Patent Grant
7913232
The present invention relates to certifying software for safety-critical systems.
A safety-critical system is a computer, electronic, or electromechanical system that upon failure can cause injury or loss of human life, severe environmental damage, provide a large adverse financial impact, or other similar catastrophic event. A failure of a safety-critical system includes failure of the system to perform intended functions, failure to warn the operator(s) or customer(s) of an unsafe condition, or failure to display appropriate information. For example, an aircraft control system is considered a safety critical system since the failure of the system can result in the loss of passengers and aircraft crew.
To incorporate software into safety critical systems, standards, such as the Radio Technical Committee on Aeronautics (RTCA) guidance document DO-178B, entitled “Software Considerations in Airborne Systems and Equipment Certification”, were developed to focus on software dependence of safety-critical systems. By applying these standards during software development, safety hazards can be identified along with detecting conditions that can lead to the hazards.
In an aspect, the invention features a method of collecting information including retrieving a first criterion for certifying software for use on a safety-critical system, receiving user input information associated to the first criterion, determining if the input information aids in satisfying the first criterion for certifying the software for use on the safety-critical system, and providing output information to the user, the output information identifying if the first criterion is satisfied.
Embodiments may include one or more of the following. The received user input information may be requested. The user input information may include user-entered text. The user input information may include a user-entered file identifier. The file identifier may identify a file containing a block diagram model. The file identifier may identify a file containing information satisfying the first criterion. The method of collecting information may include storing the received user input information. The method of collecting information may include storing the output information. The method of collecting information may include processing the user input information into processed information satisfying the first criterion. The method of collecting information may include storing the processed information. The first criterion may include an objective of a guidance document. The guidance document may be the Radio Technical Committee on Aeronautics guidance document DO-178B. Providing the output information may include displaying the output information to the user. Providing the output information may include producing an output document. The safety-critical system may include an aircraft. The method of collecting information may include assigning a software level to the software. The assigned software level may be based on the software failing on the safety-critical system. Receiving user input may include using a qualified software tool. The method of collecting information may include using a qualified software tool. The method of collecting information may include repeating retrieving, receiving, determining, and providing for a second criterion, different from the first criterion.
In another aspect, the invention features a method including in a computer system, retrieving a first criterion for certifying the software for use on a safety-critical system, receiving user input information associated to the first criterion, determining if the input information aids in satisfying the first criterion for certifying the software for use on the safety-critical system, and providing output information to the user, the output information identifying if the first criterion is satisfied.
In another aspect, the invention features an article including a storage medium having stored thereon instructions that when executed by a machine result in the following: retrieve a first criterion for certifying software for use on a safety-critical system, receive user input information associated to the first criterion, determine if the input information aids in satisfying the first criterion for certifying the software for use on the safety-critical system, and provide output information to the user, the output information identifying if the first criterion is satisfied.
Embodiments may include one or more of the following. The received user input information may be requested. The user input information may include user-entered text. The user input information may include a user-entered file identifier. The file identifier may identify a file containing a block diagram model. The file identifier may identify a file containing information satisfying the first criterion. The article may include instructions that when executed cause the machine to store the received user input information. The article may include instructions that when executed cause the machine to store the output information. The article may include instructions that when executed cause the machine to process the user input information into processed information satisfying the first criterion. The article may include instructions that when executed cause the machine to store the processed information. The first criterion may include an objective of a guidance document. The guidance document may be the Radio Technical Committee on Aeronautics guidance document DO-178B. The article may include instructions that when executed cause the machine to provide the output information that may include displaying the output information to the user. The article may include instructions that when executed cause the machine to provide the output information that may include producing an output document. The safety-critical system may include an aircraft. The article may include instructions that when executed cause the machine to assign a software level to the software. The assigned software level may be based on the software failing on the safety-critical system. The article may include instructions that when executed cause the machine to receive user input using a qualified software tool. The article may include qualified software tool instructions. The article may include instructions that when executed cause the machine to repeat retrieving, receiving, determining, and providing for a second criterion, different from the first criterion.
