Search

Purpose This paper aims to describe an effort to provide for a robust and secure software development paradigm intended to support DevSecOps in a naval aviation enterprise (NAE) software support activity (SSA), with said paradigm supporting strong traceability and provability concerning the SSA’s output product, known as an operational flight program (OFP). Through a secure development environment (SDE), each critical software development function performed on said OFP during its development has a corresponding record represented on a blockchain. Design/methodology/approach An SDE is implemented as a virtual machine or container incorporating software development tools that are modified to support blockchain transactions. Each critical software development function, e.g. editing, compiling, linking, generates a blockchain transaction message with associated information embedded in the output of a said function that, together, can be used to prove integrity and support traceability. An attestation process is used to provide proof that the toolchain containing SDE is not subject to unauthorized modification at the time said critical function is performed. Findings Blockchain methods are shown to be a viable approach for supporting exhaustive traceability and strong provability of development system integrity for mission-critical software produced by an NAE SSA for NAE embedded systems software. Practical implications A blockchain-based authentication approach that could be implemented at the OFP point-of-load would provide for fine-grain authentication of all OFP software components, with each component or module having its own proof-of-integrity (including the integrity of the used development tools) over its entire development history. Originality/value Many SSAs have established control procedures for development such as check-out/check-in. This does not prove the SSA output software is secure. For one thing, a build system does not necessarily enforce procedures in a way that is determinable from the output. Furthermore, the SSA toolchain itself could be attacked. The approach described in this paper enforces security policy and embeds information into the output of every development function that can be cross-referenced to blockchain transaction records for provability and traceability that only trusted tools, free from unauthorized modifications, are used in software development. A key original concept of this approach is that it treats assigned developer time as a transferable digital currency.

Nowadays software control large majority of systems that humankind use. Systems that software is used widely, such as transportation, military, medicine and avionics must be safe during operation. Fail in these critical systems may cause catastrophic results (i.e. loss of human life, loss or severe damage to environment or equipment etc.). In order to avoid failure on safety critical systems or at least mitigate risks detailed testing is required. Many safety critical systems are developed with sequential phases and tested with test last approach. But test last approach is not sufficient when requirements are unclear or changed. To overcome weaknesses of test last approach we propose test driven approach for safety critical software development, regulated by IEC 61508 standard. A systematic analysis of IEC 61508 software requirements against proposed approach showed that the approach directly supports some objectives and partially supports some of them. Supported objectives are safety requirement identification, simple and testable software design, verification and validation. In general introduced approach suits regulated software development well and this paper outlines these details.

The Speci cation and Analysis of Requirements (SpeAR) tool is a requirements prototyping and analysis tool based on the formal semantics of the Lustre language. It features a domain speci c language that formally captures functional requirements of systems or software. Once formalized, requirements can be analyzed to demonstrate correct- ness, consistency, and traceability using in nite-state model checking tools, such as JKind. The formal notation and analyses that SpeAR supports can be used to automate activities related to certi cation of safety critical software as suggested by DO-178C: Software Considera- tions in Airborne Systems and Equipment Certi cation. This standard de nes a rigorous software development process that ensures that soft- ware development activities produce object code that implement sys- tem requirements correctly, while introducing no additional functional- ity. Recent updates to the guidance allow for the use of formal methods to satisfy DO-178C certi cation objectives as outlined in DO-333: For- mal Methods Supplement to DO-178C and DO-278A. This paper walks through an e ort in which SpeAR is used to automate certi cation ac- tivities for production avionics software. It focuses on the use of SpeAR to address veri cation objectives related to the software design artifacts of DO-178C, replacing manual peer review activities with more rigorous formal-methods based analyses.

Aiming at the problems of long development cycle, poor reusability and portability in avionics software development, this paper proposes a development process based on MBSE(Model-based systems engineering) and FACE(future airborne capability environment) architecture. At the same time, the differences between SysML model and FACE data model lead to the incoherence of development process. Therefore, the mapping transformation method from SysML model to FACE data model is designed based on metadata model mapping Law.

