Verification
Verification
ORGANISATION ORGANISATION
AC/323(IST-027)TP/31 www.rta.nato.int
AC/323(IST-027)TP/31 www.rta.nato.int
ISBN 92-837-1146-7
Single copies of this publication or of a part of it may be made for individual use only. The approval of the RTA
Information Management Systems Branch is required for more than one copy to be made or an extract included in
another publication. Requests to do so should be sent to the address on the back cover.
ii RTO-TR-IST-027
Validation, Verification and Certification
of Embedded Systems
(RTO-TR-IST-027)
Executive Summary
This report is the final report resulting from the deliberations of the NATO Research Task Group on the
Validation, Verification and Certification of Embedded Systems (IST-027/RTG-009). The report discusses
the important role of embedded systems in both the civil and military contexts. Given the importance, the
validation, verification and certification (VV&C) of such systems are of increasing concern. The report
discusses the current landscape of VV&C, expected evolution, and also identifies standards of note. The
report concludes with various conclusions and recommendations drawn from the task group’s
deliberations.
In general terms, the Task Group found that their discussions were not specific to embedded systems; the
problems of verification, validation and certification encompass many kinds of systems. The Task Group
observed that trust, in itself, is a sociological-technical matter; it is not attained wholly through technical
means.
The Task Group concluded that certification can be used successfully to increase our confidence in
systems. However, that confidence could be expensive. We have observed that certification is working
with bounded problems and has been particularly successful in the Avionics arena. However, we also note
a couple of cautionary aspects to the use of certification in the military realm. Furthermore, we found that
current technical capabilities are not well developed for the verification, validation and certification of
component reuse, for the rigorous predictability of the behavior of networks and system, nor for
determining the non-interference of multi-level critical processes.
Numerous research trends of VV&C methods were identified including the increasing use of Commercial-
Off-The-Shelf systems, increasing occurrence of systems of systems, an increasing number of
unharmonised standards, ongoing reality of striving for cheaper and faster systems, increasing adoption of
formal modeling and analysis techniques in industrial tools, and increased interest in correlating the threat
space with the VV&C techniques to be used.
Specifically, the Task Group recommends to NATO that it give serious consideration to the use of goal-
based approaches to the certification of systems; that when performing VV&C of “critical components”
the VV&C be performed and/or assessed by an independent third party; consider whether such parties
should be accredited; that objective guidance be provided for required V&V artifacts; that maximum
freedom of IT processes and techniques be provided within the scope of the VV&C framework; and that
the certification effort reflect the criticality of the system. For highly critical systems, it is recommended
that NATO insert formal modeling and reasoning into their development processes, insert advanced static
analysis techniques, and apply extensive testing.
RTO-TR-IST-027 iii
Validation, vérification et certification
des systèmes intégrés
(RTO-TR-IST-027)
Synthèse
Le présent rapport est le fruit des délibérations du Groupe de travail Recherches de l’OTAN sur la
validation, vérification et certification des systèmes intégrés (IST-027/RTG-009). Le rapport décrit le rôle
important des systèmes intégrés, tant dans la sphère civile que militaire. Compte tenu de leur importance,
la validation, la vérification et la certification (VV&C) de ces systèmes présentent un intérêt croissant. Le
rapport dresse un état des lieux de la VV&C actuelle, évoque l’évolution escomptée,
puis identifie les normes importantes. Le rapport s’achève en présentant diverses conclusions et
recommandations dérivées des délibérations du Groupe de travail.
De façon générale, le Groupe de travail a constaté que les débats ne portaient pas uniquement sur les
systèmes intégrés ; les problèmes de vérification, de validation et de certification affectent de nombreux
types de systèmes. Le Groupe de travail a découvert que, en soi, la confiance est une notion sociologico-
technique ; on ne l’acquiert pas entièrement par des moyens techniques.
