Outsourcing of the maintenance activities related to safety-critical systems poses several challenges, where unauthorised access can lead to severe consequences in terms of data vulnerability and huge income lost. Companies can prevent the dissemination of information by managing security, which also contributes to economic and social sustainability. The purpose of the study was to investigate how organizations in the industrial sector deal with the issues of information dissemination in the outsourcing of maintenance activities related to safety-critical systems. To study the area, eleven companies have been interviewed where the results have been compiled in a cross-case analysis, which has been analysed against previous research. The study shows that there are several factors leading to an increased risk of undesired dissemination. Furthermore, the study has resulted in a model for managing control over the dissemination of information in the outsourcing of maintenance for safety-critical systems.

Sistemas embarcados críticos (SEC) correspondem aos sistemas embarcados para aplicações críticas, que são aplicações nas quais falhas podem por vidas em perigo. A crescente imersão deste tipo de sistema em nossas atividades cotidianas aumentou sua demanda, e consequentemente, a necessidade por novas técnicas de desenvolvimento que possam aumentar a produtividade dos desenvolvedores. Linha de produtos (LP) é uma técnica de reúso, na qual famílias de produtos similares são desenvolvidos em conjunto, e portanto, objetiva-se o desenvolvimento em larga escala. Com a utilização de LP, pode-se reusar requisitos e arquitetura de forma sistemática. Entretanto, o reúso no domínio de sistemas embarcados críticos ainda é visto de forma cética. Por outro lado, o domínio de SEC tem obtido avanços de desenvolvimento por meio de técnicas orientadas a modelo. A Engenharia orientada a modelos (MDE) concentra-se na importância de modelos no ciclo de vida do sistema, tornando-os parte do produto final. Assim, mantêm-se os modelos simples, e a maioria da complexidade do software passa a pertencer às transformações, que podem ser obtidas automaticamente por motores de transformação. Isso ajuda a aumentar a qualidade do produto final, bem como facilitar a futura evolução do software, que poderá ser feita mudando-se os modelos de alto nível e obtendo-se, de forma automática, o novo produto. MDE é particularmente útil no domínio de SEC, pois a partir de modelos corretos do problema, a chance de introdução de erros durante a codificação é menor se geradores de aplicações forem utilizados em vez de codificação manual. Além disso, o aumento no nível de abstração proporcionado pelo MDE permite que técnicas de validação e verificação sejam usadas desde os estágios iniciais de desenvolvimento, tais como co-design e co-simulação. Portanto, este trabalho visa defender a tese de que é possível oferecer os benefícios do desenvolvimento em larga escala para o domínio de SEC e ainda continuar se beneficiando de técnicas de MDE. Para corroborar esta tese, define-se uma abordagem de desenvolvimento de linha de produtos de sistema com uso de técnicas de engenharia orientada a modelos para o desenvolvimento de famílias de sistemas embarcados críticos. Além disso, apresenta-se um estudo de caso de marca-passo elaborado segundo as indicações da abordagem proposta que indicam a viabilidade de sua utilização. / Safety-critical embedded systems (SCES) correspond to embedded systems for critical applications, i.e., applications where lives can be lost if they fail. The increasing immersion of this type of system in our daily activities increased their demand and, consequently, the need for new development techniques that can increase developers productivity. Product Line (LP) is a promising technique for reuse, in which families of similar products are developed together and, therefore, it aims at large-scale development. With the use of LP we can reuse requirements and architecture systematically. However, developers remain sceptical about reuse in the SCES domain, mainly due to problems in the past, such as the failure of the spacecraft Ariane 5. In addition, advances in development of techniques for the SEC domain have been obtained, for example through model-driven engineering (MDE) approaches. MDE focuses on the importance of models in the software life cycle, making them part of the final product. So, it keeps models simple, and most of the software complexity belongs to the transformations that can be obtained automatically by transformation engines. This helps increasing the quality of the final product, and facilitate the future development of software that can be done by changing the high level models and obtaining, automatically, the new product. MDE is particularly useful in the SCES domain because, from correct models of the problem, the chance of introducing errors during coding is smaller if generators are used in the development instead of manual coding. In addition, the increased level of abstraction provided by MDE allows the use of validation and verification techniques since the early stages of development, such as co-design and co-simulation. Therefore, this work aims to defend the thesis that it is possible to offer the benefits of large-scale development for the SCES domain and still continue to benefit from MDE techniques. In support of this thesis, we define a system product line approach using model-driven techniques for the development of safety-critical embedded families. In addition, we present a case study prepared according to the directions of approach.

