An experimental Study using ACSL and Frama-C to formulate and verify Low-Level Requirements from a DO-178C compliant Avionics Project

Safety critical avionics software is a natural application area for formal verification. This is reflected in the formal method's inclusion into the certification guideline DO-178C and its formal methods supplement DO-333. Airbus and Dassault-Aviation, for example, have conducted studies in using formal verification. A large German national research project, Verisoft XT, also examined the application of formal methods in the avionics domain. However, formal methods are not yet mainstream, and it is questionable if formal verification, especially formal deduction, can be integrated into the software development processes of a resource constrained small or medium enterprise (SME). ESG, a Munich based medium sized company, has conducted a small experimental study on the application of formal verification on a small portion of a real avionics project. The low level specification of a software function was formalized with ACSL, and the corresponding source code was partially verified using Frama-C and the WP plugin, with Alt-Ergo as automated prover. We established a couple of criteria which a method should meet to be fit for purpose for industrial use in SME, and evaluated these criteria with the experience gathered by using ACSL with Frama-C on a real world example. The paper reports on the results of this study but also highlights some issues regarding the method in general which, in our view, will typically arise when using the method in the domain of embedded real-time programming.Comment: In Proceedings F-IDE 2015, arXiv:1508.0338

DO-178C Compliance of Verisoft Formal Methods

International audienceVerisoft XT was a three-year research project , funded by the German Federal Ministry of Education and Research (BMBF). The main goal of the project was the pervasive formal verification of computer systems. One of its sub-projects examined the application of formal methods in the avionics domain. Today’s avionics software should be developed in accordance with the RTCA/EUROCAE standard DO-178B/ED-12B to achieve formal acceptance by certification authorities. This standard lists formal methods merely as alternative means but does not provide guidance on the use and acceptance of formal methods. Its successor DO-178C/ED-12C will provide this guidance in its Formal Methods Supplement. Although DO-178C was not published during project runtime, the available material nevertheless allowed us to examine the compliance of two of the formal methods and tools – VSE and VCC – that have been used in Verisoft XT. This paper summarises the results of this evaluation and thus may serve as a first step in the certification planning of a real avionics project that would use either one or both methods