In another aspect, the invention features a graphical user interface (GUI) including a workspace, a set of graphical semantics for displaying a first criterion for certifying software for use on a safety-critical system, a set of graphical semantics for receiving user input information to aid in satisfying the first criterion, and a set of graphical semantics for displaying output information to the user, the output information identifying if the first criterion is satisfied.
Embodiments may include one or more of the following. The received user input information may be requested. The graphical user interface may include a qualified software tool. The graphical user interface may include a set of graphical semantics for displaying a second criterion for certifying the software for use on the safety-critical system.
The invention may include one or more of the following advantages. By guiding a developer through each pertinent objective associated in developing a particular piece of software, the developer can determine if the appropriate certification information needed for certification has been collected. By guiding the developer through the pertinent objectives, the developer can also efficiently determine what certification information, if any, still needs to be collected to satisfy the objectives. Additionally, by processing information supplied by the developer into a form and structure needed for certification, the developer is removed from participating in additional processing.
Other features, objects, and advantages of the invention will be apparent from the description and drawings, and from the claims.
a-c are flow diagrams of a portion of the software certification process of
TABLE 1 is a table of failure condition categories, descriptions, and software levels from RTCA document DO-178B.
TABLE 2 is a table of an objective, objective applicability, objective output, and objective control categories.
TABLE 3-12 are certification tables from RTCA document DO-178B.
Referring to
The certification process 16 is used to assure that the jet engine control software 12 is safe and airworthy. By using the certification process 16 through the software wizard 14, the user (e.g., software developer) is guided through the objectives of the “Software Considerations in Airborne Systems and Equipment Certification,” guidance document (RTCA document Do-178B), incorporated by reference herein, so that certification information needed to satisfy the particular objectives associated with the jet engine control software 12 are collected. By prompting the user to provide information, the certification information needed for each appropriate objective is collected and processed into an appropriate form required for certification.
Guidance document DO-178B is typically used by civil aviation manufactures in the approval of software developed for airborne platforms. The purpose of the guidance document is to provide detailed guidelines for the production of software so that associated functions are performed at a level of confidence in safety to comply with airworthiness requirements. By complying with these requirements software products are produced by the appropriate state-of-the-practice methods.
To associate the objectives provided by the DO-178B guidance document to the safety-critical software, a system safety assessment is applied to the software development effort. A system safety assessment is a process that identifies hazards, failure conditions that lead to the hazards, and the effects of mitigating the hazards and failure conditions. Typically these assessments are performed by or in association with the FAA. As a result of the system safety assessment, the software development effort is assigned a software level. The system safety assessment task determines this software level based on a contribution of the software to the potential failure conditions and the severity of the potential failure conditions.
Referring to Table 1, five possible software levels A-E are shown in column 20 that can individually be assigned to a software development, such as the jet engine control software 12 (shown in
These software levels A-E in column 20 are used to define differing degrees of rigor that the FAA applies to certify software for a safety-critical system. To apply the different degrees of rigor for each particular software level, guidance document DO-178B lists objectives that must be met to certify safety-critical software. Referring to Table 2, one exemplary objective 26 is shown that illustrates a layout and structure of each objective provided by DO-178B. The objective 26 includes an objective number 28, a description of the objective 30, and a reference 32 to the particular paragraph in DO-178B where the objective is further detailed. Following the objective 26 portion, four columns 34-40 provide the applicability of the objective to the software levels A-D (shown in Table 1). Since software level E covers non-effective software in regards to safety-critical functions, no objectives are required. Included in each respective column 34-40 is a symbol, or blank space, that corresponds to a legend 42 shown with the table. For example, this particular objective 26 is applicable for software classified under software levels A, B, and C. However, for software classified under software level D this objective does not need to be satisfied. Also, since software classified under software level E has no effect on operation of the aircraft, the objective also does not have to be satisfied. As shown for this particular objective, level A and B software requires that the objective be satisfied with independence while level C software does not require independence. As defined in the guidance document DO-178B, independence is achieved when the verification activity is performed by a person(s) other than the developer of the item being verified. For software quality assurance, independence also includes the authority to ensure corrective action.