Le Groupe de travail a conclu que la certification peut être utilisée avec succès pour optimiser notre
confiance envers les systèmes. Cependant, cette confiance peut s’avérer onéreuse. Nous avons remarqué
que la certification fonctionnait assez bien et qu’elle était particulièrement fructueuse dans le domaine de
l’avionique. Nous avons cependant relevé une certaine circonspection quant au recours à la certification
dans le domaine militaire. Par ailleurs, nous avons constaté que les moyens techniques actuels n’étaient
pas suffisamment matures pour vérifier, valider et certifier la réutilisation des composants, pour prévoir de
façon rigoureuse le comportement des réseaux et systèmes et pour déterminer la non-interférence des
processus critiques à niveaux multiples.
Plusieurs voies de recherche concernant les méthodes VV&C ont été identifiées ; citons notamment
l’utilisation accrue des systèmes disponibles sur étagère, la démultiplication des systèmes de systèmes,
un nombre croissant de normes non harmonisées, la tendance actuelle aux systèmes plus rapides et
meilleur marché, le recours accru aux techniques de modélisation et d’analyse formelles dans les outils
industriels et l’intérêt croissant pour corréler l’espace de la menace avec les techniques de VV&C devant
être utilisées.
iv RTO-TR-IST-027
Table of Contents
Page
Synthèse iv
RTO-TR-IST-027 v
3.8 Usability Validation 3-10
3.8.1 Expert Reviews 3-10
3.8.2 Usability Tests 3-11
3.8.3 Follow-up Studies of Installed Systems 3-12
3.8.4 Other Techniques 3-13
3.9 Efficiency Validation 3-13
3.9.1 Avalanche/Stress Testing 3-13
3.9.2 Performance Requirements 3-13
3.9.3 Other Techniques 3-13
3.10 Maintainability Validation 3-14
3.10.1 Regression Testing 3-14
3.10.2 Other Techniques 3-14
3.11 Portability Validation 3-14
vi RTO-TR-IST-027
Chapter 7 – CONCLUSIONS AND RECOMMENDATIONS 7-1
by Dan Craigen
7.1 Assessment of Current Technical Capabilities and Relevance of these Techniques and 7-1
Methods to Embedded Military Systems
7.2 Assessment of Relative Strengths and Limitations of these Methods 7-2
7.3 Assessment of Current Research Trends of these Methods 7-2
7.4 Specific Recommendations for Military Application of these Techniques 7-3
7.5 Recommendation for Future NATO IST Efforts, if relevant, such as Symposium or Workshop 7-4
RTO-TR-IST-027 vii
Membership of Task Group 027/RTG-009
The following table identifies the members of the research task group. The following members were
particularly active and have played a material role in the development of this report: Robin Bloomfield,
Jacques Cazin, Dan Craigen, Natalia Juristo, Ernst Kesseler and Jeff Voas.
∗ Principal Member
viii RTO-TR-IST-027
SPAIN UNITED KINGDOM
Dr. Natalia JURISTO Mr. Robin BLOOMFIELD
Facultad de Informática Adelard and CSR
Universidad Politecnica de Madrid Drysdale Building, Northampton Square
Campus de Montegancedo London EC1V 0HB
28660 Boadilla del Monte E-mail: [email protected]
Madrid Tel: +44 (20) 7490.9453
E-mail: [email protected] Fax: +44 (20) 7490.9451
Tel: (+34) 91336 6922
Fax: (+34) 91336 6917 UNITED STATES
Dr. Jeffrey VOAS
THE NETHERLANDS Cigital
Dr. Ernst KESSELER 21351 Ridgetop Circle, Suite 400
National Aerospace Laboratory (NLR) Dulles VA 20166
P.O. Box 90502 E-mail: [email protected]
1006 BM Amsterdam Tel: +1 (703) 404-9293
E-mail: [email protected] Fax: +1 (703) 404-9295
Tel: +31 (20) 511.34.62
Fax: +31 (20) 511.32.10
CANADA
Dr. Malcolm R. VANT ∗
Director General
Defence R&D Canada – Ottawa
3701 Carling Avenue
Ottawa, Ontario K1A 0Z4
E-mail: [email protected]
Tel: +1 (613) 998-2569
Fax: +1 (613) 998-4560
∗ Principal Member
RTO-TR-IST-027 ix
x RTO-TR-IST-027
REPORT DOCUMENTATION PAGE
1. Recipient’s Reference 2. Originator’s References 3. Further Reference 4. Security Classification
of Document
RTO-TR-IST-027 ISBN 92-837-1146-7 UNCLASSIFIED/
AC/323(IST-027)TP/31 UNLIMITED
5. Originator
Research and Technology Organisation
North Atlantic Treaty Organisation
BP 25, F-92201 Neuilly-sur-Seine Cedex, France
6. Title
Validation, Verification and Certification of Embedded Systems
7. Presented at/Sponsored by
Multiple 90
12. Distribution Statement
There are no restrictions on the distribution of this document.