O desenvolvimento de sistemas críticos é atualmente um dos problemas mais desafiadores enfrentados pela Engenharia. Há frequentemente uma pressão para se reduzir o tempo total de desenvolvimento, o que dificulta a entrega de sistemas com um mínimo aceitável de defeitos. Nos últimos anos, houve um aumento no tráfego aéreo, o que demanda uma modernização dos sistemas de tráfego aéreo atuais, muito dependentes na figura do controlador. Sistemas de tráfego aéreo são sistemas considerados críticos em segurança e de tempo real. O objetivo do presente trabalho é estabelecer um método de modelagem e verificação formal para sistemas críticos, com aplicação no domínio de tráfego aéreo. Com a adoção de técnicas de modelagem e verificação formal, pretende-se garantir a corretude dos sistemas frente aos requisitos inicialmente especificados e a detecção de erros em fases mais iniciais do projeto, o que resultaria em menores custos envolvidos na sua correção. São fornecidas diretivas para a aplicação do método através de um estudo de caso, baseado em três módulos de um sistema ATC em baixo nível de abstração, para a validação do funcionamento de módulos de software. Para verificação formal, é utilizada a ferramenta NuSMV e as propriedades a serem verificadas são descritas na lógica computacional de árvore (CTL) para garantir que o sistema satisfaça requisitos dos tipos vivacidade e segurança. / Developing safety critical systems is one of the most challenging problems in Engineering nowadays. There is usually a pressure to reduce the total time of the development, what makes it difficult to deliver systems with an acceptable low level of defects. In the recent years, there has been an increase in air trffic, what demands a modernization in the current air traffic systems, which are very dependent on the human controller. Air traffic systems are considered safety critical and real time systems. The objective of the present work is to establish a modeling and formal verification method for critical systems, applicable to the air traffic domain. By adopting modeling and formal verification techniques, it is expected to ensure the systems\' correctness compared with the initially specified requirements and the error detection in the initial phases of the project. Guidelines are provided for applying the method by means of a case study, based in three modules of and ATC system in a low abstraction level, for the validation of the operation of software modules. For the formal verification, it is used the NuSMV tool and the properties to be checked are described in the computational tree logic (CTL) to ensure that the system satisfies requirements of liveness and safety types.

Security is widely recognized as an important property that is tightly interdependentwith safety in safety-critical systems. The goal of this thesis is to conduct case studies on the implications that security attacks may have on the safety of these systems.In these case studies, we formally model the design of a robot arm system, verify itssecurity against some potential attack scenarios, propose mitigation techniques andanalyze their effectiveness. In order to achieve a thorough knowledge about the current formal verification approaches and select a proper modeling language/tool, weconducted an extensive literature review. We performed this review following a wellknown approach proposed by Barbara Kitchenham. The procedure and outcomes ofthis review are detailed in this thesis. Based on the literature review, we chose TRebeca, (a timed extension of Rebeca), as the formal language to model the robot armsystem, attack scenarios and mitigation techniques. Rebeca is an actor-based modeling language with a Java-like syntax that is effectively used to model concurrent anddistributed systems. This language is supported by a full-featured IDE called Afra,which facilitates the development of (T)Rebeca models and verification of correctnessproperties (such as safety and security) on them. Among several functions providedby a robot arm system, we chose two important functions i.e., Stand Still Supervisionand Control Error Supervision, which we believe would be interesting for attackerstrying to get control over robot movements. In particular, attackers may maliciouslymanipulate the parameter values of these functions, which may lead to safety issues.In order to find suitable attack scenarios on these functions, we studied the mostimportant security protocols used in safety-critical industrial control systems. Weobserved that these systems are vulnerable to several attacks, and man-in-the-middleattack is among the most successful attacks on these systems. Based on this study,we devised two attack scenarios for each function and modeled them with TRebeca.To mitigate these attacks, we proposed a redundancy technique, whose effectivenesswas also assured by Afra.