The next two columns 44, 46 following the applicability columns 34-40, moving left to right, describe the output required to satisfy the objective. The description column 44 provides the document which reports whether the objective is satisfied or not, based on the information provided by the user, and the reference column 46 identifies the paragraph within Chapter 11 of DO-178B that details the attributes of document listed in column 44. In some objectives the description column 44 provides the particular type for code (e.g., source code, object code, executable code, etc.) that needs to be collected to satisfy the particular objective and the reference column 46 identifies the paragraph in DO-178B that details the needed code.
The last four columns 48-54 of Table 2 associate the four software levels to control category 1 (CC1) and control category 2 (CC2) listed in the legend 42. The control categories define management activities, which are defined in the guidance document DO-178B, and are addressed in producing the outputs. Typically control category 1 (CC1) requires more management activities than control category 2 (CC2). For example, CC1 requires problem reporting and change control, however, CC2 requires only change control.
Although Table 2 provides the relationship between the four software levels and the objective 26, the guidance document DO-178B includes numerous other objectives associated with safety-critical software development that are dependent upon the software level of the software development. In general the more risk of failure associated to a particular software level, the more objectives have to be satisfied. For example, the number of objectives associated to each particular software level is listed below as provided from the guidance document DO-178B:
The guidance document distributes these objectives across various development processes that are used in producing software products for safety-critical systems. These development processes are the software requirements process, the software design process, the software coding process, and the integration process. Guidance document DO-178B also describes the integral processes that ensure correctness, control, and confidence of the software life cycles and their outputs. The integral processes are the software verification process, the software configuration management process, the software quality assurance process, and the certification liaison process. Each of these processes are described in detail in the guidance document DO-178B that also includes a description of the software planning processes that define and coordinate the activities of the software development and integral processes for the software being developed for the safety-critical system.
Each of the processes are associated with one or more objectives that are listed in Annex A of DO-178B and are organized by the development processes and integral processes mentioned above. Referring to Tables 3-12, the objectives, which are similar in structure and form to the objective shown in Table 2, are listed under the respective ten processes listed below.
Table 3: Software Planning Process
Table 4: Software Development Processes
Table 5: Verification of Outputs of Software Requirements Process
Table 6: Verification of Outputs of Software Design Process
Table 7: Verification of Outputs of Software Coding & Integration Processes
Table 8: Testing of Outputs of Integration Process
Table 9: Verification of Verification Process Results
Table 10: Software Configuration Management Process
Table 11: Software Quality Assurance Process
Table 12: Certification Liaison Process
By using the certification process 16 (shown in
Referring to
Along with guiding the user through the appropriate objectives, the certification process 60 also can produce, or assist the user in producing, outputs needed to satisfy the objectives associated to the particular software being developed. For example, the output to satisfy a particular objective may be a planning document, a design description, source code, executable code, or other type of output described in the guidance document DO-178B. Once the particular outputs have been collected that satisfy the objectives associated to the developed software, the outputs can be provided to the FAA, or other governing entity, for assessing conformance with DO-178B. Typically this conformance is determined through on-site reviews and/or desktop (data) reviews by regulatory authorities or appropriately designated industry representatives. By collecting the required outputs, each pertinent objective can be efficiently assessed to determine if the objective has been satisfied.
In some arrangements the certification process 60 uses an interactive tool, such as the software wizard 14 environment, to guide the user through the pertinent objectives associated to the safety-critical software under development. A series of dialog boxes associated with the software wizard 14 are used to enable the user to complete the certification process 60. Besides providing the appropriate objectives to the user, the wizard 14 can also provide an interactive tool to collect responses from the user to aid in satisfying the one or more displayed objectives.
The certification process 60 starts (62) when the software level assigned to the software under development for the safety-critical system is received (64). Typically the software level is determined by the FAA based on the nature of the software under development, however in some arrangements the user of the certification process 60 can enter the assigned level into the process. As mentioned above, the software levels are shown in Table 1 and range over software associated with catastrophic effects (software level A) to no effect on airliner operations (software level E). After the software level is received (64), the certification process 60 retrieves (66) the first objective that must be satisfied based on received software level. Referring briefly to Tables 3-12, each of the objectives that may be applicable to the received software level are shown. For example, objective 1 of table 3 is applicable to software levels A-D and the description of the objective, along with other appropriate associated information, would be retrieved by the certification process 60.
