Testing safety-critical software systems.ppt

Testing safety-critical software systems Marcos Mainar Lalmolda Quality Assurance and Testing 20th November 2009 Contents What a safety-critical software system is Standards Programming features and languages Approaches on design Testing Conclusion What a safety-critical software system is A safety-critical software system is a computer system whose failure or malfunction may severely harm peoples lives, environment or equipment. Some fields and examples: Medicine (patient monitors) Nuclear engineering (nuclear power station control) Transport (railway systems, cars anti-lock brakes) Aviation (control systems: fly-by-wire) Aerospace (NASA space shuttle) Civil engineering (calculate structures) Military devices Etc. Safety-critical Standards Industries specific Medical device software: IEC 62304 Nuclear power stations: IEC 60880 Aerospace: AS9100A Airbone: DO178B … Scale of 5 safety integrity levels: 4 is very high, 0 not safety related. Safety engineering Programming features and languages (I) General principle: Try to keep the system as simple as possible. Programming features not recommended: Pointers and dynamic memory allocation/deallocation. Unstructured programming (gotos) Variant data Implicit declaration and initialisation Recursion Concurrency and interrupts Programming features and languages (II) Features which increase reliability: Strong typing Run time constraint checking Parameter checking Language to be avoided: C Language recommended: Ada Ada subset for safety-critical software: SPARK Other languages: increased overhead Approaches on design Formal methods Assume that errors exist and design prevention and recovery mechanisms. “Program verification does not mean error-proof programs […]. Mathematical proofs can also be faulty. So whereas verification might reduce the program-testing load, it cannot eliminate it” (F.P. Brooks, No Silver Bullet, 1987). Testing safety-critical software systems (I) Basic idea: Identify hazards as early as p