual Conference on Computer Assurance, Systems Integrity, Software Safety and Process Security.","volume":"600 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1990-11-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"122103529","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"A vital digital control system with a calculable probability of an unsafe failure","authors":"D. Rutherford","doi":"10.1109/CMPASS.1990.175397","DOIUrl":"https://doi.org/10.1109/CMPASS.1990.175397","url":null,"abstract":"The numerically integrated safety assurance logic concept, which allows the closed-form calculation of an upper bound on the probability of an unsafe (i.e., potentially hazardous or wrongside) failure for circumscribed portions of a control system, including CPU, most ancillary digital components and software, is reviewed by describing its implementation in a railroad interlocking controller. The interlocking controller is a Boolean expression evaluation device in which the primordial logic of the interlocking has been stated as a set of expressions. The fail-safe evaluation of the expression set and the subsequent control of the switches and signals by the processor-based controller are discussed. The discussion covers system design objectives, a system description, the vital input and output circuits, vital erasure of buffer data, vital verification of output states, the requirements of the vital power source, data structure generation, verification of data structure integrity, and implications of the system design.<<ETX>>","PeriodicalId":122768,"journal":{"name":"Fifth Annual Conference on Computer Assurance, Systems Integrity, Software Safety and Process Security.","volume":"30 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1990-06-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"116766817","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Proving proof rules: a proof system for concurrent programs","authors":"D. Goldschlag","doi":"10.1109/CMPASS.1990.175405","DOIUrl":"https://doi.org/10.1109/CMPASS.1990.175405","url":null,"abstract":"A methodology for developing sound proof systems for program verification is demonstrated by the development of a proof system for reasoning about concurrent programs based on the unity logic of K.M. Chandy and J. Misra (1988). This proof system has been validated by an automated theorem prover, a computer program that checks the correctness of proofs. The Boyer-Moore logic in which the proof system is formalized and the Boyer-Moore theorem prover which mechanizes this logic are described. The motivation behind the unity logic and the way in which it may be used to prove the correctness of concurrent programs are examined. A proof system for concurrent programs based on the unity logic system is provided as an example. An operational semantics of concurrency is formalized in Boyer-Moore logic by use of the transition system model. Unity's proof rules are proved as theorems about this operational semantics. The proofs of these theorems are mechanically checked. The entire proof system has been verified by the Boyer-Moore prover, making it possible to prove mechanically the consequence of other concurrent programs.<<ETX>>","PeriodicalId":122768,"journal":{"name":"Fifth Annual Conference on Computer Assurance, Systems Integrity, Software Safety and Process Security.","volume":"4 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1990-06-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127874580","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Using CSP to develop trustworthy hardware","authors":"A. Moore","doi":"10.1109/CMPASS.1990.175409","DOIUrl":"https://doi.org/10.1109/CMPASS.1990.175409","url":null,"abstract":"An overview of a method for formalizing critical system requirements and decomposing them into requirements of the system components and a minimal, possibly empty, set of synchronization requirements is presented. The trace model of communicating sequential processes (CSPs) is the basis for the formal method, and the EHDM verification system is the basis for mechanizing proofs. The results of the application of this method to the top-level implementation of an error-detecting character repeater are discussed. The critical requirements of the repeater are decomposed into the requirements of its components. Provided that the components meet their derived requirements, the repeater has been proven to meet its critical requirements.<<ETX>>","PeriodicalId":122768,"journal":{"name":"Fifth Annual Conference on Computer Assurance, Systems Integrity, Software Safety and Process Security.","volume":"29 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1990-06-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"123471005","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Using symbolic execution to aid automatic test data generation","authors":"A. Offutt, E.J. Seaman","doi":"10.1109/CMPASS.1990.175398","DOIUrl":"https://doi.org/10.1109/CMPASS.1990.175398","url":null,"abstract":"It is shown how symbolic execution is used to solve the internal variable problem in the Godzilla test data generator. In constraint-based testing, which is used by the system, the internal variable problem appears when the constraints that specify the test cases contain internal variables. The necessary background is developed by describing the constraint systems used by Godzilla and by discussing symbolic execution in general terms. The application of symbolic execution to the internal variable problem is presented. The discussion focuses on the software used, including algorithmic details. Following this, a practical example of using this system to detect a fault in a small program is presented.