Directory

Sofia Guerra | None At This Time - Academia.edu

Skip to main content

Sofia Guerra

None At This Time, None at this time, Non-Academic

Followers

0

Following

1

Public Views

University of Genova

Katelijne Schiltz

Universität Regensburg

University of Siena / Università di Siena

University College Cork

Erciyes University

Alain Marchandisse

Université de Liège

Jeffrey Hamburger

Harvard University

Maria Pia Donato

Centre National de la Recherche Scientifique / French National Centre for Scientific Research

David Andrés Fernández

Universidad Complutense de Madrid

Google

InterestsView All (6)

Uploads

Papers by Sofia Guerra

Smart Device Safety Demonstration -- Proportional Approach Taking into Account System Context

13th Nuclear Plant Instrumentation, Control & Human-Machine Interface Technologies (NPIC&HMIT 2023)

Software Criticality Analysis of COTS/SOUP

Lecture Notes in Computer Science, 2002

This paper describes the Software Criticality Analysis (SCA) approach that was developed to suppo... more This paper describes the Software Criticality Analysis (SCA) approach that was developed to support the justification of commercial off-the-shelf software (COTS) used in a safety-related system. The primary objective of SCA is to assess the importance to safety of the software components within the COTS and to show there is segregation between software components with different safety importance. The approach taken was a combination of Hazops based on design documents and on a detailed analysis of the actual code (100kloc). Considerable effort was spent on validation and ensuring the conservative nature of the results. The results from reverse engineering from the code showed that results based only on architecture and design documents would have been misleading.

International Working Group on Assurance Cases (for Security)

IEEE Security & Privacy, May 1, 2006

Overview of Approaches to the Use and Licensing of COTS Digital Devices in Safety Critical Industries

12th Nuclear Plant Instrumentation, Control and Human-Machine Interface Technologies (NPIC&HMIT 2021), 2021

Although Commercial-Off-The-Shelf (COTS) components are increasingly used in nuclear Instrumentat... more Although Commercial-Off-The-Shelf (COTS) components are increasingly used in nuclear Instrumentation and Control (I&C) applications, there are several challenges related to their safety demonstration and justification. This paper describes work funded by Energiforsk that reviewed the use of COTS components in several safety applications, both within the nuclear sector and in other safety-critical sectors. The objective of the work was to investigate whether the use of COTS products in the Nordic Nuclear Power Plants (NPPs) may be feasible.

Composition of Default Specifications

Journal of Logic and Computation, Aug 1, 2001

In this paper we develop a theory of composition of default specifications. This theory generaliz... more In this paper we develop a theory of composition of default specifications. This theory generalizes the work by Goguen and Burstall, where specifications written in an arbitrary logical system (institution) are structured as combinations of theories. It extends the classical composition by allowing partial re-use (and overriding) of specification modules. The modularisation units are hierarchic specifications, i.e. axioms and defaults organized by priority levels. The semantics are given by default institutions, which are a generalisation of institutions in order to enable partial reuse of specifications. Composition is formalized by the use of appropriate categories, both at the syntactic and semantic levels. The theory of composition with overriding is illustrated with an example of an object-oriented specification.

Measuring hazard identification

This paper discusses an experiment that measured the effectiveness of a hazard identification pro... more This paper discusses an experiment that measured the effectiveness of a hazard identification process used to support safety in Defence Standard 00-56 project. The experimental case study utilised a Ministry of Defence project that assessed simultaneously two potential suppliers who were competing for a MOD equipment contract. The UK MOD Corporate Research Programme funded the comparison work and the MOD Integrated Project Team funded the project which included each contractor's project safety processes.