The creation of reliable unmanned aerial vehicles (drones) now is an important task in the science and technology, because such devices can have a lot of use-cases in the digital economy and modern life, so we need to ensure the reliability here. In this article, it is proposed to assemble a quadcopter from low-cost components in order to obtain a hardware prototype and to develop a software solution for the flight controller with high-reliability requirements, which will meet avionics software standards using existing open-source software solutions, and also apply the results as a model for teaching courses “Components of operating systems” and “Software verification”. In the study, we proceed to analyse the structure of quadcopters and flight controllers for them, represent a self-assembly solution. We describe Ardupilot as open-source software for unmanned aerial vehicles, the appropriate APM controller and methods of PID control. Today's avionics standard of reliable software for flight controllers is a real-time partitioning operating system that is capable of responding to events from devices with an expected speed, as well as sharing processor time and memory between isolated partitions. A good example of such OS is the open-source POK (Partitioned Operating Kernel). In the repository, it contains an example design of a system for the quadcopters using AADL language for modeling its hardware and software. We apply such a technique with Model-driven engineering to a demo system that runs on real hardware and contains a flight management process with PID control as a partitioned process. Using a partitioned OS brings the reliability of flight system software to the next level. And to increase the level of control logic correctness we propose to use formal verification methods and provide examples of verifiable properties at the level of code using the deductive approach as well as at the level of the cyber-physical system using Differential dynamic logic to prove the stability.

Software is a key ingredient when developing any aerospace system. It is used in embedded electronics, in flight dynamics, in ground and space data processing, and in the current generation of data products. For example, the National Aeronautics and Space Administration (NASA) Goddard Space Flight Center’s Innovative Partnerships Program Office offers licensing opportunities for software and technologies from a variety of areas relevant to the hardware and software requirements of Earth and space science missions and projects: aerospace/aeronautics, computer software, data processing/analysis, electromechanical devices, electronics, manufacturing equipment, mechanical technologies, nanotechnology, optics and photonics, sensor and detector technologies, subassemblies and components, telecommunications and internet, and test and measurement (IPP Office, 2009). Reuse of existing experience and artifacts eliminates having to “reinvent the wheel” and is a key element to achieving progress in many areas of complex aerospace system development. Originally, in the absence of vendor-provided solutions and commercial off-the-shelf software components, many data and information systems were designed and built as custom applications. However, as the practice of systems and applications development has matured, facilitating reuse of software and reusing previously developed software have been recognized as beneficial for meeting the challenges of developing and maintaining complex systems. Some of the challenges commonly faced by system developers can include dealing with very large quantities of data (e.g., terabytes per day), working with a distributed knowledge base, the expense and complexity of required technology infrastructure, and the need for domain-specific knowledge in software development (Samadi et al., 2007). In software development, reuse can assist today’s development teams in various aspects of the system development life cycle, especially when they share common goals (Samadi et al., 2007). The development of new systems can benefit from the efforts that contributed to the development of current and previous generations of systems. Considering the costs of building new systems, and the learning curve that contributes to such costs, leveraging the results of previous system development activities has the potential to reduce system

This paper takes the model-driven development method of avionics software system as the research target. Based on the in-depth study of the latest FACE3.0 technical standards and related FACE systems, this paper proposes MDACD, a Model-Driven Avionics software Component Development method. MDACD uses model-driven architecture, follows the FACE3.0 technical standard, and implements TSS key capability realization software and modeling tool software in a componentized development method.

International audience; Many industries use safety-critical systems and software, the failure of which may result in the loss of human lives. This article investigates the development and certification of safetycritical software, with a focus on the avionics industry. It highlights the problems encountered in companies to demonstrate compliance with the certification requirements and indicates current industrial practices. It demonstrates the interest and importance of closely and continuously integrating certification requirements in the software development process. It underlines a very recent trend in industry that consists in taking inspiration from agile principles in order to ensure that certification requirements applicable to software development are met as early as possible. It presents some successful industrial experiments and concludes on practical lessons that could be transferred to other projects.

