2 nd Software Certification Consortium Workshop: Theoretical Basis for System and Software Engineering Practices and Certification

An increasingly important requirement for success in many domains is the ability to cost-effectively develop and/or purchase dependable (fit for purpose, safe, correct, secure, robust, maintainable) software for critical, often safety-critical, systems (e.g. pacemakers, health monitoring equipment, patient care planning and monitoring systems, automotive software, avionics software, core banking applications, financial reporting, nuclear reactors, etc.). Software errors in each of these domains continue to lead to catastrophic system failures, sometimes resulting in loss of life. A recent report by the U. S. National Academy of Sciences [1], concludes that new techniques and methods will be required in order to build future software systems to the level of dependability that will be required.... In the future, more pervasive deployment of software... could lead to more catastrophic failures unless improvements are made. Thus, society is increasingly demanding that software used in critical systems must meet minimum safety, security and reliability standards. Manufacturers of these systems are in the unenviable position of not having consistent and effective guidelines as to what constitutes acceptable evidence of software quality, and how to achieve it. This drives up the cost of producing these systems without producing a commensurate improvement in dependability. The Software Certification Consortium (SCC) was formed in 2007. Its members are drawn from regulators, industry and academia. Its mandate is to significantly improve the certification of systems that depend on software to perform their intended functionality. The workshop at CASCON was SCC's second Annual Workshop on Certification of Safety Critical Software. It brought together experts in fields essential to the certification of software. Certification of software-intensive systems is currently mainly process based. The reliance on standards and certification regimes that are process based has contributed to the unpredictable dependability of software-intensive systems. This situation has arisen primarily because we do not have the fundamental results necessary to evaluate the dependability of software products based on evidence tied to the product itself. These results are necessary to develop tools and methodologies for creating certifiable software intensive systems, as well as product focused approaches to certifying these systems [2,3]. The agenda of the workshop was developed to present various aspects of research related to this problem, in particular focusing on the Theoretical Basis for System and Software Engineering Practices and Certification, one of SCC's work items identified as of importance in accomplishing SCC's goals. A unique aspect of the workshop was the active participation of people from regulatory agencies, industry and academia. The workshop was organised to be very interactive, with each pair of presentations followed by an extended discussion period and the use of breakout sessions for focused analysis on specific issues identified during the discussions. SCC has established a work program to be pursued by its members and associates. Amongst the initial topics identified in this program was the Theoretical Basis for System and Software Engineering Practices and Certification. Subsidiary topics included: • understanding of software failures. • understanding of certification issues, both in relation to the needs of suppliers as well as those of regulators. A fundamental problem here is the over reliance on process based standards as opposed to direct assessment of the product. This contrasts starkly with other engineering domains. • developing an overarching theory of coverage across multiple techniques. For example, how can we make tradeoffs amongst different testing strategies and coverage levels. How can we trade off proofs of correctness vs strategies and coverage in testing. • system engineering bodies of knowledge, to support systematic development of systems including software. • software engineering bodies of knowledge, to support the systematic development of critical software. The workshop agenda included presentations by: regulators of safety-critical software based systems, who described the problems that they face, current thinking for dealing with those problems, and solutions that require more research; manufacturers of such systems, who described the impact of uncertainty in software quality and in the typical certification process, as well as suggestions for improving the situation; and academic researchers working on metrics and processes for certification of critical software, analytic tools, and human computer interfaces. An in-depth examination of human computer interface issues related to both safety and efficacy from the point of view of context and cognition showed the range of expertise that is required to deal adequately with these complex issues. Since so much of the content of the workshop was driven by discussion at previous SCC meetings, interested readers may benefit from a brief description of details about SCC and its focus that can be found in [3].

Fetched live from OpenAlex and de-inverted. Abstracts are not stored in this database: the inverted indexes are 8.6 GB of the frame’s 9.3 GB of text, and the host has 13 GB free.