Search

The role of AI evolves from human assistance over human/machine collaboration towards fully autonomous systems. As the push towards more autonomy subsequently removes the reliance on a human overseeing the system, means of self supervision must be provided to enable safe operations. This work explores dynamic reconfiguration to provide resilience to unforeseen environmental conditions that exceed the systems capabilities, but also against normal faults. We focus on providing the means for this in an ARINC 653 compliant environment, since we target avionics platforms. Scheduling and communication are two major aspects of dynamic reconfiguration. Hence, we discuss multiple respective implementation approaches. The third pillar of reconfiguration, the process of deciding when to reconfigure is also investigated. Combining these yields the building blocks for a self-supervising system.

All current safety norms require determining the data and control flow in the source code and making sure that it is compliant to the intended control and data flow as defined in the software architecture. In traditional static code analysis, data accesses via pointer variables and control flow by function pointer calls might be missed. Using sound static analysis based on abstract interpretation, it is possible to guarantee the absence of runtime errors that could cause memory corruption and control flow corruption. Furthermore, it is possible to guarantee that in the analysis, all data and function pointer targets are considered and that the possible data and control coupling is fully captured. In this article we propose a comprehensive methodology for statically computing a safe approximation of the data and control coupling between software components. Our approach incorporates global static data and control flow analysis, taint analysis and program slicing. It can detect critical data and control flow errors and allows to complement traditional code coverage criteria by the degree of data and control coupling covered by the testing process, helping to identify relevant previously untested scenarios. It can also demonstrate freedom of spacial interference between software components at the source code level.

—General-Purpose GPU software is considered for use in avionics to satisfy the increased computational requirements of future systems. Therefore, it needs to be certified following the DO-178C guidance as all airborne software. In this work, we review the existing methods in the literature, we analyse their advantages and disadvantages, and we discuss how they can be combined to obtain certification with lower effort and cost. Our focus is restricted on application-level software, under the premise that successful completion of verification of avionics graphics GPU software products has been demonstrated, so their GPU compiler has been considered acceptable for these already DO-178C certified products, or existing qualified GPU compilers exist. Finally, we discuss upcoming solutions for certified general purpose GPU computing . This work was performed within the Airbus TANIAGPU Project ADS (E/200) in collaboration with the project partners Airbus Defence and Space, Madrid, Spain and CoreAVI, Canada. It was also partially supported by the European Space Agency (ESA) through the GPU4S (GPU for Space) activity, the Spanish Ministry of Economy and Competitiveness under grants PID2019-107255GB and FJCI-2017-34095 (Spanish State Research Agency / http://dx.doi.org/10.13039/501100011033) and the HiPEAC Network of Excellence.

Avionic industry in Russian Federation faces difficulties in organizing the reliable instrumental support of development processes. State-wide active direction on digitalization of the economy doesn’t facilitate the issue solving. The choice of software tools is an important component of success while developing complex certifiable software such as aircraft onboard systems. The same situation could be observed in other industries as well. Nowadays the Russian IT-market provides a sufficient amount of different software that can cover the development lifecycle processes of complex certifiable software for avionics in a varying degree. This article analyses the current situation on Russian software market and the impact of import substitution policy of Russian Federation on software developers and consumers – industrial enterprises. Details of regulation document DO-178C for onboard software development are considered to show the importance of correct choice of project’s instrumental landscape. Certain types of specialized software tools for development processes automating are considered. Authors identified the basic groups of tool functionality that provide support for the development lifecycle of onboard software. The Russian and foreign PLM (Product Lifecycle Management) and PDM (Product Data Management) systems and other software were examined for compliance with the necessary functionality. For comparative analysis the method based on additive verification of software by criteria was proposed. Research results allowed authors to make a conclusion about current Russian software level in comparison with worldwide analogues. Also some prospects of Russian software further evolution have received justification based on results of this research. Recommendations for the directions of software development and completion are given. The analysis, presented in the article, can be useful for avionic and other industries enterprises which need to choose some software for support the development lifecycle processes in new and ongoing projects of complex systems development. Also specialists who are interested in the current state of Russian IT industry can find some valuable information in this article.

