Assurance Aware Contract-based Design for Safety-critical Systems

Sammanfattning: Safety-critical systems are those systems whose malfunctioning can result in harm or loss of human life, or damage to property or the environment. Such systems usually need to comply with a domain-specific safety standard, which often require a safety case in form of an explained argument supported by evidence to show that the system is acceptably safe to operate in a given context. Developing safety-critical systems to comply with safety standards is a time-consuming and costly process. It can often be the case that the development of the safety case is more costly than the development of the system itself.Component-based development is a method that separates the development of the components of a system from the development of the system itself. The latter is done by composing reusable components that are developed independently of the system. Safety-critical systems require that the safety case of such components is integrated in the overall safety case of the system. For this purpose, the reusable components, together with their safety case, can be described via specifications called contracts. By checking the contracts of each component of the system against each other, it is possible to determine if the components can be composed together and still fulfil the contract specifications. Contract-based design combined with component-based development has the potential to reduce the cost and time needed to develop both the system and the accompanying safety case. Such contract-based design can then be used to facilitate reuse of parts of the system as well as verifying that the system fulfils certain requirements. While contract-based design can be used to verify that a system meets certain requirements based on its contract-specification, actually assuring that the system behaves according to the verification results require additional evidence. Hence, reuse of safety-relevant components via contract-based design is not sufficient without the reuse of the accompanying safety case artefacts, which include both the safety argument and the supporting evidence.In this thesis we focus on developing the notion of safety contracts that can be used to make a contract-based design aware of the needs of safety assurance. The goals of such assurance aware contract-based design are to promote reuse of the assurance-related artefacts such as arguments and evidence, as well as to automate creation of parts of the safety assurance case. To address this, we explore the following research goals in more detail: (1) to facilitate automated contract-driven assurance, (2) to facilitate reuse of safety-relevant components and their accompanying assurance-relevant artefacts, and (3) to align such assurance-aware contract-based design with existing failure logic analysis. To meet the first goal, we identify the additional information needed for contract-based assurance and structure it in form of argumentation patterns of reusable reasoning. Then, we define a meta-model to connect the system modelling elements related to the contracts with the safety case elements, such as evidence and arguments. Based on this meta-model, we define an algorithm for automated instantiation of the proposed argumentation patterns from system models compliant with the proposed meta-model. To facilitate reuse of the assurance-related artefacts (goal (2)), we define variability on the contract level to distinguish between contracts that are relevant for all systems and those that are system-specific. Furthermore, we align the assurance-aware contract-based design with the ISO 26262 automotive safety standard and its reuse concepts. Finally, in addressing the third goal, we connect the assurance-aware contract-based design with an existing failure logic analysis and show how such combination can be used to automate instantiation of existing argumentation patterns. In a number of real-world examples we demonstrate and evaluate the feasibility of our contributions.