Distance Functions for Defaults in Reactive Systems

Springer eBooks, 2000

Default reasoning has become an important topic in software engineering. In particular, defaults ... more Default reasoning has become an important topic in software engineering. In particular, defaults can be used to revise speci cations, to enhance reusability of existing systems, and to allow a more economic description of systems. In this paper we develop a framework for default speci cations of reactive systems. We present a formalisation of non-monotonicity in temporal logic based on the notion of default institution. Default institutions were de ned as an extension of institutions in order to allow partial reuse of existing modules. The semantics of defaults is given by a generalised distance between interpretations. In this way, b y de ning a pre-order between temporal morphisms and using temporal logic as a speci cation language, we g e t a w ay of handling defaults in speci cations of reactive systems. We illustrate the developed formalism with an example in which a speci cation is reused, but where the new behaviour contradicts the initial speci cation. In this example, the initial speci cation is seen as a default to which exceptions are added.

Workshop on assurance cases: best practices, possible obstacles, and future opportunities 1 July 2004, Florence, Italy

For safety-, mission-, or security-critical systems, regulations or acquisition guidelines typica... more For safety-, mission-, or security-critical systems, regulations or acquisition guidelines typically require a documented body of evidence to provide a compelling case that the system satisfies specified critical properties; in other words, an argument is needed to "make the case" for the system's suitability or quality. These guidelines may use terms such as safety case, certification report, or security case; we collectively call them assurance cases.

Proportionate Assurance of Smart Devices used in the UK Nuclear Industry

Book of Extended Abstracts for the 32nd European Safety and Reliability Conference

Overview of Approaches to the Use and Licensing of COTS Digital Devices in Safety Critical Industries

12th Nuclear Plant Instrumentation, Control and Human-Machine Interface Technologies (NPIC&HMIT 2021), 2021

Although Commercial-Off-The-Shelf (COTS) components are increasingly used in nuclear Instrumentat... more Although Commercial-Off-The-Shelf (COTS) components are increasingly used in nuclear Instrumentation and Control (I&C) applications, there are several challenges related to their safety demonstration and justification. This paper describes work funded by Energiforsk that reviewed the use of COTS components in several safety applications, both within the nuclear sector and in other safety-critical sectors. The objective of the work was to investigate whether the use of COTS products in the Nordic Nuclear Power Plants (NPPs) may be feasible.

The Role of Certification in the Safety Demonstration of COTS EDDs

12th Nuclear Plant Instrumentation, Control and Human-Machine Interface Technologies (NPIC&HMIT 2021), 2021

Abstract Head) Embedded digital COTS devices are increasingly being used in Nuclear Power Plants.... more Abstract Head) Embedded digital COTS devices are increasingly being used in Nuclear Power Plants. Although these devices are often not developed according to nuclear standards, they still need to be justified to be deployed in nuclear applications. Different countries have been developing their own processes to justify COTS digital devices. In many cases, this justification is based on the assessment of the development process. This is consistent with traditional standard-based approaches to safety justification – compliance to accepted practice was deemed to imply adequate safety. This could be demonstrated either directly through a review of the development artefacts or indirectly through consideration of existing certification, e.g., IEC 61508. However, over the last 20 years, there has been a trend towards explicit claim-based approaches, where specific safety claims are supported by arguments and evidence at progressively more detailed levels. The standards-based approach and the claim-based approaches are not mutually exclusive, and a combination can be used to support a safety justification. In fact, for the most critical systems, it can be argued that a safety case should consider both aspects. In this paper, we discuss the use of development process-based approaches to the safety justification of EDDs COTS components, the link between development processes and reliability, how certification may support the justification, and some of the pitfalls of relying on certification.

Abstract. This paper describes the Software Criticality Analysis (SCA) approach that was develope... more Abstract. This paper describes the Software Criticality Analysis (SCA) approach that was developed to support the justification of commercial off-the-shelf software (COTS) used in a safety-related system. The primary objective of SCA is to assess the importance to safety of the software components within the COTS and to show there is segregation between software components with different safety importance. The approach taken was a combination of Hazops based on design documents and on a detailed analysis of the actual code (100kloc). Considerable effort was spent on validation and ensuring the conservative nature of the results. The results from reverse engineering from the code showed that results based only on architecture and design documents would have been misleading. 1