<p>Day by day, we are witnessing a considerable increase in number and range of applications which entail the use of embedded computer systems. This increase is closely followed by the growth in complexity of applications controlled by embedded systems, often involving strict timing requirements, like in the case of safety-critical applications. Efficient design of such complex systems requires powerful and accurate tools that support the designer from the early phases of the design process.</p><p>This thesis focuses on the study of real-time distributed embedded systems and, in particular, we concentrate on a certain aspect of their real-time behavior and implementation: the time-triggered (TT) and event-triggered (ET) nature of the applications and of the communication protocols. Over the years, TT and ET systems have been usually considered independently, assuming that an application was entirely ET or TT. However, nowadays, the growing complexity of current applications has generated the need for intermixing TT and ET functionality. Such a development has led us to the identification of several interesting problems that are approached in this thesis. First, we focus on the elaboration of a holistic schedulability analysis for heterogeneous TT/ET task sets which interact according to a communication protocol based on both static and dynamic messages. Second, we use the holistic schedulability analysis in order to guide decisions during the design process. We propose a design optimisation heuristic that partitions the task-set and the messages into the TT and ET domains, maps and schedules the partitioned functionality, and optimises the communication protocol parameters. Experiments have been carried out in order to measure the efficiency of the proposed techniques.</p> / Report code: LiU-Tek-Lic-2003:21.

<p>The Integrated Modular Avionics architecture , IMA, provides means for runningmultiple safety-critical applications on the same hardware. ARINC 653 is aspecification for this kind of architecture. It is a specification for space and timepartition in safety-critical real-time operating systems to ensure each application’sintegrity. This Master thesis describes how databases can be implementedand used in an ARINC 653 system. The addressed issues are interpartitioncommunication, deadlocks and database storage. Two alternative embeddeddatabases are integrated in an IMA system to be accessed from multiple clientsfrom different partitions. Performance benchmarking was used to study the differencesin terms of throughput, number of simultaneous clients, and scheduling.Databases implemented and benchmarked are SQLite and Raima. The studiesindicated a clear speed advantage in favor of SQLite, when Raima was integratedusing the ODBC interface. Both databases perform quite well and seem to begood enough for usage in embedded systems. However, since neither SQLiteor Raima have any real-time support, their usage in safety-critical systems arelimited. The testing was performed in a simulated environment which makesthe results somewhat unreliable. To validate the benchmark results, furtherstudies must be performed, preferably in a real target environment.The Integrated Modular Avionics architecture , IMA, provides means for runningmultiple safety-critical applications on the same hardware. ARINC 653 is aspecification for this kind of architecture. It is a specification for space and timepartition in safety-critical real-time operating systems to ensure each application’sintegrity. This Master thesis describes how databases can be implementedand used in an ARINC 653 system. The addressed issues are interpartitioncommunication, deadlocks and database storage. Two alternative embeddeddatabases are integrated in an IMA system to be accessed from multiple clientsfrom different partitions. Performance benchmarking was used to study the differencesin terms of throughput, number of simultaneous clients, and scheduling.Databases implemented and benchmarked are SQLite and Raima. The studiesindicated a clear speed advantage in favor of SQLite, when Raima was integratedusing the ODBC interface. Both databases perform quite well and seem to begood enough for usage in embedded systems. However, since neither SQLiteor Raima have any real-time support, their usage in safety-critical systems arelimited. The testing was performed in a simulated environment which makesthe results somewhat unreliable. To validate the benchmark results, furtherstudies must be performed, preferably in a real target environment.</p>

