A Model–Based Design Methodology with Contracts to Enhance the Development Process of Safety–Critical Systems

Lecture Notes in Computer Science

Törngren

2013

Abstract. ISO 26262 -"Road vehicles-Functional Safety" is a standard for the automotive industry, administered in an attempt to prevent potential accidents due to systematic and random failures in the Electrical/Electronic-system. ISO 26262 is based on the principle of relying on safety requirements as the main source of information to enforce correctness of design. We show that the contract theory from the SPEEDS FP6 project provides a suitable foundation to structure safety requirements in ISO 26262. Contracts provide the necessary support to separate the responsibilities between a system and its environment by explicitly imposing requirements on the environment as assumptions, in order to guarantee the safety requirements. We show this by characterizing two levels of safety requirements with contracts for an industrial system where we also show how contract theory supports the verification of consistency and completeness of safety requirements.

Section: Introductionmentioning

confidence: 99%

Structuring Safety Requirements in ISO 26262 Using Contract Theory

Lecture Notes in Computer Science

Törngren

2013

“…1, there already exist approaches where contract theory is used to provide tool support. For example, contracts theory is used to provide tool support for safety analyzes in [19], safety certification in [69], modelbased design in [5], and failure propagation modeling in [56,57]. More similar to the present paper, the work [13,14] presents tool support for verifying contracts refinement, which in essence corresponds to verifying completeness.…”

Section: Related Workmentioning

confidence: 91%

“…2.2, and also condition (5). Figure 4 shows an example of when condition (5) is violated with respect to contract  �� Esys = ({ �� Esys },…”

Section: Theoremmentioning

confidence: 99%

Providing tool support for specifying safety-critical systems by enforcing syntactic contract conditions

2017

Requirements Eng

Functional safety standards such as IEC 61508 and ISO 26262 advocate a particularly stringent requirements engineering where safety requirements must be structured in a hierarchical manner and specified in accordance with the system architecture. In contrast to the stringent requirements engineering in functional safety standards, according to previous studies, requirements engineering in industry is in general of poor quality. Contracts theory has been previously shown to be suitable for supporting such a stringent requirements engineering effort; this support has also been implemented in tools. However, to use these contract-based tools, requirements must be formalized, which is a major challenge in industry. Therefore, to support current industrial requirements engineering practice and the stringent requirements engineering in functional safety standards, it is shown how tool support can be provided even when requirements, and also architectures, are not formalized. This is achieved by enforcing syntactic, yet formal, conditions in contracts theory. Despite the need for further validation, initial findings in an industrial case study indicate high potential in realizing the proposed support in an industrial setting.

“…Similar work to [3][4][5] is presented in [46] and in [35] with tool support [90], and also in a more applied setting in [91,92]. The use of theory [3][4][5] has been advocated in [10][11][12][13][14][15] and the use of contracts in general has been proposed for analyzes integration [93] and as a means to achieve functional safety in [94,95] and also in [96] with tool support [97]. Contract theory has also been extended both with modalities [98] in [12,41] and to a stochastic setting in [37,42].…”

Section: Contracts and Their Properties Compositionality Elements mentioning

confidence: 93%

Conditions of contracts for separating responsibilities in heterogeneous systems

2017

Form Methods Syst Des

A general, compositional, and component-based contract theory is proposed for modeling and specifying heterogeneous systems, characterized by consisting of parts from different domains, e.g. software, electrical and mechanical. Given a contract consisting of assumptions and a guarantee, clearly separated conditions on a component and its environment are presented where the conditions ensure that the guarantee is fulfilled-a responsibility assigned to the component, given that the environment fulfills the assumptions. The conditions are applicable whenever it cannot be ensured that the sets of ports of components are partitioned into inputs and outputs, and hence fully support scenarios where components, characterized by both causal and acausal models, are to be integrated by solely relying on the information of a contract. An example of such a scenario of industrial relevance is explicitly considered, namely a scenario in a supply chain where the development of a component is outsourced. To facilitate the application of the theory in practice, necessary properties of contracts are also derived to serve as sanity checks of the conditions. Furthermore, based on a graph that represents a structuring of a hierarchy of contracts, sufficient conditions to achieve compositionality are presented.