Bernd Fischer

Building Heterogeneous Safety Cases for Automatically Generated Code

Safety cases provide a mechanism for representing evidence-based arguments that a system is acceptably safe to operate in its intended context. We show how we can automatically combine diverse types of information from heterogeneous sources into a single integrated safety case for a system implemented using automatically generated software. The core argument structure of the safety case is generated from a formal analysis of automatically generated code, based on automated theorem proving, and driven by a set of formal requirements and assumptions. This is then extended by separately specified auxiliary information giving contexts, assumptions, justifications, and constraints, or additional forms of evidence derived from other verification activities, such as testing. The resulting safety case thus combines formal and informal argumentation and makes explicit assumptions which would otherwise be left implicit.

Formal Safety Certification of Auto-Generated Aerospace Software [invited]

Code generators can address many of the increasing demands placed on software in the aerospace industry, yet trust in the code produced by commercial generators is notoriously difficult to achieve and traditionally relies on qualification of the generator. We describe an alternative approach that directly ensures trust in each individual generated program, using a combination of three fully automated formal techniques: i.) the generation of safety proofs, ii.) the generation of documentation that explains the generated code, and iii.) the generation of hyperlinks between all the elements of the code generation and certification process. Our approach is integrated with the AutoFilter generator for state estimation code, but it could, in principle, also be integrated with commercial code generators such as RealTime Workshop.