The goal of this project was to develop a solution for safety-critical software product lines that partially automated the initial construction of a new product’s safety case. The project aimed to provide guidance to developers in the reuse of safety assets such as safety-case elements across multiple releases of a safety-critical product line as appropriate. We developed, experimentally evaluated, and delivered several new techniques toward this goal. 

Software product lines use structured reuse of software assets from existing products to reduce the time-to-market and development costs of new products in the line.  Many product lines are safety-critical, including the software in medical devices, airplanes, helping robots, and self-driving vehicles. A safety case is built for a new product that assembles evidence showing that it is safe for use when used as planned.  Constructing these safety cases is time-consuming and costly for industry and can be a drag on innovation.

As a product line grows, new products and versions can introduce unintended changes that are unsafe.  For example, new features (units of functionality in the software) often interact in ways that are contrary to the developers’ intent and may be unsafe.   New products frequently operate in new contexts, such as different users, platforms, or environments, so assumptions used in previous products may be inappropriately reused rather than updated in the new product.  This can jeopardize or even invalidate the safety case for the new product.   To address this, we collaboratively introduced and tested a new technique that uses the traceability required by many certifying bodies to identify assumptions that were omitted or incorrectly retained in new products.

We investigated an important class of change that increasingly challenges safety case construction, namely, the composition of potentially mismatched components, exemplified in the interaction between small unpiloted aerial vehicles and ground stations in an urban airspace. We collaboratively developed a general framework to construct interlocking safety cases between the individual unpiloted aerial vehicles and the urban airspace’s overarching safety case. We delivered algorithms to monitor and respond to changes that violated safety assumptions.

Toward automating the safety analysis for a new software product’s safety case, we developed techniques to automatically learn unsafe feature interactions earlier in the development process.  We did this using machine learning models based on similarity measures of the software assets of existing products in the product line. 

 We further developed a new approach that detects unsafe feature interactions using program analysis to extract machine-learning models from source code.  Where specifications of constraints on feature interactions are undocumented, the constraints are inferred using feature-related data-flow dependency information. We extended our work to highly configurable systems where very high numbers of options lead existing techniques to miss unsafe configurations.  We experimentally evaluated our solutions on product-line benchmarks and a real-world configurable system. The project contribution was to support developers by improving the detection of feature combinations in a new product or version that could interact in unsafe or unknown ways.

More broadly, the project developed new techniques for increasing the safety of a delivered software product-line system and decreasing the work needed to build its safety case.  The project trained two graduate students in product line and safety case research.  We worked with multiple undergraduate students to develop research and educational material inspired by a NASA astronaut jetpack product line and published a paper with several of them. We also developed a new undergraduate course in software system safety, which has now been taught three times.  The algorithms, experimental data, and software from this project are publicly available to support future research and transition to industry.

Last Modified: 07/24/2021
Modified by: Robyn R Lutz