Qualification of a Model Checker for Avionics Software Verification
Formal methods tools have been shown to be effective at finding defects in safety-critical systems, including avionics systems in commercial aircraft. The publication of DO-178C and the accompanying formal methods supplement DO-333 provide guidance for aircraft manufacturers and equipment suppliers who wish to obtain certification credit for the use of formal methods for software development and verification.
However, there are still a number of issues that must be addressed before formal methods tools can be injected into the design process for avionics systems. DO-178C requires that a tool used to meet certification objectives be qualified to demonstrate that its output can be trusted. The qualification of formal methods tools is a relatively new concept presenting unique challenges for both formal methods researchers and software developers in the aerospace industry.
This paper presents the results of a recent project studying the qualification of formal methods tools. We have identified potential obstacles to their qualification and proposed mitigation strategies. We have conducted two case studies based on different qualification approaches for an open source formal verification tool, the Kind 2 model checker. The first case study produced a qualification package for Kind 2. The second demonstrates the feasibility of independently verifying the output of Kind 2 through the generation of proof certificates and verifying these certificates with a qualified proof checker, in lieu of qualifying the model checker itself.
KeywordsQualification Certification Model checking Software verification
This work was funded by NASA contract NNL14AA06C.
- 1.RTCA DO-178C: Software considerations in airborne systems and equipment certification, Washington, DC (2011)Google Scholar
- 3.RTCA DO-333: Formal methods supplement to DO-178C and DO-278A, Washington, DC (2011)Google Scholar
- 4.RTCA DO-330: Software tool qualification considerations, Washington, DC (2011)Google Scholar
- 6.Cofer, D., Klein, G., Slind, K., Wiels, V.: Qualification of formal methods tools (Dagstuhl seminar 15182). Dagstuhl Rep. 5, 142–159 (2015)Google Scholar
- 7.OCamlPro: Alt-ergo (2013). https://alt-ergo.ocamlpro.com/
- 8.AdaCore: SPARK Pro (2014). http://www.adacore.com/sparkpro/
- 10.Camus, J.L., DeWalt, M.P., Pothon, F., Ladier, G., Boulanger, J.L., Blanquart, J.P., Quere, P., Ricque, B., Gassino, J.: Tool qualification in multiple domains: status and perspectives. In: Embedded Real Time Software and Systems, Toulouse, France, 5–7 February, vol. 7991. Springer (2014)Google Scholar
- 13.NASA: Qualification of Formal Methods Tools Under DO-330 (2017). https://shemesh.larc.nasa.gov/fm/FMinCert/DO-330-case-studies-RC.html
- 14.Mebsout, A., Tinelli, C.: Proof certificates for SMT-based model checkers for infinite-state systems. In: FMCAD, Mountain View, California, USA, October 2016. http://cs.uiowa.edu/~amebsout/papers/fmcad2016.pdf
- 15.Halbwachs, N., Caspi, P., Raymond, P., Pilaud, D.: The synchronous dataflow programming language LUSTRE. In: Proceedings of the IEEE, pp. 1305–1320 (1991)Google Scholar
- 19.Gacek, A.: JKind - a Java implementation of the KIND model checker (2014). https://github.com/agacek/jkind