2010-03-31 - VU Amsterdam - Experiences testing safety critical systems
•
1 j'aime•312 vues
1) Testing safety critical systems is challenging because software often contains errors and failures can have catastrophic consequences, so systems must be designed and tested to extremely high standards of reliability. 2) The document discusses standards like IEC 61508 that provide requirements for safety integrity levels and risk management in developing safety critical systems. 3) Rigorous verification techniques are needed including reviews, static analysis, unit testing with high code coverage, integration testing of components, system testing of full environments, and acceptance testing of real systems.
![Testing Safety Critical Systems Theory and Experiences ,[object Object],[object Object]](https://image.slidesharecdn.com/2010-03-31-uva-testingsafetycriticalsystems-110610140919-phpapp02/85/2010-03-31-VU-Amsterdam-Experiences-testing-safety-critical-systems-1-320.jpg)
Recommandé
Recommandé
Contenu connexe
Tendances
Tendances (20)
Similaire à 2010-03-31 - VU Amsterdam - Experiences testing safety critical systems
Similaire à 2010-03-31 - VU Amsterdam - Experiences testing safety critical systems (20)
Plus de Jaap van Ekris
Plus de Jaap van Ekris (20)
Dernier
Dernier (20)
2010-03-31 - VU Amsterdam - Experiences testing safety critical systems
- 4. Actually, we all do…
- 11. IEC 61508: Safety Integrity Level and acceptable risk
- 13. IEC 61508: A process for safety critical functions
- 15. A short introduction into storm surge barriers…
- 17. A simple design of a storm surge barrier Relais (€10,00/piece) Waterdetector (€17,50) Design documentation (Sponsored by Heineken)
- 18. Risk analysis Relais failure Chance : small Cause : aging Effect : catastophic Waterdetector fails Change : Huge Oorzaken : Rust, driftwood, seaguls (eating, shitting) Effect : Catastophic Measurement errors Chance : Collossal Causes : Waves, wind Effect : False Positive Broken cable Chance : Medium Cause : digging, seaguls Effect : Catastophic
- 20. Risk analysis
- 24. Risk reality does change over time...
- 26. Stuur X : Component architecture design
- 27. Stuur x ::Functionality, initial global design Init Start_D “ Start” signal to Diesels Wacht Waterlevel < 3 meter Waterlevel> 3 meter W_O_D “ Diesels ready” Sluit_? “ Close Barrier” Waterlevel
- 28. Stuur x ::Functionality, final global design
- 29. Stuur x ::Functionality, Wait_For_Diesels, detailed design
- 31. The end is nigh...
- 34. An example of safety critical components
- 35. IEC 61508 SIL4: Required verification activities
- 39. Representative testing is difficult
- 47. Testing safety critical functions is dangerous...
- 50. Failed gates of a potential deadlock
- 54. A root-cause analysis of this flaw
- 59. Safeguarding life, property and the environment www.dnv.com
Notes de l'éditeur
- Copyright CIBIT Adviseurs|Opleiders 2005 Jaap van Ekris, Veiligheidskritische systemen Werkveld: Kerncentrales Luchtverkeersleiding Stormvloedkeringen Fouten kosten veel mensenlevens
- Voordeel van Glen was dat het maar 1 keer hoefde te werken...... En dat waren de 60er jaren (toen kon dat nog), en astronauten hadden nog lef Bron: http://www.historicwings.com/features98/mercury/seven-left-bottom.html
- When I started my career, my mentor told me: “From now on, your goal is to stay off the frontpage of the newspapers” I can tell you it is hard, but so far I’ve succeeded.
- Maar we leven (onwetend) nog steeds in die wereld..... 10 June 2011
- Please note that these failure rates include electromechanical failure as well!! Electrocution by a light switch: Change of 10 -5 per usage 10 June 2011
- Voordeel van Glen was dat het maar 1 keer hoefde te werken...... Bron: http://www.historicwings.com/features98/mercury/seven-left-bottom.html
- FTA en FMEA zijn tegenpolen, goede controlemechanismen van elkaar (NASA) Alhoewel NASA geen feilloos trackrecord heeft….
- Doel: mag maar eens in de 10.000 jaar
- Je begint met je primary concern Proces is simpel: je hakt je probleem zover op todat je die 2 miljoen onderdelen hebt, en je weet wat de bijdrage is van elke component Je pakt de belangrijkste 10, of 100 en neemt gericht maatregelen
- Als we rekening gaan houden met deadlocks en redundantie ziet ons plaatje er zo uit: niet echt simpel meer……
- There is a bug in this one: this code is NOT fail-safe because it has a potential catastrophic deadlock (when the Diesels don’t report Ready)..... 10 June 2011
- Please be reminded: the presented code has a deadlock! 10 June 2011
- FTA en FMEA zijn tegenpolen, goede controlemechanismen van elkaar (NASA) Alhoewel NASA geen feilloos trackrecord heeft….
- Do you know the difference between validation and verification? Validation = meets external expectations, does what it is supposed to do Verification = meets internal expectations, conforming to specs 10 June 2011
- Funny example: printing screen....
- Most beautifull example: UPSes using too much power to charge, killing all fuses.... Current example: found out that identity management server was a single point of failure.... 10 June 2011
- This is functional nonsense: DirMsgResponse is sent to the output, whatever what. 10 June 2011
- Dijkstra put mathematicians in the line of ships, just to remind them of the danger: a practice still used by Boeing and Airbus (maiden flight) Testers, like John Glenn actually was, put their life on the line each and every time At eurocontrol, each bug had a bodycount attachted to it..... When a system fails in production, it is actual blood on our hands I lose about a collegue a year Quit when you think it is routine.....
- 10 June 2011