Courtois Justifying the Dependability of Computer-based Systems

With Applications in Nuclear Engineering
1. Auflage 2008
ISBN: 978-1-84800-372-9
Verlag: Springer-Verlag
Format: PDF
Kopierschutz: Adobe DRM (»Systemvoraussetzungen)

E-Book, Englisch, 323 Seiten

Safety is a paradoxical system property. It remains immaterial, intangible and invisible until a failure, an accident or a catastrophy occurs and, too late, reveals its absence. And yet, a system cannot be relied upon unless its safety can be explained, demonstrated and certified. The practical and difficult questions which motivate this study concern the evidence and the arguments needed to justify the safety of a computer based system, or more generally its dependability. Dependability is a broad concept integrating properties such as safety, reliability, availability, maintainability and other related characteristics of the behaviour of a system in operation. How can we give the users the assurance that the system enjoys the required dependability? How should evidence be presented to certification bodies or regulatory authorities? What best practices should be applied? How should we decide whether there is enough evidence to justify the release of the system? To help answer these daunting questions, a method and a framework are proposed for the justification of the dependability of a computer-based system. The approach specifically aims at dealing with the difficulties raised by the validation of software. Hence, it should be of wide applicability despite being mainly based on the experience of assessing Nuclear Power Plant instrumentation and control systems important to safety. To be viable, a method must rest on a sound theoretical background.

Autoren/Hrsg.

Courtois, Pierre-Jacques

Inhaltsverzeichnis

1;Preface;8
2;Acknowledgements;10
3;Contents;12
4;PART I The Context;18
4.1;1 Introduction;19
4.2;2 Current Practices;24
4.3;3 Axiomatic Justification and Uncertainty;27
4.4;4 Justification and Dependability Case;31
4.4.1;4.1 Cost Minimization and the Proportionality Principle;32
4.4.2;4.2 Risk-based Assessment;33
4.4.3;4.3 Two Illustrative Case Studies: A Process Instrumentation (SIP) and a Radioactive Materials Handling System;33
5;PART II Prescriptions;35
5.1;5 Requirements, Claims and Evidence;36
5.1.1;5.1 Where to Start? The First Foundation of Dependability Justification;36
5.1.2;5.2 The Initial Dependability Requirements (CLM0);37
5.1.3;5.3 The Other Foundation: The System Input-Output Preliminary Requirements;41
5.1.4;5.4 Primary Claims;42
5.1.5;5.5 Differences Between Dependability Requirements and Claims;43
5.1.6;5.6 Evidence and Model Assumptions.;45
5.1.7;5.7 How to Organize Evidence? A Four-level Structure;46
5.1.8;5.8 How Are the Four Levels Related? Levels of Causality;49
5.1.9;5.9 Examples;52
5.2;6 Arguments, Syntax and Semantics;54
5.2.1;6.1 Claim Assertions;54
5.2.2;6.2 White, Grey and Black Claims;55
5.2.3;6.3 The Inductive Justification Process;56
5.2.4;6.4 The Conjunctive Property;59
5.2.5;6.5 The Syntax of an Argument;62
5.2.6;6.6 Claim and Argument Semantic Aspects;65
5.3;7 Axiomatic Principles and Limits;71
5.3.1;7.1 Claim Justifiability;71
5.3.2;7.2 Evidence Plausibility and Weight;73
5.3.3;7.3 The Ineluctability of Consensus;74
5.3.4;7.4 Epistemic Versus Stochastic Uncertainty;76
5.3.5;7.5 Claims on Product Versus Evidence from Process;79
5.3.6;7.6 Logics of Prevention, Precaution and Enlightened Catastrophism;80
5.3.7;7.7 Concluding Remarks on Claims, Arguments, Evidence;81
6;PART III Descriptions;83
6.1;8 Structures and Interpretations;84
6.1.1;8.1 The Roles of Models in Dependability Assessment;85
6.1.2;8.2 Basic Model Notions;86
6.1.3;8.3 On Descriptions and Interpretations;90
6.1.4;8.4 Mathematical Structures;92
6.1.5;8.5 System Structures;93
6.1.6;8.6 L-Interpretations;95
6.1.7;8.7 The Formal Definition of a Model;96
6.1.8;8.8 Validation and Satisfiability Obligations;97
6.1.9;8.9 Interdependencies Between Structures of Different Levels;111
6.1.10;8.10 Interdependencies Between Languages of Different Levels;118
6.1.11;8.11 The Tree of Sub-structures Dependencies;121
6.1.12;8.12 A General Multi-level Justification Framework;122
6.1.13;8.13 Design Abstractions;123
6.1.14;8.14 Recommendations for Design and Validation Models;124
6.2;9 Embedded Computer System Structures;127
6.2.1;9.1 States, Events and Other Basic Notions;128
6.2.2;9.2 Notation;130
6.2.3;9.3 Level -0. Environment Requirements, Events and Constraints;131
6.2.4;9.4 Level -1. System-Environment Interface;133
6.2.5;9.5 Level-2. Computer System Architecture;161
6.2.6;9.6 Level-3. Design;197
6.2.7;9.7 Structure of the Operation Control;226
6.2.8;9.8 Guidance Provided by the System Substructure Tree;248
6.2.9;9.9 Concluding Remarks: Model Inter-relations and Preservation Properties;249
7;PART IV Methodological Implications;253
7.1;10 Pre-existing Systems and Components;254
7.1.1;10.1 Pre-existing Components;255
7.1.2;10.2 Composability and Re-use of Arguments;255
7.1.3;10.3 Guaranteed Services and Rely Conditions;257
7.1.4;10.4 The System-Component Interface Substructures;259
7.1.5;10.5 Documentation;272
7.1.6;10.6 Concluding Remarks and Justification Issues;274
7.1.7;10.7 Criticality Degrees and Integrity Levels;277
7.2;11 Construction Methods;278
7.2.1;11.1 Dependability Case Construction Rules;278
7.2.2;11.2 FFP (Functions/Failures/Properties) Method;287
7.3;12 Postface;292
7.4;Appendix A The SIP System;296
7.4.1;A.1 Description;296
7.4.2;A.2 Plant, Technology and Safety Replacement Constraints;298
7.4.3;A.3 Dependability Requirements (CLM0) and Primary Claims;299
7.4.4;A.4 Primary Claims on Software CCF’s;300
7.4.5;A.5 Software Architecture and Design. Claims and Evidence;301
7.5;Appendix B Automated Material Handling System;304
7.5.1;B.1. Description;304
7.5.2;B.2 Dependability Requirements (CLM0);305
7.5.3;B.3 Constraints and Postulated Initiating Events;307
7.5.4;B.4 Preliminary Specifications and Primary Claims;307
8;References;317
9;Index;324