{"title":"Deriving safety properties of critical software from the system risk analysis, application to ground transportation systems","authors":"J. Boulanger, V. Delebarre, S. Natkin, J. Ozello","doi":"10.1109/HASE.1997.648058","DOIUrl":"https://doi.org/10.1109/HASE.1997.648058","url":null,"abstract":"Safety properties of critical software are consequences of the application safety properties (i.e. the front collision of two trains must not occur), and of the system design choices. The paper presents the first results of a SNCF and CESIR joint research project whose purpose is to design a constructive and formal method to derive, at each design level, the safety properties of subsystems from the System Preliminary Hazard Analysis. One of the goals of this method is to obtain, at the lowest level, properties of the safety software which can be checked either by formal proof or by testing. The method relies on two concepts: the safety kernel, proposed by J. Rushby (1989), and a generalization and formalization of the notion of \"restrictivity\", used in classical safe hardware design. An application to the Maggaly (Lyon Subway) automatic pilot is presented.","PeriodicalId":319609,"journal":{"name":"Proceedings 1997 High-Assurance Engineering Workshop","volume":"192 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1997-08-11","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"122007194","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Design of a portable control-flow checking technique","authors":"Z. Alkhalifa, S. Nair","doi":"10.1109/HASE.1997.648049","DOIUrl":"https://doi.org/10.1109/HASE.1997.648049","url":null,"abstract":"A software-based method for concurrent detection of hardware faults via control-flow checking is presented. The method is capable of detecting all single control flow errors and almost all multiple control flow errors, regardless of the type of fault that caused the error. It is implemented by means of adding assertions to the entry and exit points of each branch-free interval of the high-level source code. This method is portable across architectures and does not require any special hardware for its application. The assertions are placed automatically through the use of a preprocessor.","PeriodicalId":319609,"journal":{"name":"Proceedings 1997 High-Assurance Engineering Workshop","volume":"25 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1997-08-11","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"123358487","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Toward more effective testing for high assurance systems","authors":"H. Hecht, M. Hecht, D. Wallace","doi":"10.1109/HASE.1997.648060","DOIUrl":"https://doi.org/10.1109/HASE.1997.648060","url":null,"abstract":"The objective of the paper is to reduce the cost of testing software in high assurance systems. It is at present a very expensive activity and one for which there are no generally accepted guidelines. A part of the problem is that failure mechanisms for software are not as readily understood as those for hardware, and that the experience of any one project does not provide enough data to improve the understanding. A more comprehensive attack on the high cost of software test requires pooling of fault and failure data from many projects, and an initiative by NIST that can furnish the basis for the data collection and analysis is described.","PeriodicalId":319609,"journal":{"name":"Proceedings 1997 High-Assurance Engineering Workshop","volume":"30 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1997-08-11","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"121445325","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"A mechanism for communicating in dynamically reconfigurable embedded systems","authors":"Mehrdad Hassani, D. Stewart","doi":"10.1109/HASE.1997.648069","DOIUrl":"https://doi.org/10.1109/HASE.1997.648069","url":null,"abstract":"We present a time bounded state based communication mechanism for dynamically reconfigurable embedded systems. The mechanism is a single processor, low overhead version of the Chimera state variable mechanism, that was developed for state based communication in multiprocessor environments. The new design is suitable for execution on low performance embedded processors, uses less memory, and supports dynamic binding, one to one, one to many, and broadcast capabilities in a time deterministic manner.","PeriodicalId":319609,"journal":{"name":"Proceedings 1997 High-Assurance Engineering Workshop","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1997-08-11","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"117332047","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Combining testing and correctness verification in software reliability assessment","authors":"B. Cukic","doi":"10.1109/HASE.1997.648061","DOIUrl":"https://doi.org/10.1109/HASE.1997.648061","url":null,"abstract":"The delivery of sophisticated control algorithms or system features via software is the driving force behind its increased use in safety critical applications. The existence of software faults in these systems is not tolerable and a high degree of confidence that safety critical systems meet their reliability requirements must be gained prior to their deployment. The transformational approach to software reliability assessment of process control systems combines the strengths of formal verification and statistical sampling techniques in one unified framework. Partial program proofs are used to amplify the effect of test cases, i.e., they allow us to infer the behavior of the program for many inputs based on its behavior for one input. These transformations reduce the effective size of the input space, typically by eliminating one or more dimensions in the input space. We report on the application of the transformational reliability assessment approach to two control programs in the aerospace engineering domain: a simplified satellite pitch controller and an automatic airplane landing program. Advantages of the transformational approach include significant reduction in size (dimensionality) of input space domain, exact determination of minimal fault size, and reduced sensitivity of reliability estimate to variations in the operational profile.","PeriodicalId":319609,"journal":{"name":"Proceedings 1997 High-Assurance Engineering Workshop","volume":"51 