Information about the availability of this and other RTO
unclassified publications is given on the back cover.
13. Keywords/Descriptors
Airborne computers Critical systems Software development
Avionics Embedded systems Software engineering
Best practices Information systems Software management
Commercial equipment Integrity SoSI (System of Systems Integration)
Compatibility Integrated systems Standards
Computer program verification Interoperability System of systems
Computer programs Modelling Systems engineering
Computer systems programs Performance standards VV&C (Validation, Verification
Control systems Quality assurance and Certification)
COTS (Commercial Off-The
Shelf)
14. Abstract
This report is the final report resulting from the deliberations of the NATO Research Task Group
on the Validation, Verification and Certification of Embedded Systems (IST-027/RTG-009). The
report discusses the important role of embedded systems in both the civil and military contexts.
Given the importance, the validation, verification and certification (VV&C) of such systems are
of increasing concern. The report discusses the current landscape of VV&C, expected evolution,
and also identifies standards of note. The report concludes with various conclusions and
recommendations drawn from the task group’s deliberations.
RTO-TR-IST-027
RTO-TR-IST-027
NORTH ATLANTIC TREATY ORGANISATION RESEARCH AND TECHNOLOGY ORGANISATION
AGENCES DE VENTE
NASA Center for AeroSpace The British Library Document Canada Institute for Scientific and
Information (CASI) Supply Centre Technical Information (CISTI)
Parkway Center, 7121 Standard Drive Boston Spa, Wetherby National Research Council
Hanover, MD 21076-1320 West Yorkshire LS23 7BQ Acquisitions, Montreal Road, Building M-55
ETATS-UNIS ROYAUME-UNI Ottawa K1A 0S2, CANADA
Les demandes de documents RTO ou AGARD doivent comporter la dénomination « RTO » ou « AGARD » selon le cas, suivie du numéro de série
(par exemple AGARD-AG-315). Des informations analogues, telles que le titre et la date de publication sont souhaitables. Des références
bibliographiques complètes ainsi que des résumés des publications RTO et AGARD figurent dans les journaux suivants :
Scientific and Technical Aerospace Reports (STAR) Government Reports Announcements & Index (GRA&I)
STAR peut être consulté en ligne au localisateur de publié par le National Technical Information Service
ressources uniformes (URL) suivant: Springfield
http://www.sti.nasa.gov/Pubs/star/Star.html Virginia 2216
STAR est édité par CASI dans le cadre du programme ETATS-UNIS
NASA d’information scientifique et technique (STI) (accessible également en mode interactif dans la base de
STI Program Office, MS 157A données bibliographiques en ligne du NTIS, et sur CD-ROM)
NASA Langley Research Center
Hampton, Virginia 23681-0001
ETATS-UNIS
NORTH ATLANTIC TREATY ORGANISATION RESEARCH AND TECHNOLOGY ORGANISATION
BP 25 DISTRIBUTION OF UNCLASSIFIED
F-92201 NEUILLY-SUR-SEINE CEDEX • FRANCE
RTO PUBLICATIONS
Télécopie 0(1)55.61.22.99 • E-mail [email protected]
AGARD & RTO publications are sometimes available from the National Distribution Centres listed below. If you wish to receive all RTO reports,
or just those relating to one or more specific RTO Panels, they may be willing to include you (or your Organisation) in their distribution.
RTO and AGARD reports may also be purchased from the Sales Agencies listed below.
Requests for RTO or AGARD documents should include the word ‘RTO’ or ‘AGARD’, as appropriate, followed by the serial number. Collateral
information such as title and publication date is desirable.