The article presents selected results of analytical and design works undertaken at the Air Force Institute of Technology (AFIT) in the field of building a computer support and software lifecycle management system that is critical for flight safety. The aim of the work undertaken is to develop methods and carry out verification and testing in order to detect errors in the developed avionics software for compliance with the requirements of the DO-178C standard and its production, certification, and implementation on board aircraft. The authors developed an original computer system within the implemented requirements used in the construction and certification of avionic onboard devices and their software (among others, DO-254, DO-178C, AQAP 2210, ARP 4761, ARP 4754A). The conducted analysis involved three basic groups of avionics software development processes, i.e., software planning, creation, and integration. Examples of solutions implemented in the constructed computer system were presented for each of these process groups. The theoretical basis of the new method for predicting vulnerabilities in the software implemented within integrated avionic systems using branching processes is discussed. It was demonstrated that the possibility of predicting vulnerabilities in future software versions could have a significant impact on assessing the risk associated with software safety in the course of its lifecycle. It was indicated that some of the existing quantitative models for analyzing software vulnerabilities were developed based on dedicated software data, which is why actual scenario implementation may be limited. DO-178C standard requirements for the process of developing avionics software were implemented in the helmet-mounted flight parameter display system constructed at AFIT. The requirements of the DO-178C and AQAP 2210 standards were shown to be met in the example of the software developed for a graphics computer, managing the operating modes of this system.

Nowadays there are lots of means to automate the aircraft avionics software verification. The model-based software development made a formal verification approach popular (e.g. model checking). Such ways allow to verify the matching of the system model contained the end number of states and requirements expressed in the temporal logic language. However, the software operation in the target platform is out of scope here. Software verification within a hardware-in-the-loop simulation takes into account the target features. In this case, the verification automation tools are capable to simulate the input signals, to check the equipment’s feedback by monitoring output signals, to process the captured data, and to generate the verification protocols. At the same time, there are some onboard high-critical systems (e.g. cockpit displays, flight warning) are being required the human-operator during the testing. They generate visual and aural information which has to be perceived by for the crew members. Thus, their verification is complicated to be automated accounting the mentioned aspect that leads to increased time and cost expenses. The paper describes the software tool that has been developed to partially automate the verification of avionics equipment which required human visual checking. The tool performs recognizing of the textual data displayed on the cockpit screens. It allows reducing the time and cost expenses within aircraft testing and recertification.

The self-* properties commonly associated with the concept of autonomic computing are capabilities desirable for avionics software platforms. They decrease the configuration effort and inherently provide new fault tolerance and resource savings possibilities. The rigid certification process and the requirements for a static and predetermined system behavior are, however, in contradiction with the adaptive and flexible nature of autonomic computing systems. We propose a partition-based architecture providing autonomic features for avionics software platforms while being compliant to regulations and accepted technologies, such as ARINC 653. The core is a platform consciousness based on a domain-specific model and a novel MAP-QE-K cycle. Moreover, we suggest a planning intelligence, a virtual qualification authority, and a minimized execution unit. For each component we define the required design assurance level and possible realization techniques. We discuss the overall feasibility and point out central challenges in the fields of runtime verification and models at runtime. These challenges need to be solved up to the realization of autonomic avionics, e.g. a virtual security assessment and a qualifiable domain-specific model database., Comment: 7 pages, 5 figures

This paper describes a concept allowing for automated testing of avionics installed on a test bench where concepts of Artificial Intelligence are used. This test bench technology provides means for fast discovery of changes in behavior of new releases of avionics software where feature corrections can lead to modified behavior of other functions. The tested avionics is installed in a simulator test bench allowing to simulate behavior and systems of the respective airplane type. The test bench allows the pilot himself to test the functionality which can be repeated by the automation system itself. The technology behind the simulator collects all the data from the test bench internal buses under different conditions to be used as a reference to identity deviations from expected behavior of the avionic systems. The Artificial Intelligence methods used in our approach include state space search algorithms for determination of required control routines and data learning related to identification of deviations in behavior.

The scale and complexity of software in modern avionics systems are growing fast. It becomes a challenge to develop such kind of software systems satisfying both high safety and reliability requirements. This paper presents a framework of automatic test case generation for avionics software form formal requirement models. We introduced a specific formal model of VRM (Variable Relation Model), which is used for modeling the requirements of avionics software, from which control tree structures are established. Different model test coverage criteria are defined according to the DO-178C standard to simplified the control tree structure, and test path constraint selection methods are proposed based on those criteria. Through performing domain error test case selection, test cases are generated for each path constraint selected, which makes up a test case set for the requirement. At last, to demonstrate how we generate test cases form a requirement model, a case study is given.