Process modelling to support dependability arguments

Proceedings International Conference on Dependable Systems and Networks

This paper reports work to support dependability arguments about the future reliability of a prod... more This paper reports work to support dependability arguments about the future reliability of a product before there is direct empirical evidence. We develop a method for estimating the number of residual faults at the time of release from a "barrier model" of the development process, where in each phase faults are created or detected. These estimates can be used in a conservative theory in which a reliability bound can be obtained or can be used to support arguments of fault freeness. We present the work done to demonstrate that the model can be applied in practice. A company that develops safety-critical systems provided access to two projects as well as data over a wide range of past projects. The software development process as enacted was determined and we developed a number of probabilistic process models calibrated with generic data from the literature and from the company projects. The predictive power of the various models was compared.

Assessment and Qualification of Smart Sensors

This paper describes research work done on approach es to justifying smart instruments, and in pa... more This paper describes research work done on approach es to justifying smart instruments, and in particular, how some of this research has succes sfully been applied to the safety substantiation of such instruments. From a management perspective , we examine both the issues involved gaining access to information required for this jus tification and the necessity for a sustainable long-term approach for the justification of smart s en ors that is acceptable to both suppliers and customers. From a technical perspective, we examine both overall safety justification approaches and specific techniques that can be used in the jus tification of the instruments’ software. Our smart device assessment work covered both management and technical issues. Many of the approaches that were initially developed in research projects have now been applied in practice to smart devices that will be used in nuclear applications. We anticipate that further analysis techniques developed in our research progra...

Databases and Other Harmonised Approaches to the Safety Justification of Embedded Digital Devices

This paper describes work funded by Energiforsk to consider the feasibility of using harmonised c... more This paper describes work funded by Energiforsk to consider the feasibility of using harmonised component level safety demonstration and, in particular, on using aspects of the UK approach to licensing and qualification of smart devices in Finland. We concluded that the use of harmonised component justification is feasible. In shorter timescales, this seems more likely to succeed if such an approach is developed within Finland. Using the assessments performed in the UK in Finland would have several advantages, but there are a number of technical and commercial issues that would need to be overcome for this to be feasible.

Application of a Commercial Assurance Case Tool to Support Software Certification Services

HARMONICS: EU FP7 Project on the Reliability and Safety Assessment of Modern Nuclear I&C Software

The reliability of computer-based systems implementing safety functions is a critical issue for t... more The reliability of computer-based systems implementing safety functions is a critical issue for the modernization and construction of nuclear power plants, in particular because software can usually not be proven to be entirely free of defects. The differences in regulation and safety justification principles between different countries restrict efficient co-operation and hinder the emergence of widely accepted best practices. This paper gives an introduction to an EU FP7 project HARMONICS (Harmonised Assessment of Reliability of Modern Nuclear I&C Software, 2011-2014) which has an overall objective to ensure that the nuclear industry has well founded and up-to-date methods and data for assessing software of computer-based safety systems.

Harmonized Component Level Safety Demonstration

Justification of Commercial Industrial Instrumentation and Control Equipment for Nuclear Power Plant Applications

This paper discusses work done by the authors to develop an IAEA Nuclear Energy Series report to ... more This paper discusses work done by the authors to develop an IAEA Nuclear Energy Series report to provide guidance on what would constitute an adequate justification process for a COTS device to be installed in a NPP for important to safety applications such that there is reasonable assurance of high quality and that the application of the COTS does not introduce new, unanalysed failure modes. The publication provides a process for justification of digital COTS devices that may be used to guide the incorporation of these devices into the design of I&C systems important to safety, such that there is sufficient evidence to demonstrate that these products have adequate integrity to meet the requirements for their intended nuclear applications.

V & V Techniques for Fpga-Based I & C Systems – How Do They Compare with Techiques for Microprocessors ?