<p>It is not unusual that software systems are redeveloped when the systems environment changes or new requirements to functionality are found. The reason for this is that system evolution is usually not considered during the initial development of a system.</p><p>In this report we propose a development process focusing on modifiability in security-safety critical systems. The process is based on the standard IEC 61508 Functional safety of electrical/electronic/programmable electronic safety-related systems and the CORAS framework for model-based risk assessment. We focus on integrating modifiability as a non-functionality and extend the development process with an architecture and design phase. Modifiability is addressed using Architecture Tradeoff Analysis Method (ATAM) and Attribute Driven Design (ADD). An evaluation of this process is given by redeveloping a prototype for an already existing security-critical system using the approaches given by the process. The main result from the evaluation showed that we where able to obtain a higher level of modifiability than the original prototype, without compromising the functionality and safety level required.</p>

It is not unusual that software systems are redeveloped when the systems environment changes or new requirements to functionality are found. The reason for this is that system evolution is usually not considered during the initial development of a system. In this report we propose a development process focusing on modifiability in security-safety critical systems. The process is based on the standard IEC 61508 Functional safety of electrical/electronic/programmable electronic safety-related systems and the CORAS framework for model-based risk assessment. We focus on integrating modifiability as a non-functionality and extend the development process with an architecture and design phase. Modifiability is addressed using Architecture Tradeoff Analysis Method (ATAM) and Attribute Driven Design (ADD). An evaluation of this process is given by redeveloping a prototype for an already existing security-critical system using the approaches given by the process. The main result from the evaluation showed that we where able to obtain a higher level of modifiability than the original prototype, without compromising the functionality and safety level required.

O desenvolvimento de sistemas críticos é atualmente um dos problemas mais desafiadores enfrentados pela Engenharia. Há frequentemente uma pressão para se reduzir o tempo total de desenvolvimento, o que dificulta a entrega de sistemas com um mínimo aceitável de defeitos. Nos últimos anos, houve um aumento no tráfego aéreo, o que demanda uma modernização dos sistemas de tráfego aéreo atuais, muito dependentes na figura do controlador. Sistemas de tráfego aéreo são sistemas considerados críticos em segurança e de tempo real. O objetivo do presente trabalho é estabelecer um método de modelagem e verificação formal para sistemas críticos, com aplicação no domínio de tráfego aéreo. Com a adoção de técnicas de modelagem e verificação formal, pretende-se garantir a corretude dos sistemas frente aos requisitos inicialmente especificados e a detecção de erros em fases mais iniciais do projeto, o que resultaria em menores custos envolvidos na sua correção. São fornecidas diretivas para a aplicação do método através de um estudo de caso, baseado em três módulos de um sistema ATC em baixo nível de abstração, para a validação do funcionamento de módulos de software. Para verificação formal, é utilizada a ferramenta NuSMV e as propriedades a serem verificadas são descritas na lógica computacional de árvore (CTL) para garantir que o sistema satisfaça requisitos dos tipos vivacidade e segurança. / Developing safety critical systems is one of the most challenging problems in Engineering nowadays. There is usually a pressure to reduce the total time of the development, what makes it difficult to deliver systems with an acceptable low level of defects. In the recent years, there has been an increase in air trffic, what demands a modernization in the current air traffic systems, which are very dependent on the human controller. Air traffic systems are considered safety critical and real time systems. The objective of the present work is to establish a modeling and formal verification method for critical systems, applicable to the air traffic domain. By adopting modeling and formal verification techniques, it is expected to ensure the systems\' correctness compared with the initially specified requirements and the error detection in the initial phases of the project. Guidelines are provided for applying the method by means of a case study, based in three modules of and ATC system in a low abstraction level, for the validation of the operation of software modules. For the formal verification, it is used the NuSMV tool and the properties to be checked are described in the computational tree logic (CTL) to ensure that the system satisfies requirements of liveness and safety types.