Integrated Modular Avionics (IMA) has become the mainstream in avionics system because of its advanced design and excellent performance. However, the disadvantage of the high price, not published source code and limited resource problems makes the development and verification of avionics software more and more complicated. It is of great significance to provide a software testing environment on the general operating system in avionics software development and system integration. In this paper, a virtual ARINC 653 system simulation platform is designed and built by using virtual experiment technology. The platform contains partition management, communication management and health monitoring management, and effectively solves the limited test resources of avionics system. Experimental results show that the performance of the proposed platform is excellent, and meets the real-time requirements of applications.

Assessment of software reliability is inevitable in modern software production process. Many works aimed at better models for measurement and prediction of reliability of software products. Tens of approaches have been developed and evaluated so far. However, very few works focus on approaches to compare existing systems with respect to reliability. Despite a tremendous importance to practice (and software management area), a complete and sound comparison methodology does not exist. In this paper, we propose a methodology for software reliability comparison. The methodology extensively applies the GQM approach and software reliability growth models. The methodology has been thoroughly evaluated on a case of assessment and comparison of three open source mobile operating systems: Sailfish, Tizen and CyanogenMod.

The software safety of a nuclear digital protection system is critical for the safety of nuclear power plants as any software defect may result in severe damage. In order to ensure the safety and reliability of safety-critical digital system products and their applications, software hazard analysis is required to be performed during the lifecycle of software development. The dynamic software hazard modeling and analysis method based on Colored Petri Net is proposed and applied to the safety-critical control software of the nuclear digital protection system in this paper. The analysis results show that the proposed method can explain the complex interactions between software and hardware and identify the potential common cause failure in software properly and effectively. Moreover, the method can find the dominant software induced hazard to safety control actions, which aids in increasing software quality.

Spacecraft on-board computers are responsible for controlling the spacecraft platform, payloads, or other on-board devices. Their mission-specific software allows communication with ground or other on-board computers. Traditionally, on-board software has been written close to the hardware in assembly language, Ada, C, or C++, with or without a real-time operating system (RTOS) [1]. As the spacecraft computer hardware capabilities are increasing, spacecraft software is becoming larger and more complex, handling more tasks from payload data processing to landing a first stage of a launch vehicle on an ocean-going barge. Spacecraft will still continue to include very small embedded systems that can be developed without operating systems (OS), but some systems will also have large software bases, requiring efficient software development processes and reuse of existing software modules. The last decade has seen increasing use of Linux in spacecraft on-board software. This article presents common features of spacecraft on-board computers and software and discusses potential benefits and drawbacks of on-board Linux use. The focus of this article is on spacecraft on-board avionics software, that is, spacecraft- controlling code that flies into orbit with the spacecraft. Other types of computers are not included in this analysis; for example, many laptops on the International Space Station run Linux [2].

The increasing dependence of our modern society on software systems has driven the development of software products become even more competitive and time-consuming. Single release software product no longer meets the increasing market requirements. Thereby it is important to release multiple version software products in order to add new features in the next release and fix remaining faults from previous release. In this paper, we develop a multi-release software reliability model with consideration of the remaining software faults from previous release and the new introduced-faults (from newly added features). Additionally, dependent fault detection process is taken into account in this research. In particular, the detection of a new fault for developing the next release depends on the detection of the remaining faults from previous release and the detection of the new introduced-faults. The proposed model is validated on the open source software project datasets with multiple releases.

Fundamentally new software and hardware systems for lower level automation in the safety monitoring and control systems of nuclear power plants are examined. More than a hundred software-hardware systems employing software and hardware from different manufacturers have been developed and introduced in this area. Design and functional solutions based on specific software-hardware systems are presented and comparative data on the apparatus and the use of the diversity principle are discussed.