If you wish to receive electronic notification of RTO reports as they are published, please visit our website (www.rta.nato.int) from where you can
register for this service.
NATIONAL DISTRIBUTION CENTRES
BELGIUM GERMANY NORWAY
Etat-Major de la Défense Streitkräfteamt / Abteilung III Norwegian Defence Research
Département d’Etat-Major Stratégie Fachinformationszentrum der Establishment
ACOS-STRAT – Coord. RTO Bundeswehr (FIZBw) Attn: Biblioteket
Quartier Reine Elisabeth Friedrich-Ebert-Allee 34 P.O. Box 25, NO-2007 Kjeller
Rue d’Evère D-53113 Bonn
B-1140 Bruxelles POLAND
GREECE (Point of Contact) Armament Policy Department
CANADA Defence Industry & Research 218 Niepodleglosci Av.
DRDKIM2 General Directorate, Research Directorate 00-911 Warsaw
Knowledge Resources Librarian Fakinos Base Camp, S.T.G. 1020
Defence R&D Canada Holargos, Athens PORTUGAL
Department of National Defence Estado Maior da Força Aérea
305 Rideau Street HUNGARY SDFA – Centro de Documentação
9th Floor Department for Scientific Analysis Alfragide, P-2720 Amadora
Ottawa, Ontario K1A 0K2 Institute of Military Technology
Ministry of Defence SPAIN
CZECH REPUBLIC H-1525 Budapest P O Box 26 SDG TECEN / DGAM
LOM PRAHA s. p. C/ Arturo Soria 289
o. z. VTÚLaPVO ICELAND Madrid 28033
Mladoboleslavská 944 Director of Aviation
PO Box 18 c/o Flugrad, Reykjavik TURKEY
197 21 Praha 9 Milli Savunma Bakanlığı (MSB)
ITALY ARGE ve Teknoloji Dairesi Başkanlığı
DENMARK Centro di Documentazione 06650 Bakanliklar – Ankara
Danish Defence Research Tecnico-Scientifica della Difesa
Establishment Via XX Settembre 123 UNITED KINGDOM
Ryvangs Allé 1 00187 Roma Dstl Knowledge Services
P.O. Box 2715 Information Centre, Building 247
DK-2100 Copenhagen Ø LUXEMBOURG Dstl Porton Down
See Belgium Salisbury, Wiltshire SP4 0JQ
FRANCE
O.N.E.R.A. (ISP) NETHERLANDS UNITED STATES
29, Avenue de la Division Leclerc Royal Netherlands Military NASA Center for AeroSpace
BP 72 Academy Library Information (CASI)
92322 Châtillon Cedex P.O. Box 90.002 Parkway Center, 7121 Standard Drive
4800 PA Breda Hanover, MD 21076-1320
SALES AGENCIES
NASA Center for AeroSpace The British Library Document Canada Institute for Scientific and
Information (CASI) Supply Centre Technical Information (CISTI)
Parkway Center Boston Spa, Wetherby National Research Council
7121 Standard Drive West Yorkshire LS23 7BQ Acquisitions
Hanover, MD 21076-1320 UNITED KINGDOM Montreal Road, Building M-55
UNITED STATES Ottawa K1A 0S2, CANADA
Requests for RTO or AGARD documents should include the word ‘RTO’ or ‘AGARD’, as appropriate, followed by the serial number (for example
AGARD-AG-315). Collateral information such as title and publication date is desirable. Full bibliographical references and abstracts of RTO and
AGARD publications are given in the following journals:
Scientific and Technical Aerospace Reports (STAR) Government Reports Announcements & Index (GRA&I)
STAR is available on-line at the following uniform published by the National Technical Information Service
resource locator: Springfield
http://www.sti.nasa.gov/Pubs/star/Star.html Virginia 2216
STAR is published by CASI for the NASA Scientific UNITED STATES
and Technical Information (STI) Program (also available online in the NTIS Bibliographic
STI Program Office, MS 157A Database or on CD-ROM)
NASA Langley Research Center
Hampton, Virginia 23681-0001
UNITED STATES
ISBN 92-837-1146-7