Sviluppare per Certificare

Transcript

1 Sviluppare per Certificare Alcune considerazioni sulla Certificazione del Software Iapicca

2 Certificazione (definizioni coerenti con la terminologia adottata dall associazione SINCERT) Certificazione: attestazione, rilasciata da un organismo accreditato, atta ad assicurare, con un livello di confidenza precisamente definito, la conformità a requisiti prefissati di un determinato prodotto, servizio, processo, sistema di qualità o personale.

3 Certificazione di processo (Certificazione rispetto a norme di processo) Misura "formale" della qualità del prodotto tramite una certificazione mirata a stabilire che il processo di sviluppo ed il processo di verifica e validazione (riesami, test, etc.) siano svolti con le modalità, attività, tecniche e misure conformi ai requisiti della norma di riferimento.

4 Certificazione di prodotto misura "sostanziale" della qualità di prodotto tramite una certificazione, mirata a stabilire che il prodotto, operante in un ambiente operativo ben definito, risulti conforme rispetto alla specifica dei requisiti, spesso con particoalre riguardo a requisiti ritenuti importanti per quella classe di prodotti es. requisiti di sicurezza (safety)

5 Certificazione di prodotto a posteriori A fronte di una specifica richiesta di qualità da parte di un cliente si certifica che un prodotto esistente possiede tale qualità Es. omologazione secondo una normativa Certificazione da parte di un ente terzo Self-assessment in vista della certificazione

6 Certificazione a posteriori Testing Verifica formale Analisi statica

7 Testing Testing funzionale - sulla base di specifiche formali? Testing strutturale - richiede il codice sorgente Infattibilità teorica / pratica del testing esaustivo Livello di copertura strutturale Strumenti di supporto al testing (mediamente costosi)

8 Verifica formale Dimostrazione matematica che il codice (sorgente) soddisfa alcune specifiche formali Teoricamente indecidibile in generale spesso fattibile, con molte difficoltà complessità computazionale elevata skill specialistico strumenti di supporto scarsi, non commerciali oppure costosi

9 Analisi statica (sul codice sorgente) typechecking rispondenza a guidelines. correttezza parziale

10 Un possibile schema di certificazione di prodotto per un ente certificatore (provenienza: TUV)

11 Prepararsi alla certificazione per evitare i costi (enormi) di una certificazione completamente a posteriori occorre: riscrivere casi di test per moduli che non sono stati precedentemente testati recuperare le specifiche (formali) di tali moduli Re-engineering investire nel processo di sviluppo!!!!! quali tecniche adottare?. diamo un occhiata alla normativa CENELEC EN50128

12 Normativa CENELEC European Committee for Electrotechnical Standardization pren June 1997 Railway Applications: Software for Railway Control and Protection Systems

13 Software safety integrity levels (SIL) The required software safety integrity level shall be decided on the basis of the level of risk associated with the use of the software in the system and the system safety integrity level. Integrity Level Safety Integrity 4 Very High 3 High 2 Medium 1 Low 0 Non Safety-Related

14 Modello di ciclo di vita a V System Requirements Specification System Safety Requirements Specification System Architecture Description System Safety Plan Software Maintenance Phase Software Maintenance Records Software Change Records Software Assessment Phase Software Assessment Report A ogni passo del ciclo di sviluppo corrisponde un passo di validazione Software Planning Phase Software Development Plan Software Quality Assurance Plan Software Config Management Plan Software Verification Plan Software Integration Test Plan Software/hardware Integration Test Plan Software Validation Plan Software Maintenance Plan Software Requirements Spec Phase Software Requirements Specification Software Requirements Test Specification Software Requirements Verification Report Software Architecture & Design Phase Software Architecture Specification Software Design Specification Software Design Test Specification Software Architecture and Design Verification Report Software Validation Phase Software Validation Report Software/hardware Integration Phase Software/hardware Integration Test Report Software Integration Phase Software Integration Test Report Dipartimento interno o ente esterno per la V&V, testing, qualita. Indipendenza dai dipartimenti produttivi. Software Module Testing Phase Software Module Design Phase Software Module Test Report Software Module Design Spec Software Module Test Spec Software Module Verification Report Code Phase Software Source Code & Supporting Documentation Software Source Code Verification Report