Sistemas embarcados críticos (SEC) correspondem aos sistemas embarcados para aplicações críticas, que são aplicações nas quais falhas podem por vidas em perigo. A crescente imersão deste tipo de sistema em nossas atividades cotidianas aumentou sua demanda, e consequentemente, a necessidade por novas técnicas de desenvolvimento que possam aumentar a produtividade dos desenvolvedores. Linha de produtos (LP) é uma técnica de reúso, na qual famílias de produtos similares são desenvolvidos em conjunto, e portanto, objetiva-se o desenvolvimento em larga escala. Com a utilização de LP, pode-se reusar requisitos e arquitetura de forma sistemática. Entretanto, o reúso no domínio de sistemas embarcados críticos ainda é visto de forma cética. Por outro lado, o domínio de SEC tem obtido avanços de desenvolvimento por meio de técnicas orientadas a modelo. A Engenharia orientada a modelos (MDE) concentra-se na importância de modelos no ciclo de vida do sistema, tornando-os parte do produto final. Assim, mantêm-se os modelos simples, e a maioria da complexidade do software passa a pertencer às transformações, que podem ser obtidas automaticamente por motores de transformação. Isso ajuda a aumentar a qualidade do produto final, bem como facilitar a futura evolução do software, que poderá ser feita mudando-se os modelos de alto nível e obtendo-se, de forma automática, o novo produto. MDE é particularmente útil no domínio de SEC, pois a partir de modelos corretos do problema, a chance de introdução de erros durante a codificação é menor se geradores de aplicações forem utilizados em vez de codificação manual. Além disso, o aumento no nível de abstração proporcionado pelo MDE permite que técnicas de validação e verificação sejam usadas desde os estágios iniciais de desenvolvimento, tais como co-design e co-simulação. Portanto, este trabalho visa defender a tese de que é possível oferecer os benefícios do desenvolvimento em larga escala para o domínio de SEC e ainda continuar se beneficiando de técnicas de MDE. Para corroborar esta tese, define-se uma abordagem de desenvolvimento de linha de produtos de sistema com uso de técnicas de engenharia orientada a modelos para o desenvolvimento de famílias de sistemas embarcados críticos. Além disso, apresenta-se um estudo de caso de marca-passo elaborado segundo as indicações da abordagem proposta que indicam a viabilidade de sua utilização. / Safety-critical embedded systems (SCES) correspond to embedded systems for critical applications, i.e., applications where lives can be lost if they fail. The increasing immersion of this type of system in our daily activities increased their demand and, consequently, the need for new development techniques that can increase developers productivity. Product Line (LP) is a promising technique for reuse, in which families of similar products are developed together and, therefore, it aims at large-scale development. With the use of LP we can reuse requirements and architecture systematically. However, developers remain sceptical about reuse in the SCES domain, mainly due to problems in the past, such as the failure of the spacecraft Ariane 5. In addition, advances in development of techniques for the SEC domain have been obtained, for example through model-driven engineering (MDE) approaches. MDE focuses on the importance of models in the software life cycle, making them part of the final product. So, it keeps models simple, and most of the software complexity belongs to the transformations that can be obtained automatically by transformation engines. This helps increasing the quality of the final product, and facilitate the future development of software that can be done by changing the high level models and obtaining, automatically, the new product. MDE is particularly useful in the SCES domain because, from correct models of the problem, the chance of introducing errors during coding is smaller if generators are used in the development instead of manual coding. In addition, the increased level of abstraction provided by MDE allows the use of validation and verification techniques since the early stages of development, such as co-design and co-simulation. Therefore, this work aims to defend the thesis that it is possible to offer the benefits of large-scale development for the SCES domain and still continue to benefit from MDE techniques. In support of this thesis, we define a system product line approach using model-driven techniques for the development of safety-critical embedded families. In addition, we present a case study prepared according to the directions of approach.