<<ETX>>","PeriodicalId":122768,"journal":{"name":"Fifth Annual Conference on Computer Assurance, Systems Integrity, Software Safety and Process Security.","volume":"82 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1990-06-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"116833497","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"The computer-related risk of the year: distributed control","authors":"P. Neumann","doi":"10.1109/CMPASS.1990.175414","DOIUrl":"https://doi.org/10.1109/CMPASS.1990.175414","url":null,"abstract":"The risks inherent in distributed systems with respect to requirements such as security, reliability, availability, real-time performance, and safety are discussed. The risks are seen to be generally no less than, and in many cases greater than, comparable risks in systems with centralized control. The October 27, 1980, Arpanet collapse and the January 15, 1990, AT&T slowdown are presented in order to illustrate some of the serious risks in distributed control. A multiple-copy problem in sendmail is also presented to demonstrate further difficulties in enforcing global consistency. The relative effectiveness of various measures for countering these risks is discussed.<<ETX>>","PeriodicalId":122768,"journal":{"name":"Fifth Annual Conference on Computer Assurance, Systems Integrity, Software Safety and Process Security.","volume":"28 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1990-06-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"123745735","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"A structure approach to code correspondence analysis","authors":"J. Freeman, R. Neely","doi":"10.1109/CMPASS.1990.175407","DOIUrl":"https://doi.org/10.1109/CMPASS.1990.175407","url":null,"abstract":"Results from a code correspondence analysis task for the trusted computing base of an internet gateway system are reported. Analysis placement within the context of the overall assurance demonstration for the system is described, and the definition and employment of a method to increase the credibility of the code correspondence effort as compared with previous efforts are discussed. The method described is a refinement of the approach promulgated by a US Department of Defense standard. The integrated assurance demonstration approach is presented in a manner that is applicable to requirements that may be identified as critical, though not necessarily security related. The results obtained from applying specific techniques that make the integrated assurance demonstration real within a development project are summarized.<<ETX>>","PeriodicalId":122768,"journal":{"name":"Fifth Annual Conference on Computer Assurance, Systems Integrity, Software Safety and Process Security.","volume":" 8","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1990-06-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"132011733","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"A case study: production problems in an application running on the PRODIGY service","authors":"M. L. Hutcheson","doi":"10.1109/CMPASS.1990.175399","DOIUrl":"https://doi.org/10.1109/CMPASS.1990.175399","url":null,"abstract":"The code-related production problems that occurred in an application running on the PRODIGY service production network over its first 17 months of live service are discussed. They fall into three general categories: errors caused by incompatible code modules (integration failures), errors in program logic and errors caused by faulty specifications. The test history of the project is reviewed, and the problems are examined to determine why testing failed to isolate them. Strategies for preventing their occurrence in future projects are proposed.<<ETX>>","PeriodicalId":122768,"journal":{"name":"Fifth Annual Conference on Computer Assurance, Systems Integrity, Software Safety and Process Security.","volume":"11 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1990-06-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133344831","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Are trusted computer system standards useful for the development of systems whose criticality is other than security?","authors":"H. O. Lubbes, H. Johnson, C. Pfleeger, P. Neumann","doi":"10.1109/CMPASS.1990.175417","DOIUrl":"https://doi.org/10.1109/CMPASS.1990.175417","url":null,"abstract":"A discussion is given on the application of the Department of Defense (DOD) trusted computer system evaluation criteria (TCSEC) and equivalent criteria to systems that must be trusted to support fail-safe (e.g., all failures leave the system in a safe state), mandatory sequence (no process is invoked out of sequence), guaranteed completion (processes are guaranteed to complete in a specific time allocation), integrity, guaranteed service, and authorized invocation (processes are guaranteed to be invoked only by authorized stimulus) policies.<<ETX>>","PeriodicalId":122768,"journal":{"name":"Fifth Annual Conference on Computer Assurance, Systems Integrity, Software Safety and Process Security.","volume":"59 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1990-06-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"124009841","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"An overview of IEC draft standard: 'Functional safety of programmable electronic systems'","authors":"R. Bell, S. Smith","doi":"10.1109/CMPASS.1990.175412","DOIUrl":"https://doi.org/10.1109/CMPASS.1990.175412","url":null,"abstract":"An overview of the International Electrotechnical Commission draft standard for computer-based systems, generally referred to as programmable electronic systems (PESs), which are increasingly being used in safety-related applications, is presented. The scope of the standard, which includes the safety integrity and reliability terms, the safety-related systems concept, the separation of risk and safety integrity, the system and software integrity levels and the safety life cycle concept, is described. Key issues remaining to be resolved are also presented.<<ETX>>","PeriodicalId":122768,"journal":{"name":"Fifth Annual Conference on Computer Assurance, Systems Integrity, Software Safety and Process Security.","volume":"42 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1990-06-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"129467748","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}