No description available.

No description available.

Safety-critical software systems have traditionally been found in the aerospace-, nuclear- andmedical domains. As technology advances and software complexity increases, such systemscan be found in more and more applications, e.g. self driving cars. These systems need to meetexceptionally strict standards in terms of dependability. Proving compliance is a challenge forthe industry. The regulatory bodies often require a certain amount of testing to be performed butdo not require evidence of a given failure rate (which for software is hard to deal with comparedto hardware). This Licentiate thesis discusses how to quantify test results and analyses whatconclusions can be drawn from a given test effort, in terms of remaining faults in the software.

<p> Many safety-critical software applications are hard real-time systems. They have stringent timing requirements that have to be met. We present descriptions of timing behaviors that include precise definitions as well as analysis of how functional timing requirements (FTRs) interact with performance timing requirements (PTRs), and how these concepts can be used by software designers. The definitions explicitly show how to specify timing requirements with tolerances on time durations. </p> <p> This thesis shows the importance of specifying both FTRs and PTRs, by revealing the fact that their interaction directly determines the final implementability of real-time systems. By studying this interaction under three environmental assumptions, we find that the implementability results of the timing properties are different in each environment, but they are closely related. The results allow us to predict the system's implementability without developing or verifying the actual implementation. This also shows that we can sometimes significantly reduce the sampling frequency on the target platform, and still implement the timing requirement correctly. </p> <p> We present a component-based approach to formalizing common timing requirements and provide a pre-verified implementation of one of these requirements. The verification is performed using the theorem proving tool PVS. This allows domain experts to specify the tolerance in each individual timing requirement precisely. The pre-verified implementation of a timing requirement is demonstrated by applying the method in two examples. These examples show that both the design and verification effort are reduced significantly using a pre-verified template. </p> <p> A primary focus of this thesis is on how to include tolerances on timing durations in the specification, implementation and verification of timing behaviors in hard real-time applications. </p> / Thesis / Doctor of Philosophy (PhD)

Formal methods is a discipline of using a collection of mathematical techniques and formalisms to model and analyze software systems. Motivated by the new formal methods-based certification recommendations for safety-critical embedded software and the significant increase in the cost of verification and validation (V\&V), this research is about creating a software development process for control systems that can provide mathematical guarantees of high-level functional properties on the code. The process, dubbed credible autocoding, leverages control theory in the automatic generation of control software documented with proofs of their stability and performance. The main output of this research is an automated, credible autocoding prototype that transforms the Simulink model of the controller into C code documented with a code-level proof of the stability of the controller. The code-level proof, expressed using a formal specification language, are embedded into the code as annotations. The annotations guarantee that the auto-generated code conforms to the input model to the extent that key properties are satisfied. They also provide sufficient information to enable an independent, automatic, formal verification of the auto-generated controller software.

For avionic systems, the safety requirements are stricter than for non-safety critical systems due to the severe consequences a failure could cause. Depending on the consequences of a failure, the software needs to fulfill different testing criterias. More critical software needs more extensive testing. The question is whether the extra testing activities performed for software of higher criticality level results in discovery of more faults. Mutation testing has been used in this thesis as a method to evaluate the quality of test suites of avionic applications from different safety critical levels. The results showed that the extra activities performed at the higher levels do not necessarily result in finding more faults.

Date: 4th June 2023 Level: Master thesis in Product- and Process Development, advanced level, 30 credits Institution: School of Innovation, Design and Engineering at Mälardalen University Authors: Victor Busck Julia Eriksson Title: Improving Software Development Process Through Industry 4.0 Methodologies - A focus on Railway Embedded Software Supervisor: Yuji Yamamoto - Mälardalens University, Raluca Marinescu - Alstom, Ian Bird-Radolovic - Alstom Keywords: Safety-critical software development; Software development;Industry 4.0; Artificial Intelligence Purpose: The purpose of this study is to investigate what challenges and bottlenecks may occur in the development process of safety-critical software and suggest how Industry 4.0 technologies could be applied to overcome the bottlenecks and improve the process. Research questions: 1. What bottlenecks can the railway domain encounter when developing safety-critical software? 2. How can Industry 4.0 technologies be applied to overcome thebottlenecks and improve the development process of safety-critical software? Methodology: The study is based on a qualitative research methodology following an abductive approach. This led to the theoretical framework being gradually developed in parallel with the empirical data collection. The theoretical collection was based on scientific reports and books. The empirical data collection was based on a questionnaire, of which five in-depth interviews werethen conducted based on responses. Out of the five, three were semi-structured and two unstructured. Conclusion: The study concluded that all phases except design and implementation and software evaluation contained various bottlenecks related to tools, training, processes, resources and communication. However, it can be concluded that the testing phases were the biggest bottleneck at Alstom. To overcome testing challenges and improve the development process, the analysis shows that Industry 4.0 technologies such as AI, NLP and ML could be used to automate testing activities.

A number of logical code coverage criteria have been used throughout the years in the testing of safety-critical software. Kaminski, et al. proposed Relational Operator Replacement Global (RORG), a method to bring benefits from ROR mutation to Modified Condition / Decision Coverage (MCDC), which is widely used in the avionics industry. However, there is a lack of studies in the industry to support this method. In this thesis, we report on the results of applying RORG to avionic code, augmenting an MCDC adequate test set to satisfy RORG, evaluating its ability to find real faults in industrial software. Conclusions drawn from this thesis are: (1) Faults in relational operators in avionic code are rare, no faults were found in this study. (2) 24% of the relational operators in our study would require additional software requirements to be verified for RORG coverage. (3) 37% of the relational operators in our study were infeasible to test due to program semantics. (4) 84% of the tests added covered enumeration comparisons.

This work describes the process of the design of a flight software for a space-qualified device, outlines the development and testing of the SW, and provides a description of the final product. The flight software described in this work has been developed for the project Demise Observation Capsule (DOC). DOC is a device planned to be attached to an upper stage of a launch vehicle and observe its demise during atmospheric re-entry at the end of its mission. Due to constraint on communication time during the mission and the need to maximize the amount of transferred data, a custom communication protocol has been developed. / Demise Observation Capsule

The importance and requirements of certifying safety critical software is today more apparent than ever. This study focuses on the standards and practices used within the avionics, automotive and medical domain when it comes to safety critical software. We identify critical problems and trends when certifying safety critical software and propose a proof-of-concept using static analysis, model checking and incremental SAT solving as a contribution towards solving the identified problems. We present quantitative execution times and code coverage results of our proposed solution. The proposed solution is developed under the assumptions of safety critical software standards and compared to other studies proposing similar methods. Lastly, we conclude the issues and advantages of our proof-of-concept in perspective of the software developer community