In software development, requirements traceability is often mandated. It is important to apply to support various software development activities like result evaluation, regression testing and coverage analysis. Model-Driven Testing is one approach to provide a way to verify and validate requirements. However, it has many challenges in test generation in addition to the creation and maintenance of traceability information across test-related artifacts. This paper presents a model-based methodology for requirements traceability that relies on leveraging model transformation traceability techniques to achieve compliance with DO-178C standard as defined in the software verification process. This paper also demonstrates and evaluates the proposed methodology using avionics case studies focusing on the functional aspects of the requirements specified with the UCM (Use Case Maps) modeling language.

International audience; The emergence of a global market for urban air mobility and unmanned aerial systems has attracted many startups across the world. These organizations have little training or experience in the traditional processes used in civil aviation for the development of software and electronic hardware. They are also constrained in the resources they can allocate for dedicated teams of professionals to follow these standardized processes. To fill this gap, this paper presents a custom workflow based on a subset of objectives derived from the foundational standards for safety critical software DO-178C/DO-331. The selection of objectives from the standards is based on the importance, degree of automation, and reusability of specific objectives. This custom workflow is intended to establish a lean and highly automated development life cycle resulting in higher quality software with better maintainability characteristics for research and prototype aircraft. It can also be proposed as means of compliance for software of certain applications such as unmanned aircraft systems, urban air mobility and general aviation. By producing the essential set of development and verification artifacts, the custom workflow also provides a scalable basis for potential future certification in compliance with DO-178C/DO-331. The custom workflow is demonstrated in a case study of an Autopilot Manual Disconnection System.

Adaptive and Learning Agents (ALAs) bring computational intelligence to their Cyber Physical host systems to adapt to novel situations encountered in their complex operational environment. They do so by learning from their experience to improve their performance. RTCA DO-178C specifies a stringent certification process for airborne software which represents several challenges when applied to an ALA in regards of functional completeness, functional correctness, testability and adaptability. This research claims that it is possible to certify an Adaptive Learning Unmanned Aerial Vehicle (UAV) Agent designed as per a Cognitive Architecture with current DO-178C certification process when leveraging a qualified tool (DO-330), Model-Based Development and Verification (DO-331) and Formal Methods (DO-333). The research consists in developing, as a case study, an ALA embedded in a UAV aimed at neutralizing rogue UAVs in the vicinity of civil airports and test it in the field. This article is the plan to complete, by end 2022, a dissertation currently in its confirmation phase.

Structural coverage analysis is an important task for the development of safety-critical systems. In particular, structural coverage analysis is one of the objectives specified in RTCA DO-178C for the airborne software verification process. Structural coverage analysis is normally supported by the tools that collect coverage information in the course of test execution. This paper concerns with the problems and methods of structural coverage collecting in order to specify the required functionality of structural coverage collecting tools, which is necessary to provide their compliance with the DO-178C objectives.

Nowadays there is an actual problem in aviation industry - how to make the development of complex safety-critical systems certifiable according to international and domestic standards and regulations like DO-178C, DO-254, ARP 4754A, ARP 4761 etc. In the article configuration management process from the development lifecycle of DO-178C is considered as the main source of criteria for the development tool selection. Selected criteria can be applied to software tool, which supports entire development lifecycle of aviation software, as well as to software tools supporting some individual lifecycle processes. The activities of configuration management process provide work with all project lifecycle data, its storage, integrity, security, manageability and information support for data exchange between the remaining lifecycle processes, maintenance of the history of changes etc. Compliance with the principles of the configuration management process allows project managers to control development, ensure the required quality and reliability of the product; also, its certifiability and the necessary level of confidence in security, reduce financial and time development costs. As example of using criteria one of the most widely known in industry software tool for requirements development and management was analyzed for compliance with the chosen criteria.

If we wish to use an automatic code generator for the modelbased development of a safety-critical system, how can we gain sufficient confidence in the correctness of the tool? For a tool like a code generator, which could insert an error into an airborne system, the US Federal Aviation Administration (FAA) requires the highest level of tool qualification [2], Tool Qualification Level 1 (TQL-1), if the tool is going to be used for a Level-A subsystem (one whose failure could be catastrophic). Achieving TQL-1 for such a code generator is analogous to achieving Level A certification for an embedded software component, but the lines of code in the tool can be substantially greater. In this paper we describe approaches to manage the complexity of specification and testing required for Level-1 qualification of a tool like an automatic code generator, a tool which includes multiple phases that transform an input model into optimized generated code.

