Verification and testing of safety-critical airborne systems: A model-based methodology

Abstract

In this paper, we address the issues of safety-critical software verification and testing that are key requirements for achieving DO-178C and DO-331 regulatory compliance for airborne systems. Formal verification and testing are considered two different activities within airborne standards and they belong to two different levels in the avionics software development cycle. The objective is to integrate model-based verification and model-based testing within a single framework and to capture the benefits of their cross-fertilization. This is achieved by proposing a new methodology for the verification and testing of parallel communicating agents based on formal models. In this work, properties are extracted from requirements and formally verified at the design level, while the verified properties are propagated to the implementation level and checked via testing. The contributions of this paper are a methodology that integrates verification and testing, formal verification of some safety critical software properties, and a testing method for Modified Condition/Decision Coverage (MC/DC). The results of formal verification and testing can be used as evidence for avionics software certification.

Complete formal verification of the PSTM transaction Scheduler

“…"Model checking is a technique for automatic verification of software and reactive system, and it consists of verifying some properties of the model of the system", see [7]. We selected three recent papers in order to illustrate formal verification state of the art [4], [5], and [6].…”

“…The paper [5] addresses the issues of safety-critical software verification and testing that are key requirements for achieving DO-178C and DO-331 regulatory compliance for airborne systems. The verification is performed by the symbolic model checker MCMAS+ that uses OBDDs.…”

“…However, as this paper shows, conducting traditional formal verification in two steps (described above) as was, for example, done in [1], [4], [5], and [6] is not sufficient. As will be elaborated in more detail in Section 1.1 (related work), the main problem with the traditional two-steps formal verification is that the formal model constructed in the first step is not directly tested.…”