15 Tecniche raccomandate dalla normativa CENELEC WEach technique or measure in the tables there is a requirement for each software safety integrity level (SWSIL), 1 to 4 and also for the non safety-related level 0. In this version of the document, the requirements for software safety integrity levels 1 and 2 are the same for each technique. Similarly, each technique has the same requirements at software safety integrity levels 3 and 4. These requirements can be: 'M' 'HR' 'R' '-' 'NR' 'F' This symbol means that the use of a technique is mandatory. This symbol means that the technique or measure is Highly Recommended for this safety integrity level. If this technique or measure is not used then the rationale behind not using it should be detailed in the Software Quality Assurance Plan or in another document referenced by the Software Quality Assurance Plan. This symbol means that the technique or measure is Recommended for this safety integrity level. This is a lower level of recommendation than an 'HR' and such techniques can be combined to form part of a package. This symbol means that the technique or measure has no recommendation for or against being used. This symbol means that the technique or measure is positively Not Recommended for this safety integrity level. If this technique or measure is used then the rationale behind using it should be detailed in the Software Quality Assurance Plan or in another document referenced by the Software Quality Assurance Plan. This symbol means that the use of this technique is forbidden.

16 Ruolo dei Metodi Formali nella normativa CENELEC Table A2 : Software Requirements Specification TECHNIQUE/MEASURE Ref SWSIL O SWSIL 1 SWSIL 2 SWSIL 3 SWSIL 4 1. Formal Methods including for example CCS, CSP, HOL, LOTOS, OBJ, Temporal Logic, VDM, Z and B B.30 - R R HR HR 2. Semi-Formal Methods D.7 R R R HR HR 3. Structured. Methodology including for example JSD, MASCOT, SADT, SDL, SSADM, and Yourdon. B.60 R HR HR HR HR Requirements 1. The Software Requirements Specification will always require a description of the problem in natural language and any necessary mathematical notation that reflects the application. 2. The table reflects additional requirements for defining the specification clearly and precisely. One or more of these techniques shall be selected to satisfy the Software Safety Integrity Level being used.

17 TECHNIQUE/MEASURE Ref SWSILO SWSIL1 SWSIL2 SWSIL3 SWSIL4 Table A4: Software Design and Implementation 1. Formal Methods including for example CCS, CSP, HOL, LOTOS, OBJ, Temporal Logic, VDM, Z and B B.30 - R R HR HR 2. Semi-FormaI Methods (incl. Statecharts, FSMs) D.7 R HR HR HR HR 3. Structured. Methodology including for example JSD, B.60 R HR HR HR HR MASCOT, SADT, SDL, SSADM and Yourdon. 4. Modular Approach D.9 HR M M M M 5. Design and Coding Standards D.1 HR HR HR M M 6. Analysable Programs B.2 HR HR HR HR HR 7. Strongly Typed Programming Language B.57 R HR HR HR HR 8. Structured Programming B.61 R HR HR HR HR 9. Programming Language D.4 R HR HR HR HR 10. Language Subset B HR HR 11. Validated Translator B.7 R HR HR HR HR 12. Translator Proven in Use B.65 HR HR HR HR HR 13. Library of Trusted/Verified Modules and Components B.40 R R R R R 14. Functional/ Black-box Testing D.3 HR HR HR M M 15. Performance Testing D.6 - HR HR HR HR 16. Interface Testing B.37 HR HR HR HR HR 17. Data Recording and Analysis B.13 HR HR HR M M 18. Fuzzy Logic B Object Oriented Programming B.68 - R R R R Requirements 1. A suitable set of techniques shall be chosen according to the software safety integrity level. 2. At software safety integrity level 3 or 4, the approved set of techniques shall include one of techniques 1, 2 or 3, together with one of techniques 11 or 12. The remaining techniques shall still be treated according to their recommendations.

18 TECHNIQUE/MEASURE Ref SWSILO SWSIL1 SWSIL2 SWSIL3 SWSIL4 Table A4: Software Design and Implementation 1. Formal Methods including for example CCS, CSP, HOL, LOTOS, OBJ, Temporal Logic, VDM, Z and B B.30 - R R HR HR 2. Semi-FormaI Methods (incl. Statecharts, FSMs) D.7 R HR HR HR HR 3. Structured. Methodology including for example JSD, B.60 R HR HR HR HR MASCOT, SADT, SDL, SSADM and Yourdon. 4. Modular Approach D.9 HR M M M M 5. Design and Coding Standards D.1 HR HR HR M M 6. Analysable Programs B.2 HR HR HR HR HR 7. Strongly Typed Programming Language B.57 R HR HR HR HR 8. Structured Programming B.61 R HR HR HR HR 9. Programming Language D.4 R HR HR HR HR 10. Language Subset B HR HR 11. Validated Translator B.7 R HR HR HR HR 12. Translator Proven in Use B.65 HR HR HR HR HR 13. Library of Trusted/Verified Modules and Components B.40 R R R R R 14. Functional/ Black-box Testing D.3 HR HR HR M M 15. Performance Testing D.6 - HR HR HR HR 16. Interface Testing B.37 HR HR HR HR HR 17. Data Recording and Analysis B.13 HR HR HR M M 18. Fuzzy Logic B Object Oriented Programming B.68 - R R R R Requirements 1. A suitable set of techniques shall be chosen according to the software safety integrity level. 2. At software safety integrity level 3 or 4, the approved set of techniques shall include one of techniques 1, 2 or 3, together with one of techniques 11 or 12. The remaining techniques shall still be treated according to their recommendations.