International audience; As the number of embedded systems has grown regularly over the past decades, the development and certification costs of safety-critical software has increased accordingly. For the aeronautics industry, certification activities are covered by DO-178C, which provides guidance for developing airborne software; and its companion document DO-330 covers the qualification of tools used for the development of such software. In this paper, we present ASTERIOS , a solution for the design, generation and execution of safety critical real-time applications; then we present the certification strategy we advocate for systems developed using our technology. This strategy relies on the use of an automated verification tool called ASTERIOS Checker , qualified in accordance with DO-330. This paper presents the technology behind the code generation engine of ASTERIOS and the verification activities automated by ASTERIOS Checker. It shows how the use of such an automated, qualified tool enables to benefit from design abstractions and relatively complex code generation engines while developing certified systems at the highest level of certification.

Software development in safety-critical domains is dictated by software standards, such as "Software Considerations in Airborne Systems and Equipment Certification" (DO-178C). This standard is an acceptable means of compliance for achieving the required level of software safety in aviation. In addition to software safety, the security aspects of cyber-physical systems has become increasingly important in recent years, especially for unmanned aircraft systems with an increasing number of autonomous functions. The importance of this topic has grown with recent updates to security standards in 2018 and new regulations proposed by EASA in 2019. However, in literature, software safety and cybersecurity often get handled completely separate. Since most software engineers in aviation need to consider software safety and the corresponding DO-178C standard in some form, this work offers an introduction to the more recent software security standards. To do this, a brief overview of software standards as well as security standards is presented. The focus of the comparison between software safety and cybersecurity will be on "Airworthiness Security Process Specification" (DO-326A), as well as "Airworthiness Security Methods and Considerations" (DO-356A), since these standards, similar to DO-178C, also handle the initial airworthiness considerations. Additional standards, such as the standard "Information Security Guidance for Continuing Airworthiness" (DO-355) and others will also be introduced.

ARP 4754A (Guidelines for Development of Civil Aircraft and Systems) promotes modeling and simulation for aircraft systems integration, requirements validation and implementation verification. DO-331, the model-based development and verification supplement to DO-178C (Software Considerations in Airborne Systems and Equipment Certification) further endorses simulation for verification of Specification Models, Design Models and executable code. While both state that the quality of simulation should be assured, there is no particular guidance for its qualification. This paper investigates the application of IEEE Recommended Practice for Distributed Simulation Engineering and Execution Process (DSEEP) for the qualification of simulation as a tool for airborne systems engineerinng.

Avionics systems are relying more on software to control their behaviour. However, engineering such software is a complex task. Even more so due to their safety-critical nature. Aviation authorities require suppliers to provide appropriate safety assurance through the certification of compliance with DO-178C to a determined software design assurance level. Such a concern is leading the avionics software industry to consider and incorporate effective engineering methods that can support them in their certification endeavours. This paper presents a domain specific modelling language (DSML) providing a documentation infrastructure that enforces certification information mandated by DO-178C and its supplements according with the software's design assurance level. Focus is given to the conceptual model of DO-178C and its supplements, which lies behind the proposed DSML to support the features it delivers. The DSML was built and implemented as a UML profile. Three different use cases for the DSML are illustrated in an avionics case study.

This paper provides a real example of applying COCOMO II as an estimation technique for the required software development effort in a safety-critical software application project following the DO-178C processes. The main goal and contribution of the case study is to support the research on software effort estimation and to provide software practitioners with useful data based on a real project. We applied the method as it is, by correlating the effort multiplier factors with the complexity and objectives introduced by the DO-178C level A application, resulting in an estimated effort. The rationales for each scale factor and effort multiplier selection were also described in detail. By comparing the estimated values with the actual required data, we found a magnitude of relative error (MRE) of 40% and provided alternatives for future work in order to increase the effort estimation accuracy in safety-critical software projects.

The RTCA/DO-330 “Software Tool Qualification Consideration” is released after the RTCA/DO-178B was widely used for tool qualification in the latest 20 years. In the RTCA/DO-178C collection, the RTCA/DO-330 is used together with RTCA/DO-178C to define the tool qualification requirements for airborne software development. This paper compares and analyses the different requirements in RTCA/DO-178B and RTCA/DO-178C+DO-330 to provide an indication of what are the new requirements and what has not been changed. For those unfamiliar with the tool qualification requirements in RTCA/DO-178C and RTCA/DO-330, this paper serves to provide an entry point to this new certification guidance.

