On the Formal Development of Safety-Critical Software

Abstract

Abstract. We reflect on the formal development models applicable to embedded control systems in light of our experience with safety-critical applications from the aerospace domain. This leads us to propose two complementary enhancements to Parnas' four-variable model, one elaborating the structure outside the control computer, and the other elaborating the structure inside the control computer. We then identify several challenges which illustrate why formal development in this domain is difficult, and report our own progress in meeting these challenges. Finally, we outline the residual issues, which form the agenda for our future work.

Do I Need to Fix a Failed Component Now, or Can I Wait Until Tomorrow?

“…RELATED WORK While there has been work in formal modelling for safetycritical systems, especially in the context of formal system development [5], and runtime models for managing self adaptation and the complexity of evolving software behaviour while it is executing [6], there appears to be scant work on formal modelling to inform (human) operational decision making during the execution of safety-critical systems. One issue for quantitative analysis of dependable systems development is state space explosion and numerical simulation difficulties in the presence of rare events [7].…”