We compare verification and validation (V&V) techniques for FPGA and microprocessorbased instrume... more We compare verification and validation (V&V) techniques for FPGA and microprocessorbased instrumentation and control (I&C) systems from the point of view of standards compliance, an approach based on behavioural properties, and the analysis of vulnerabilities. We found that the non-technology-specific elements of the standards considered are very similar. Differences are more marked when considering behavioural properties and vulnerabilities: the amount of effort required and confidence level obtained depend on a number of properties of the particular design under

Smart Device Safety Demonstration -- Proportional Approach Taking into Account System Context

13th Nuclear Plant Instrumentation, Control & Human-Machine Interface Technologies (NPIC&HMIT 2023)

Software Criticality Analysis of COTS/SOUP

Lecture Notes in Computer Science, 2002

This paper describes the Software Criticality Analysis (SCA) approach that was developed to suppo... more This paper describes the Software Criticality Analysis (SCA) approach that was developed to support the justification of commercial off-the-shelf software (COTS) used in a safety-related system. The primary objective of SCA is to assess the importance to safety of the software components within the COTS and to show there is segregation between software components with different safety importance. The approach taken was a combination of Hazops based on design documents and on a detailed analysis of the actual code (100kloc). Considerable effort was spent on validation and ensuring the conservative nature of the results. The results from reverse engineering from the code showed that results based only on architecture and design documents would have been misleading.

International Working Group on Assurance Cases (for Security)

IEEE Security & Privacy, May 1, 2006

Overview of Approaches to the Use and Licensing of COTS Digital Devices in Safety Critical Industries

12th Nuclear Plant Instrumentation, Control and Human-Machine Interface Technologies (NPIC&HMIT 2021), 2021

Although Commercial-Off-The-Shelf (COTS) components are increasingly used in nuclear Instrumentat... more Although Commercial-Off-The-Shelf (COTS) components are increasingly used in nuclear Instrumentation and Control (I&C) applications, there are several challenges related to their safety demonstration and justification. This paper describes work funded by Energiforsk that reviewed the use of COTS components in several safety applications, both within the nuclear sector and in other safety-critical sectors. The objective of the work was to investigate whether the use of COTS products in the Nordic Nuclear Power Plants (NPPs) may be feasible.

Composition of Default Specifications

Journal of Logic and Computation, Aug 1, 2001

In this paper we develop a theory of composition of default specifications. This theory generaliz... more In this paper we develop a theory of composition of default specifications. This theory generalizes the work by Goguen and Burstall, where specifications written in an arbitrary logical system (institution) are structured as combinations of theories. It extends the classical composition by allowing partial re-use (and overriding) of specification modules. The modularisation units are hierarchic specifications, i.e. axioms and defaults organized by priority levels. The semantics are given by default institutions, which are a generalisation of institutions in order to enable partial reuse of specifications. Composition is formalized by the use of appropriate categories, both at the syntactic and semantic levels. The theory of composition with overriding is illustrated with an example of an object-oriented specification.

Measuring hazard identification

This paper discusses an experiment that measured the effectiveness of a hazard identification pro... more This paper discusses an experiment that measured the effectiveness of a hazard identification process used to support safety in Defence Standard 00-56 project. The experimental case study utilised a Ministry of Defence project that assessed simultaneously two potential suppliers who were competing for a MOD equipment contract. The UK MOD Corporate Research Programme funded the comparison work and the MOD Integrated Project Team funded the project which included each contractor's project safety processes.

Distance Functions for Defaults in Reactive Systems

Springer eBooks, 2000

Default reasoning has become an important topic in software engineering. In particular, defaults ... more Default reasoning has become an important topic in software engineering. In particular, defaults can be used to revise speci cations, to enhance reusability of existing systems, and to allow a more economic description of systems. In this paper we develop a framework for default speci cations of reactive systems. We present a formalisation of non-monotonicity in temporal logic based on the notion of default institution. Default institutions were de ned as an extension of institutions in order to allow partial reuse of existing modules. The semantics of defaults is given by a generalised distance between interpretations. In this way, b y de ning a pre-order between temporal morphisms and using temporal logic as a speci cation language, we g e t a w ay of handling defaults in speci cations of reactive systems. We illustrate the developed formalism with an example in which a speci cation is reused, but where the new behaviour contradicts the initial speci cation. In this example, the initial speci cation is seen as a default to which exceptions are added.

