F-22 Raptor - Universität Paderborn

Transcription

Universität Paderborn
AG Softwaretechnik
Prof. Dr. W. Schäfer
AG Softwaretechnik
F-22 Raptor
Model-Based Software Development and
Automated Code Generation for Safety-Critical Systems
Cause:
Bug in Flight Control Software
for the Seminar
„Advanced Topics in Software Engineering for Safety-Critical Systems“
Author: Robert Traussnig
Advisor: Dr. Holger Giese
2 MLOC Ada Code
7 Billion Dollars Cost for Software
20 Years Software Development Time
Paderborn, July 2004
1
Automated Code-Generation for Safety-Critical Systems
Agenda
AG Softwaretechnik
1. Motivation
1. Motivation
2. Historical Overview and Trends
3. Model Based Software Development
4. Application: Airbus Industries
5. Standards, Qualification and Certification
6. SCADE
7. Outlook and Conclusion
2
AG Softwaretechnik
- growing complexity of safety-critical software systems
- increasing development time and cost vs. time-to-market
- verification activities are cost-intensive and time-consuming
- software quality needs to be improved
3
4
1
2. Historical Overview and Trends
AG Softwaretechnik
AG Softwaretechnik
70s
- Manual Coding: Machine Code, Assembly
80s
Proof
Requirements and
Design Document
-Structured Programming: C, Ada (Subsets for
Safety-Critical Applications, eg. SPARKAda)
Software Model
Simulation
90s
10s
- Model-Based Software Development
e.g. SCADE
ion
at
lid
on
Va d cati
an rifi
Ve
00s
- Object-Oriented Programming
e.g. FAA OOT Initiative
5
3. Benefits of Model Based SW Development
AG Softwaretechnik
Automated Qualified
Code Generator
Source
Code
6
AG Softwaretechnik
UML (Unified Modelling Language) in FUJABA tool:
- Model is the software specification: it is the unique point-of-reference
in the project
- Sourcecode is automatically generated from the model with a
(qualified) Code Generator
- Code is correct and up-to-date by construction
Just Draw It!
- Documentation is automatically generated from the model: it is
correct and up-to-date by construction
- Model can be used for simulation, using the same code as the actual
implementation
- Formal proof techniques can be applied to the model to detect bugs
or prove safety properties
7
8
2
AG Softwaretechnik
AG Softwaretechnik
3. From the V-Model to the Y-Model
Manual Coding
Programming Code
Standard Automatic
Code Generator
Generating Code
Qualified
Code Generator
No Code Test
Design Verifier
9
AG Softwaretechnik
Automated Design
Verification
Time
10
- average development & test of 10.000 Lines of Code (KLOC)
of DO-178 level B avionics software: 16 man-years
AG Softwaretechnik
On-Board Software
20
- cost of a major bug is between $1M - $500M
15
-> Airbus decided in the early 80‘s to introduce automated code
generation.
MBytes
- cost of a minor bug detected in flight is between $100K - $500K
10
5
0
A 310 (1970s)
Source: Esterel Technologies
A 320 (1980s)
A 340 (1990s)
11
12
3
AG Softwaretechnik
AG Softwaretechnik
Errors detected per 100 KBytes of code
500
Errors
400
300
70 % ACG Code
200
100
A340/600 FCSC (Flight Control Secondary Computer):
0
70 % automatically generated code
50 % reduction in development cost
reduction in modification cycle time by factor 3
A 310 (1970s)
A 320 (1980s)
A 340 (1990s)
“No software bug ever detected in flight (including flight test) since the beginning of
the use of ACG for Fly-By-Wire software.” [F. Pothon, Airbus France]
13
5. Standards, Certification and Qualification
AG Softwaretechnik
14
AG Softwaretechnik
DO 178B Software Criticality Levels
Relevant Standards for Safety-Critical Software:
- RTCA DO-178B (Civil Aircraft), 1980 and 1992
Flight Control Systems
- ARP 4754
- IEC 61508 „Functional Safety of Electrical / Electronic /
Programmable Electronic Safety-Related Systems“
Backup Systems
Warning Systems
15
16
4
Qualifiable:
Qualified:
Certified:
AG Softwaretechnik
AG Softwaretechnik
Qualification Requirements of the Automated Code Generator (ACG)
with respect to DO-178B:
Tool has been developed in such a way that it is
“prequalified” or „qualifiable“ which means that it is
ready for qualification on specific projects
ACG defined as:
„Tool whose output is part of the airborne software and thus can
introduce errors“
On a per-project basis only. Tool Criticality Level
has to match the final Software Criticality Level.
DO-178B, section 12.2.1:
„If a software tool is to be qualified, the software development
processes for the tool should satisfy the same objectives as the
software development processes of airborne software.“
Legal recognition by the certification authority that a
product, service, organization or person complies with
the requirements.
„The software level assigned to the tool should be the same as
that for the airborne software it produces.“
17
6. SCADE: Introduction
AG Softwaretechnik
18
6. SCADE: Process
AG Softwaretechnik
•
•
•
•
SCADE (Safety Critical Application Development Environment)
Developed 1997 by Airbus Industries
Since 2001 development and distribution by Esterel Technolgies
De-facto Standard in Aerospace and Nuclear Powerplant
Industries
• Core Application for EU-SafeAir (ASDE: Avionics Systems
Development Environment) Project
19
20
5
6. SCADE: Software Requirements Specs
AG Softwaretechnik
6. SCADE: Software Requirements Specs
AG Softwaretechnik
II. Hierarchical and Concurrent State Machines:
I. Continous Control: Blockdiagrams for Continous Control
Traditional
Control Schema
Scade
Representation of
Control Schema
21
6. SCADE: Generated Safe Code
AG Softwaretechnik
7. Outlook and Conclusion
- no pointer artithmetic, no dynamic memory allocation
- no operating system call
- fixed length loops for arrays or delay
- code is traceable to the model: nodes, variables and constants
22
AG Softwaretechnik
- Model-Based Development is a new paradigm for
safety-critical software
- Automated Code Generation reduces time-to-market and
cost while increasing quality
- Aerospace Industry is driving the use of tools and definition
of new standards (FAA DO-178C including MBD and ACG)
- Limits and Constraints:
- few qualified tools available
- no qualified compiler yet
- manual coding still necessary
- steep learning curve for developers
23
24
6
AG Softwaretechnik
Thank you for the Attention!
Questions, please.
25
7

F-22 Raptor - Universität Paderborn

Transcription

Documents pareils

DGVFM-Minisymposium Schedule_DAV

European Master of Social Work and Social Economics (Sowosec

Presentation of Prof. Dr. Christian Daniel Assoun

Das Theodor Bilharz Research Institute, Ministry of High

Einladung zur Akademischen Feier - Evangelisch

Analyse de Tissu Biologique Histopathologie Numérique

Cancer Immunotherapies

Sagittal Balance Course

Mode-Automata based Methodology for Scade