In software development, testing often takes more than half the total development time (Pan 1999). Test case design and execution of test procedures consume most of the testing time. Thus, automatically generating test cases and automatically detecting errors in test procedures prior to execution is highly advantageous. This thesis proposes a new approach to further automate test case design and the test procedure development process. Several open-source products exist to automate test case design, but they have limitations including test cases that do not trace back to models; test cases that are not reusable for libraries; and limiting test cases to generation on their own test environment. This limits their support for the important, new avionics standard, DO-178C (RTCA 2012). The first contribution of the thesis is a technique for test code generation that, compared to existing products, is faster, provides improved traceability to models, and supports reusable test procedures that can be generated on any testing environment. To address the current limitations, the new approach utilizes the Simulink Design Verifier and an open-source constraint solver to generate test cases. The technique allows each test case to be traced back to an expression and to the original model. Detecting errors in manually written test procedures before testing starts is also critical to efficient verification. It can save hours or even days if errors are detected in the early test procedure design stage. However, analysis done here of a set of open source code analysis tools shows that they cannot detect type and attribute errors effectively. The second contribution of the thesis is to develop a static code analyzer for Python code that detects bugs that could cause automated test procedures to crash. The analyzer converts a Python code to an abstract syntax tree and detects all type and attribute errors by

As with many of the products and systems that pervade us, aircraft rely more and more on software for controlling the behaviour of their systems. In consequence, the field has seen increased work around more up-to-date, effective software engineering technologies for aiding avionics software providers in reducing software and development complexities and supporting them in their certification endeavours. However, there is a lack in the literature of reusable, comprehensive references about avionics software developments in conformance with DO-178C. Moreover, there is a need for a benchmark specification to support the evaluation of proposed engineering approaches in the field. This paper presents a software development case study of an avionics control software for a landing gear system. All the documentation for the software's requirements specification and design has been developed to conform with the DO-178C guideline and the applicable DO-331 and DO-332 supplements for model-based and object-oriented development, respectively. A requirements specification and design methodology is proposed and followed for the construction of the software in the case study. Furthermore, the paper discusses the observations, and challenges and issues experienced throughout the process.

Safety critical avionics software is a natural application area for formal verification. This is reflected in the formal method's inclusion into the certification guideline DO-178C and its formal methods supplement DO-333. Airbus and Dassault-Aviation, for example, have conducted studies in using formal verification. A large German national research project, Verisoft XT, also examined the application of formal methods in the avionics domain. However, formal methods are not yet mainstream, and it is questionable if formal verification, especially formal deduction, can be integrated into the software development processes of a resource constrained small or medium enterprise (SME). ESG, a Munich based medium sized company, has conducted a small experimental study on the application of formal verification on a small portion of a real avionics project. The low level specification of a software function was formalized with ACSL, and the corresponding source code was partially verified using Frama-C and the WP plugin, with Alt-Ergo as automated prover. We established a couple of criteria which a method should meet to be fit for purpose for industrial use in SME, and evaluated these criteria with the experience gathered by using ACSL with Frama-C on a real world example. The paper reports on the results of this study but also highlights some issues regarding the method in general which, in our view, will typically arise when using the method in the domain of embedded real-time programming., Comment: In Proceedings F-IDE 2015, arXiv:1508.03388

The rapid growth in the use of software in airborne systems and equipment in the early 1980s resulted in a need for industry-accepted guidance for satisfying airworthiness requirements [1]. To assure the reliability of the software and to ultimately ensure the safety of passengers, the U.S. Federal Aviation Administration (FAA) has imposed software certifcation suited to the development of safety-critical systems. The FAA has accepted guidelines developed by the Radio Technical Commission for Aeronautics (RTCA) that respond to the necessity of reliability and safety, which are vital in this feld: DO-178B/EUROCAE ED-12B (DO-178B), titled Software Considerations in Airborne Systems and Equipment Certifcation [1]. DO-178B prescribes design assurance guidance for airborne software. The aim of DO-178B is to assure that software developed for avionics systems is reliable and safe to use in fight [2].