CSR: EHS: Assurance-Based Development of Critical Embedded Systems

关键系统的建造方式应使它们不仅足够可靠，而且明显足够可靠。保证案例是一种论证，它展示了系统开发工作(测试结果、静态分析结果等)所产生的具体证据。结合起来支持系统足够可靠的结论。此外，保证案件还记录了对每一项证据作出结论所用的理由。在发生非随机事件的故障时，可以检查此记录以发现导致有缺陷的系统发布的错误推理，从而帮助开发人员纠正系统的S缺陷，并避免在未来的开发工作中犯类似的错误。这项研究正在开发基于保证的开发方法，将系统的开发与其保证用例的开发结合起来，以便在做出决策时可以获得每个开发决策的可靠性影响的明确标准。对可靠性保证的需求推动了系统开发，导致开发人员做出选择，以产生所需的可靠性和可靠性的证据。在整个开发过程中对可靠性的明确评估还有助于在潜在的保证困难出现时进行检测和避免，而不是在开发完成之后？？当这些困难更难解决时。此外，了解系统每个部分上的保证义务事件将使开发人员能够灵活地仅在保证需要的组件上部署昂贵的技术，如正式验证。

Critical systems should be built in a manner that makes them not only adequately dependable, but demonstrably adequately dependable. An assurance case is an argument that demonstrates how the specific evidence resulting from system development efforts (test results, results of static analysis, etc.) combine to support the conclusion that the system is adequately dependable. The assurance case moreover documents the rationale used to draw conclusions about each piece of evidence. In the event of a failure that is not a random event, this record can be examined to discover the faulty reasoning that led to the release of the flawed system, thus helping developers to redress the system?s flaws and to avoid making similar mistakes in future development efforts. This research is developing methods for Assurance Based Development that couples the development of the system with the development of its assurance case so that explicit criteria for the dependability impact of each development decision are available at the time the decision is made. The need for assurance of dependability drives system development, leading developers to make choices that give rise to both the needed dependability and evidence of that dependability. The explicit evaluation of dependability throughout the development process also facilitates detection and avoidance of potential assurance difficulties as they arise, rather than after development is complete?when they are much harder to address. Furthermore, knowing the assurance obligation incident on each part of the system will give developers the flexibility to deploy expensive technology, such as formal verification, only on components whose assurance needs demand it.