Workshop on assurance cases: best practices, possible obstacles, and future opportunities 1 July 2004, Florence, Italy

For safety-, mission-, or security-critical systems, regulations or acquisition guidelines typica... more For safety-, mission-, or security-critical systems, regulations or acquisition guidelines typically require a documented body of evidence to provide a compelling case that the system satisfies specified critical properties; in other words, an argument is needed to "make the case" for the system's suitability or quality. These guidelines may use terms such as safety case, certification report, or security case; we collectively call them assurance cases.

Proportionate Assurance of Smart Devices used in the UK Nuclear Industry

Book of Extended Abstracts for the 32nd European Safety and Reliability Conference

Overview of Approaches to the Use and Licensing of COTS Digital Devices in Safety Critical Industries

12th Nuclear Plant Instrumentation, Control and Human-Machine Interface Technologies (NPIC&HMIT 2021), 2021

Although Commercial-Off-The-Shelf (COTS) components are increasingly used in nuclear Instrumentat... more Although Commercial-Off-The-Shelf (COTS) components are increasingly used in nuclear Instrumentation and Control (I&C) applications, there are several challenges related to their safety demonstration and justification. This paper describes work funded by Energiforsk that reviewed the use of COTS components in several safety applications, both within the nuclear sector and in other safety-critical sectors. The objective of the work was to investigate whether the use of COTS products in the Nordic Nuclear Power Plants (NPPs) may be feasible.

The Role of Certification in the Safety Demonstration of COTS EDDs

12th Nuclear Plant Instrumentation, Control and Human-Machine Interface Technologies (NPIC&HMIT 2021), 2021

Abstract Head) Embedded digital COTS devices are increasingly being used in Nuclear Power Plants.... more Abstract Head) Embedded digital COTS devices are increasingly being used in Nuclear Power Plants. Although these devices are often not developed according to nuclear standards, they still need to be justified to be deployed in nuclear applications. Different countries have been developing their own processes to justify COTS digital devices. In many cases, this justification is based on the assessment of the development process. This is consistent with traditional standard-based approaches to safety justification – compliance to accepted practice was deemed to imply adequate safety. This could be demonstrated either directly through a review of the development artefacts or indirectly through consideration of existing certification, e.g., IEC 61508. However, over the last 20 years, there has been a trend towards explicit claim-based approaches, where specific safety claims are supported by arguments and evidence at progressively more detailed levels. The standards-based approach and the claim-based approaches are not mutually exclusive, and a combination can be used to support a safety justification. In fact, for the most critical systems, it can be argued that a safety case should consider both aspects. In this paper, we discuss the use of development process-based approaches to the safety justification of EDDs COTS components, the link between development processes and reliability, how certification may support the justification, and some of the pitfalls of relying on certification.

Abstract. This paper describes the Software Criticality Analysis (SCA) approach that was develope... more Abstract. This paper describes the Software Criticality Analysis (SCA) approach that was developed to support the justification of commercial off-the-shelf software (COTS) used in a safety-related system. The primary objective of SCA is to assess the importance to safety of the software components within the COTS and to show there is segregation between software components with different safety importance. The approach taken was a combination of Hazops based on design documents and on a detailed analysis of the actual code (100kloc). Considerable effort was spent on validation and ensuring the conservative nature of the results. The results from reverse engineering from the code showed that results based only on architecture and design documents would have been misleading. 1

Process modelling to support dependability arguments

Proceedings International Conference on Dependable Systems and Networks

This paper reports work to support dependability arguments about the future reliability of a prod... more This paper reports work to support dependability arguments about the future reliability of a product before there is direct empirical evidence. We develop a method for estimating the number of residual faults at the time of release from a "barrier model" of the development process, where in each phase faults are created or detected. These estimates can be used in a conservative theory in which a reliability bound can be obtained or can be used to support arguments of fault freeness. We present the work done to demonstrate that the model can be applied in practice. A company that develops safety-critical systems provided access to two projects as well as data over a wide range of past projects. The software development process as enacted was determined and we developed a number of probabilistic process models calibrated with generic data from the literature and from the company projects. The predictive power of the various models was compared.

