Compositional V&V methods in the certification process Elena Gómez-Martínez

1. Compositional V&V methods in the certification process Elena Gómez-Martínez Universidad Politécnica de Madrid, Spain

2. Outline • Objectives • Safety Certification • Safety Properties • Compositional V&V Methods • Conclusions

3. Objectives

4. Objectives • To reduce the cost of qualification, certification and verification for compositional development. • The certification process includes: • Software verification • System verification • Safety • Unsafe conditions may arise in the interaction among components.

5. Objectives • A big amount of evidence to convince a certifying authority that a system is safe: • To integrate the certification into the development process • To enrich the system description with properties that are relevant to demonstrate the system’s safety. • Modelling languages must support the specification of Safety Properties.

6. Safety Certification

7. Safety Certification • Certification process: • The software system meets the requirements. • The software system works as expected. • The software system can be implemented. • The software system satisfies the stakeholders’ needs. • …but it depends on the application domain!

8. Safety Certification • Verification and Validation: • Process of checking that a system meets specifications and that is fulfils its intended purpose. • Verification: the process of evaluating a system or component to determine whether the products of a given development phase satisfy the specified requirements. • Validation: “the process of evaluating a system component during or at the end of the development process to determine whether is fulfils the intended purpose”.

9. Safety Certification • Verification: • walkthroughs and software inspections; • checking that software requirements are traceable to user requirements; • checking that design components are traceable to software requirements; • unit testing; • integration testing; • system testing; • acceptance testing; • formal proofs; • audit.

10. Safety Certification • Validation: • “end to end” verification.

11. Safety Certification Acceptance Tests User needs Software Requirements System Tests Architectural Design Integration Tests Unit Tests Detailed Design Code

12. Safety Certification

13. Safety Certification

14. Safety Certification • Static methods: • The structure of the model • The modelling techniques • Data and control flow within the model • Syntactical accuracy

15. Safety Certification • Static methods

16. Safety Certification • Dynamic methods: • Execution of the system and evaluation • Testing and simulation

17. Safety Certification • Dynamic methods:

18. Safety Properties

19. Safety Properties • Properties that are relevant to demonstrate the system’s safety. • They represent an abstraction of a particular functional or extra-functional aspect of a component.

20. Safety Properties • Types and values ranges. • Functional pre/post conditions. • Temporal contracts. • Valid interaction sequences. • Memory usage. • Execution time. • Communication resource usage.

21. Safety Properties • Compliance of code with a particular standard. • Failure propagation. • Behavioural model. • Fault-trees and FMEA tables. • Safety Integrity Level. • Traces and sequences of subcomponent interaction.

22. Compositional V&V methods

23. Compositional Verification • The complexity of large systems may undermine the feasibility of V&V methods. • A verification method is compositional when it proves the property of a (sub-)system on the basis of the properties proved on its components, without the need of additional information about the internal construction of these components

24. Compositional Verification M1 M2 Satisfies P1 Satisfies P2

25. Compositional Verification • Assume-guarantee reasoning: • To decompose a global property into local properties and to verify the local properties locally with respect to a component taking into account some assumptions on the other components and the environment. • Issues: • To identify those assumptions. • To have a compositional modelling framework that separates the notions of interface and behaviours: Composition Operators.

26. Compositional Verification • Component verification with environment abstraction: • Component environments are abstracted, to cope with verification complexity, and when part of the component environment is not available • Issues: • It is potentially unsound: depending on the behaviour of the external world. • It can yield impressive improvements in scalability.

27. Compositional Verification • Formal contracts specification languages: • The interface of components and their contracts: • Interface: what is visible of a component in terms of event and data ports. • Contract: what is visible in terms of semantics. • Contracts are typically expressed as pairs of first-order predicates. • Pre-conditions, post-conditions, and invariants of classes

28. Conclusions

29. Conclusions • V&V methods used to certification process. • Properties for safety certification. • Compositional methods for Component-Based system certification.

30. Thank you for your kind attention!