After the first objective has been retrieved (66), the certification process 60 displays (68) the objective to the user. In some arrangements the description of the objective is displayed to the user along with a response field for the user to input information that is used to satisfy the objective. After the objective has been the displayed (68), the certification process 60 waits to receive (70) input from the user to satisfy the objective that is currently displayed.
Referring to
Referring to
Referring to
Returning again to
After producing (74) the output, the certification process 60 stores (76) the output for later accessing by the user, or another party, to determine if the objectives have be met or not. After storing (76) the output, the certification process 60 determines (78) if all the appropriate objectives have been displayed to the user based on the particular software level assigned to the developed software. Referring briefly to Tables 3-12, the applicability for each of software level is provided and as mentioned may currently include up to 66 individual objectives.
Returning to
The invention can be implemented in digital electronic circuitry, or in computer hardware, firmware, software, or in combinations of them. The invention can be implemented as a computer program product, i.e., a computer program tangibly embodied in an information carrier, e.g., in a machine-readable storage device or in a propagated signal, for execution by, or to control the operation of, data processing apparatus, e.g., a programmable processor, a computer, or multiple computers. A computer program can be written in any form of programming language, including compiled or interpreted languages, and it can be deployed in any form, including as a stand-alone program or as a module, component, subroutine, or other unit suitable for use in a computing environment. A computer program can be deployed to be executed on one computer or on multiple computers at one site or distributed across multiple sites and interconnected by a communication network.
Method steps of the invention can be performed by one or more programmable processors executing a computer program to perform functions of the invention by operating on input data and generating output. Method steps can also be performed by, and apparatus of the invention can be implemented as, special purpose logic circuitry, e.g., an FPGA (field programmable gate array) or an ASIC (application-specific integrated circuit).
Processors suitable for the execution of a computer program include, by way of example, both general and special purpose microprocessors, and any one or more processors of any kind of digital computer. Generally, a processor will receive instructions and data from a read-only memory or a random access memory or both. The essential elements of a computer are a processor for executing instructions and one or more memory devices for storing instructions and data. Generally, a computer will also include, or be operatively coupled to receive data from or transfer data to, or both, one or more mass storage devices for storing data, e.g., magnetic, magneto-optical disks, or optical disks. Information carriers suitable for embodying computer program instructions and data include all forms of non-volatile memory, including by way of example semiconductor memory devices, e.g., EPROM, EEPROM, and flash memory devices; magnetic disks, e.g., internal hard disks or removable disks; magneto-optical disks; and CD-ROM and DVD-ROM disks. The processor and the memory can be supplemented by, or incorporated in special purpose logic circuitry.
The invention can be implemented in a computing system that includes a back-end component, e.g., as a data server, or that includes a middleware component, e.g., an application server, or that includes a front-end component, e.g., a client computer having a graphical user interface or a Web browser through which a user can interact with an implementation of the invention, or any combination of such back-end, middleware, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication, e.g., a communication network. Examples of communication networks include a local area network (“LAN”) and a wide area network (“WAN”), e.g., the Internet.
The computing system can include clients and servers. A client and server are generally remote from each other and typically interact through a communication network. The relationship of client and server arises by virtue of computer programs running on the respective computers and having a client-server relationship to each other.
In conjunction with
Also in conjunction with
Also, in conjunction with
Also, in conjunction with
Other embodiments are within the scope of the following claims.
| Number | Name | Date | Kind |
|---|---|---|---|
| 7139999 | Bowman-Amuah | Nov 2006 | B2 |
| 7228461 | Krietemeyer et al. | Jun 2007 | B2 |
| 7284274 | Walls et al. | Oct 2007 | B1 |
| 7337429 | Psaras et al. | Feb 2008 | B1 |
| 7380270 | Tracy et al. | May 2008 | B2 |
| 20040210873 | Tudor | Oct 2004 | A1 |
| Number | Date | Country | |
|---|---|---|---|
| 20040169591 A1 | Sep 2004 | US |