Assessment and Qualification of Smart Sensors

This paper describes research work done on approach es to justifying smart instruments, and in pa... more This paper describes research work done on approach es to justifying smart instruments, and in particular, how some of this research has succes sfully been applied to the safety substantiation of such instruments. From a management perspective , we examine both the issues involved gaining access to information required for this jus tification and the necessity for a sustainable long-term approach for the justification of smart s en ors that is acceptable to both suppliers and customers. From a technical perspective, we examine both overall safety justification approaches and specific techniques that can be used in the jus tification of the instruments’ software. Our smart device assessment work covered both management and technical issues. Many of the approaches that were initially developed in research projects have now been applied in practice to smart devices that will be used in nuclear applications. We anticipate that further analysis techniques developed in our research progra...

Databases and Other Harmonised Approaches to the Safety Justification of Embedded Digital Devices

This paper describes work funded by Energiforsk to consider the feasibility of using harmonised c... more This paper describes work funded by Energiforsk to consider the feasibility of using harmonised component level safety demonstration and, in particular, on using aspects of the UK approach to licensing and qualification of smart devices in Finland. We concluded that the use of harmonised component justification is feasible. In shorter timescales, this seems more likely to succeed if such an approach is developed within Finland. Using the assessments performed in the UK in Finland would have several advantages, but there are a number of technical and commercial issues that would need to be overcome for this to be feasible.

Application of a Commercial Assurance Case Tool to Support Software Certification Services

HARMONICS: EU FP7 Project on the Reliability and Safety Assessment of Modern Nuclear I&C Software

The reliability of computer-based systems implementing safety functions is a critical issue for t... more The reliability of computer-based systems implementing safety functions is a critical issue for the modernization and construction of nuclear power plants, in particular because software can usually not be proven to be entirely free of defects. The differences in regulation and safety justification principles between different countries restrict efficient co-operation and hinder the emergence of widely accepted best practices. This paper gives an introduction to an EU FP7 project HARMONICS (Harmonised Assessment of Reliability of Modern Nuclear I&C Software, 2011-2014) which has an overall objective to ensure that the nuclear industry has well founded and up-to-date methods and data for assessing software of computer-based safety systems.

Harmonized Component Level Safety Demonstration

Justification of Commercial Industrial Instrumentation and Control Equipment for Nuclear Power Plant Applications

This paper discusses work done by the authors to develop an IAEA Nuclear Energy Series report to ... more This paper discusses work done by the authors to develop an IAEA Nuclear Energy Series report to provide guidance on what would constitute an adequate justification process for a COTS device to be installed in a NPP for important to safety applications such that there is reasonable assurance of high quality and that the application of the COTS does not introduce new, unanalysed failure modes. The publication provides a process for justification of digital COTS devices that may be used to guide the incorporation of these devices into the design of I&C systems important to safety, such that there is sufficient evidence to demonstrate that these products have adequate integrity to meet the requirements for their intended nuclear applications.

V & V Techniques for Fpga-Based I & C Systems – How Do They Compare with Techiques for Microprocessors ?

We compare verification and validation (V&V) techniques for FPGA and microprocessorbased instrume... more We compare verification and validation (V&V) techniques for FPGA and microprocessorbased instrumentation and control (I&C) systems from the point of view of standards compliance, an approach based on behavioural properties, and the analysis of vulnerabilities. We found that the non-technology-specific elements of the standards considered are very similar. Differences are more marked when considering behavioural properties and vulnerabilities: the amount of effort required and confidence level obtained depend on a number of properties of the particular design under