CSR: EHS: Assurance-Based Development of Critical Embedded Systems

关键系统的构建方式不仅要足够可靠，而且要充分可靠。保证用例是一个论证，它演示了由系统开发工作（测试结果、静态分析结果等）产生的具体证据如何结合起来支持系统是足够可靠的结论。保证案例还记录了对每一项证据作出结论的理由。在发生非随机事件的故障时，可以检查此记录以发现导致发布有缺陷系统的错误推理，从而帮助开发人员纠正系统。以避免在未来的开发工作中犯类似的错误。这项研究正在为基于保证的开发开发方法，该方法将系统的开发与保证案例的开发结合起来，以便在做出决策时，为每个开发决策的可靠性影响提供明确的标准。对可靠性保证的需求驱动着系统开发，引导开发人员做出选择，从而产生所需的可靠性和该可靠性的证据。在整个开发过程中对可靠性进行明确的评估，也有助于发现和避免潜在的保证困难，而不是在开发完成之后。当它们更难解决的时候。此外，了解系统每个部分的保证义务事件将使开发人员能够灵活地部署昂贵的技术，例如仅在保证需要它的组件上部署形式化验证。

Critical systems should be built in a manner that makes them not only adequately dependable, but demonstrably adequately dependable. An assurance case is an argument that demonstrates how the specific evidence resulting from system development efforts (test results, results of static analysis, etc.) combine to support the conclusion that the system is adequately dependable. The assurance case moreover documents the rationale used to draw conclusions about each piece of evidence. In the event of a failure that is not a random event, this record can be examined to discover the faulty reasoning that led to the release of the flawed system, thus helping developers to redress the system?s flaws and to avoid making similar mistakes in future development efforts. This research is developing methods for Assurance Based Development that couples the development of the system with the development of its assurance case so that explicit criteria for the dependability impact of each development decision are available at the time the decision is made. The need for assurance of dependability drives system development, leading developers to make choices that give rise to both the needed dependability and evidence of that dependability. The explicit evaluation of dependability throughout the development process also facilitates detection and avoidance of potential assurance difficulties as they arise, rather than after development is complete?when they are much harder to address. Furthermore, knowing the assurance obligation incident on each part of the system will give developers the flexibility to deploy expensive technology, such as formal verification, only on components whose assurance needs demand it.