Safety Critical Software - Out of Sight, Out of Mind

by Dylan LLewellyn
18.12.2018 Code Coverage,Test framework,Unit Testing

I recently travelled for business to Vietnam. I flew from London to Ho Chi Minh City, then took a few internal flights to and from Hanoi and then finally flew back from Hanoi to London. I travelled 24,633km in 6 days and spent more than 30 hours in the air. I flew on 3 different aircraft types, from 2 manufacturers and with 3 different airlines. I travelled in relative comfort, on time, able to breathe at over 30,000 feet in the air. I didn’t freeze to death. I enjoyed my warm and varied food. I watched movies and hardly felt a bump the whole time.


Most passengers are blissfully unaware of the intricate, complex physics and computing that keep them aloft and deliver them to their destinations, ready for that vital meeting or to relax by the pool. They have played their small part in a beautiful aerial ballet and they hardly gave the process a thought.


During 2018 more than 210m international air passengers flew via the UK alone, either via originating flights or connecting flights. Look at the mobile app ‘FlightTracker24’, anyone can see the staggering number of aircraft in our skies at any one time.


Beyond the physics, the mechanical engineering and the hardware, all of which have undertaken a massive evolution over the past decades, the computing power available and the safety systems that now form an intrinsic part of every aircraft have taken huge leaps in complexity and reliability. A reliability backed up by proven processes within high integrity standards such as DO178C that ensure that every part of the aircraft you travel on has been designed and tested to the highest applicable levels of reliability, robustness and redundancy.


It is not just airborne system safety that has improved however, the awareness of environmental impacts has increased also. This has driven the need to greatly reduce emissions, increase in fuel efficiency, and lower noise footprints, through life costs and impacts and even end of life factors[J1] [J2] . This impacts not just the aircraft but the traffic management therefore improving in-flight and on-ground safety and management systems that have undergone the most stringent testing are paramount, even though we can’t control the weather, we can manage its impact on operations.


Behind the scenes, business critical processes are active that are tested to industrial standards again, not thought of or considered by the average passenger. The lighting, HVAC, communications, bookings, transfers, security and other terminal operations such as baggage handling systems are all controlled by large computer systems running complex, Certified software, all of which needs to be qualified and tested to meet Certification Standards to prove its robustness and reliability. A lot needed to happen to take me from London to Ho Chi Minh City!


Of course, it’s not just the aircraft themselves. Much of the global infrastructure in place today relies on similar or equivalent safety and mission-critical system approaches. How did you get to the airport for instance, train? Signalling, braking, monitoring and maintenance (HUMS), train separation and even door operation, all managed by software, software designed to meet the EN 50128 international standard before being allowed to be operational in a passenger carrying environment.


Perhaps the journey to the airport was in your car or a taxi? Drive-by-wire systems are now commonplace, there are no longer physical connections between the pedals and the braking systems. There was a time not that long ago that pressing the brake pedal with the driver’s foot resulted in an actuation rod passing through the bulkhead which moved forwards in to a cylinder which resulted in brake fluid being forced in to small pipes and eventually activating brake cylinders. Most of the mechanical activity stills happens but now when you push the pedal a sensor is activated, that pressure-sensitive sensor sends a code to a computer that calculates the pressure and duration of the pedal push and commands a braking activity. The throttle pedal is now operated in much the same way, no metal cables and linkages any more. Many cars do not have a steering column now, again, a series of sensors react to and calculate movement, communicate with wheel speed and throttle response sensors calculate the acceptable response and send an appropriate signal. Anti-Lock Braking Systems, Traction Control, Electronic Dampers, Harmonics Control, Night Vision, Lane Assist, all these systems require far more computing power that the Apollo mission had on the entire space vehicle and without software and are tested to the ISO 26262 Standard.


It’s amazing to think that an operator on Earth can precisely adjust the orbit of a spacecraft heading for Mars. Much closer to home, software that has been designed, qualified, tested and certified to standards such as IEC 62304 controls essential equipment in hospitals, such as incubators used to keep premature babies alive or drug-delivery systems to allow for pain management.


So how do we test that a software code will do only what we want, when we want and within accepted criteria and reliably, possibly for years without maintenance?


We test, test and test again, dynamically in many cases to prove the highest levels of integrity. We test repeatedly using only the most reliable and proven tools on the market, the tools that test the software that keeps you and I alive without us even being aware of their presence.


What do we mean by “Dynamic Testing”? During Dynamic Testing, code is executed to check the functional behaviour of the software system, its memory and CPU usage and overall performance of the system. The objective of this testing is to confirm that the software works in conformance with the standards and as per its design criteria to ensure it meets requirements.


“Does it do what it should, when it should and nothing else”.


Hence the term "Dynamic"


It is a true statement that in 2019 without computers, we’d be in trouble, life would certainly be harder than we have made it and millions of lives would be at risk. Software has become a manmade part of our ecosystem. Millions of lines of highly complex, internationally-compliant software code are needed for society to operate in the early 21st Century, all of which must be written, verified, validated and certified to the highest levels of integrity. And it is going to get far more intrinsic to daily life.


Interestingly, in many cases, the most common threat to accuracy is human error, as the software involved has been so rigorously tested against failure, it is more reliable.


Digital systems are close to infallible and are most often the safest option to employ. They do however, only act as they were designed and in that is the greatest possibility of disaster. Guaranteeing infallibility requires considerable expertise and experience. Thorough and high-quality testing of the software we use will ensure that, as our reliance on such systems grows, our world in response, becomes a safer place for humans.


Of course, the demands on software don’t end there. Demand for and the ability to create stronger, faster systems to support the introduction of increasingly complex, highly efficient functionality are insatiable and industry reacts willingly to demand.


Those demands, for complexity, reliability and speed, coupled with ever shorter “time to market” pressures increase the need for software developers and exponentially increase the need for testing. Testing demands millions of man-hours annually around the world and by using the worlds leading, Certified dynamic test tool for C and C++, Cantata, a high percentage of those hours is recoverable using feature sets within Cantata such as AutoTest. Enabling up to 100% Code Coverage, Unit Testing, Integration Testing and Systems Testing at the very highest safety levels demanded by industry and expected by user groups as a minimum!


The next time you drive to the airport, arrive safely, get on a plane, fly at great speed over vast distances and arrive relaxed and ready for a meeting. When a family member requires medical care or even when the lift at works gets to your floor and the door miraculously opens, remember that behind the scenes every part of that journey, everything that kept you safe that day was controlled by software, tested to the highest standards by the best engineers in the world, using the leading tool.


The beautiful thing about important software is that the less it’s noticed, the more exceptional it is. We’re happy to contribute our safety-critical testing expertise to keeping people safe in the air, on the ground and one day in space whether they know it, or not.