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1997-08-11","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"132913272","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"ReSoFT: a reusable testbed for development and evaluation of software fault-tolerant systems","authors":"K. Tso, E. Shokri, R. Dziegiel","doi":"10.1109/HASE.1997.648054","DOIUrl":"https://doi.org/10.1109/HASE.1997.648054","url":null,"abstract":"The Reusable Software Fault-tolerance Testbed (ReSoFT) has been developed to facilitate the development and evaluation of high-assurance systems that require tolerance of both hardware and software faults. Central to ReSoFT is a library of reusable software components from which a wide variety of software fault tolerance (SWFT) techniques can be utilized to construct highly dependable systems. The reusable components include: (1) SWFT executive components, (2) SWFT support components, (3) SWFT interface components, (4) fault-tolerant network communication components, and (5) fault-injection components. A set of graphical tools are also provided to build, monitor and test the SWFT systems. The ReSoFT testbed is developed and hosted on a network of Sun workstations running the standard Solaris operating system. The workstations are connected with dual-redundant networks to tolerate communication faults. To ensure effective reuse, object-oriented analysis and design based on the Booch method have been used to develop the reusable components. The components were implemented in Ada 95 to take advantage of its new object-oriented and real-time support features. The graphical tools were implemented in Java which provides object-oriented and platform-independent features.","PeriodicalId":319609,"journal":{"name":"Proceedings 1997 High-Assurance Engineering Workshop","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1997-08-11","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"129397399","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"The quality of service model and high assurance","authors":"T. Lawrence","doi":"10.1109/HASE.1997.648036","DOIUrl":"https://doi.org/10.1109/HASE.1997.648036","url":null,"abstract":"The quality of service (QoS) model provides a recursive model that is applicable at any level of abstraction and that encompasses the concepts of real-time systems, dependability and security. It provides metrics based on the QoS attributes of timeliness, precision and accuracy, which can be used for system specification, instrumentation and evaluation. It is hoped that this model will lead to better engineering practice for information systems, facilitate compatibility and provide a better basis for system assurance.","PeriodicalId":319609,"journal":{"name":"Proceedings 1997 High-Assurance Engineering Workshop","volume":"65 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1997-08-11","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127582943","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Efficient compositional state-space verification for communicating processes in distributed systems","authors":"J. Tsai, Eric Y. T. Juan","doi":"10.1109/HASE.1997.648062","DOIUrl":"https://doi.org/10.1109/HASE.1997.648062","url":null,"abstract":"Compositional verification has been considered as one of the most promising approaches to attack the state explosion problem. However, current techniques still can not efficiently verify modern distributed systems due to the high interleaved execution of asynchronously sending actions. The paper presents a new methodology for the compositional verification of deadlock states. The contribution of our methodology is that it can efficiently eliminate the interleaved execution of asynchronously sending actions and invisible actions. Experimental results show significant improvement over other methods.","PeriodicalId":319609,"journal":{"name":"Proceedings 1997 High-Assurance Engineering Workshop","volume":"36 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1997-08-11","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133758028","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Experience in capturing requirements for safety-critical medical devices in an industrial environment","authors":"W. Tsai, R. Mojdehbakhsh, Sanjai Rayadurgam","doi":"10.1109/HASE.1997.648035","DOIUrl":"https://doi.org/10.1109/HASE.1997.648035","url":null,"abstract":"This paper presents some of the lessons learned in developing safety-critical implantable medical devices, such as pacemakers and defibrillators, in an industrial environment. It discusses some important issues related to obtaining requirements directly from end users, and their impact on reliability and safety aspects of the system. The emphasis is on practical aspects of system and software development rather than on theoretical aspects.","PeriodicalId":319609,"journal":{"name":"Proceedings 1997 High-Assurance Engineering Workshop","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1997-08-11","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115647024","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Verifying communication constraints in RSML specifications","authors":"M. Heimdahl","doi":"10.1109/HASE.1997.648039","DOIUrl":"https://doi.org/10.1109/HASE.1997.648039","url":null,"abstract":"Discusses a formal approach to the specification of inter-component communication in RSML (Requirements State Machine Language) specifications. The approach is based on communicating finite state machines. The formalism allows the encapsulation of communication-related properties in well-defined interface specifications. The encapsulation enables us to use the interface specifications as simple safety kernels and to enforce certain safety and liveness constraints in these kernels, Furthermore, we describe how safety and liveness constraints related to inter-component communication can be formalized using a simple and easy-to-understand constraint language. To formally verify that the constraints are satisfied in an RSML model, we attempt to prove that the constraints are satisfied by only looking at the interface specifications. We illustrate the approach with an example from the TCAS II (Traffic Collision Avoidance System) avionics system.","PeriodicalId":319609,"journal":{"name":"Proceedings 1997 High-Assurance Engineering Workshop","volume":"2 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1997-08-11","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"129880080","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}