19 Table A5: Verification and Testing TECHNIQUE/MEASURE Ref SWSI LO SWSI L1 SWSI L2 SWSI L3 SWSI L4 1. FormaI Proof B.31 - R R HR HR 2. Probabilistic Testing B.47 - R R HR HR 3. Static Analysis D.8 - HR HR HR HR 4. Dynamic Analysis and Testing D.2 - HR HR HR HR 5. Metrics B.42 - R R R R 6. Traceability Matrix B.69 - R R HR HR 7. Software Error Effects Analysis B26 - R R HR HR Requirements 1. For Software Safety Integrity Level 3 or 4, the approved combinations of techniques shall be:- a) 1 and b) 3 and 4 or c) 4, 6 and 7 2. For Software Safety Integrity Level 1 or 2, the approved technique shall be 1 or 4.

20 Table A13: Dynamic Analysis and Testing (D.2) 1. Test Case Execution from Boundary Value Analysis B.4 - HR HR HR HR 2. Test Case Execution from Error Guessing B.2 1 R R R R R 3. Test Case Execution from Error Seeding B R R R R 4. Performance Modelling B R R HR HR 5. Equivalence Classes and Input Partition Testing B R R HR HR 6. Structure-Based Testing B R R HR HR

21 Table A15: Programming Languages (D.4) TECHNIQUE/MEASURE Ref SWSI LO 1. ADA B.62 R HR HR R R 2. MODULA-2 B.62 R HR HR R R 3. PASCAL B.62 R HR HR R R 4. Fortran 77 B.62 R R R R R 5. 'C' or C++ (unrestricted) B.62 R - - NR NR SWSI L1 SWSI L2 SWSI L3 SWSI L4 6. Subset of C or C++ with coding standards B.62 B.38 R R R R R 7. PL/M B.62 R R R NR NR 8. BASIC B.62 R NR NR NR NR 9. Assembler B.62 R R R Ladder Diagrams B.62 R R R R R 11. Functional Blocks B.62 R R R R R 12. Statement List B.62 R R R R R 11At Software Safety Integrity Level 3 and 4 when a subset of languages 1, 2, 3 and 4 are used the recommendation changes to HR. 2. For certain applications the languages 7 and 9 may be the only ones available. 3. At Software Safety Integrity Level 3 and 4 where a Highly recommended option is not available it is strongly recommended that to raise the recommendation to 'R' there should be a subset of these languages and that there should be a precise set of coding standards. 34.For information on assessing the suitability of a programming language see entry in the bibliography for 'Suitable Programming Language', B.62.

22 Sviluppare per Certificare... O Sviluppare Certificando

23 Una riflessione La normativa vista, come altre di settori diversi (avionico, RTCA DO178B), privilegia l adozione di tecnologie mature La certificazione secondo le EN50128 puo` sembrare (a ragione) eccessiva per il nostro ambito aziendale, e addirittura contraria agli investimenti fatti o che si pensa di fare sulle nuove tecnologie (Object-Oriented, UML,...) Ma: quanto ci costa la certificazione, mai definitiva, fatta sul campo dai nostri clienti? Investire nel miglioramento del processo di sviluppo adozione di metodologie e strumenti adeguati per dare un sufficiente grado di confidenza sulla qualità dei nostri prodotti, anche in assenza di un bollino

24 Anche le più recenti tecnologie mirate allo sviluppo rapido di prodotti non critici con bassi costi e buona qualità concordano in alcuni punti con la CENELEC: Approccio tipo XP (Extreme Programming): Associare ad ogni classe e ad ogni metodo della classe dei casi di test, possibilmente derivati da una specifica formale, e testare via via le classi che si integrano, ripetendo i test ad ogni cambiamento o aggiunta.