The large majority of technological devices can be seen as the sum of components of heterogeneous nature (electrical, mechanical, thermal, software, etc.) so that their analysis and design calls for the use of tools from different engineering disciplines. Integration among the different tools is particularly relevant at control system design level, since it is at this stage that it is required to analyze the behavior of both each single component and the system as a whole, with different levels of detail. In this paper mechatronic systems are considered, that exhibit a strong interplay between mechanical and electrical components, and the issue of modeling and designing embedded control algorithms and architectures for such systems is addressed. In particular, an integrated virtual prototyping approach for analyzing the system behavior down to embedded software level is proposed, that can be used in a wide number of situations that can represent the actual real-world operational conditions of consumer products. This approach can be used for system design (in particular at control systems level), embedded software design, and virtual testing so as to optimize and reduce the costs of late stage software development, physical prototypes, and their testing. The case study is based on some recently derived software tools that perform the co-simulation of the firmware execution and the multi-physical controlled system dynamics. The actual control software implemented in the final product can be entirely developed and tested inside the virtual prototype. To prove the validity and potentialities of the proposed approach, a real case study is presented, regarding a very common, though complex to simulate, mechatronic system such as an electric sliding gate. It turns out that the proposed environment goes beyond hardware-in-the-loop tools, since it does not require the use of specific hardware (the hardware itself is simulated in detail) but allows to analyze in detail the status of the microprocessors and peripherals at arbitrary time-scales and allows the designer to study at the earliest design stages the dynamics between the multi-physical controlled system and the firmware, without committing to a given hardware structure.

Errors in safety-critical software can have disastrous consequences. However, tools exist that developers can use to thoroughly analyze software subsystems for critical safety properties.

Embedded computer systems are proliferating, but the complexities of embedded software make it increasingly difficult to produce systems that are robust and reliable. These challenges increase as embedded systems are connected to networks and relied on to control or monitor physical processes in critical infrastructure. This paper describes a senior-level course that exposes students to foundational characteristics of embedded software, such as concurrency, synchronization and communication. The core of the class is a sequence of laboratory assignments in which students design and implement a real-time operating system. Each student-developed RTOS has the same API, so all can run the same application code, but internal implementations vary widely. The principal challenges that arise in the design and debugging of a multi-tasking RTOS tend to be instances of the general problems that arise in embedded software. In our experience, the activity of creating a working RTOS is effective in helping students acquire the knowledge and skills required to be successful embedded software developers.

Safety stories specify safety requirements, using the EARS (Easy Requirements Specification) format. Software practitioners can use them in agile projects at lower levels of safety criticality to deal effectively with safety concerns.

Measuring software reliability is one of the most important concerns for software engineers and decisions makers since if we can't measure it we can't master it. For engineers, the system reliability level can be used to measure the progress of system testing by comparing the current software failure intensity with the desired one. For decision makers,the system reliability level Guarantee better exploitation by the users therefore better customer satisfaction. A literature review shows a lack of studies focusing on the reliability measurement processes related to software development life cycle (SDLC). In this paper, our intention is to propose a thoroughly analysis of the software reliability measurement processes. Since the current software measurement trends are focusing on software metrics, we will propose a new framework of reliability measurement based on software metrics. This new framework is required by developers to assess their software reliability and by decision makers to make appropriate quality improvements.

Commercial microprocessors could be useful computational platforms in space systems, as long as the risk is bound. Many spacecraft are computationally constrained because all of the computation is done on a single radiation-hardened microprocessor. It is possible that a commercial microprocessor could be used for configuration, monitoring and background tasks that are not mission critical. Most commercial microprocessors are affected by radiation, including single-event effects (SEEs) that could be destructive to the component or corrupt the data. Part screening can help designers avoid components with destructive failure modes, and mitigation can suppress data corruption. We have been experimenting with a method for masking radiation-induced faults through the software executing on the microprocessor. While triple-modular redundancy (TMR) techniques are very effective at masking faults in software, the increased amount of execution time to complete the computation is not desirable. In this paper we present a technique for combining duplication with compare (DWC) with TMR that decreases observable errors by as much as 145 times with only a 2.35 time decrease in performance.

Fujitsu researchers have developed a methodology to automate testing of industrial-strength embedded software implemented in C or C++. The methodology’s core is a program analysis technique called symbolic execution, which the researchers have customized to automate testing. The methodology generates unit-level tests, greatly reducing test generation time and cost while providing excellent test coverage.

The requirement for high reliability is no longer restricted to a few specialized and proven domains. Instead, ever more functions whose failure can hurt humans and damage property are cropping up in new areas. Avoiding problems and catastrophes in the new software reliability landscape is possible but won't be easy.