Method and computer program for testing technical systems

Abstract

To provide a method for testing technology systems.SOLUTION: A method (100) is for testing safety related technology systems including software. The system is represented by a model (200) that includes at least two components (210, 220). In the method (100), an assumption (A) about a safety related system of one component (210, 220) and a guarantee (G) on the safety related system of one component (210, 220) are defined by a safety contract. The method (100) is configured to create a program code (C) executable based on at least one assumption (A) and at least one guarantee (G) in a step (110), and test the safety related system by the execution of the program code (C) in step (120).SELECTED DRAWING: Figure 2

Description

[Technical Field]

[0001] The present disclosure relates, inter alia, to methods and apparatus for testing safety-related systems. The present disclosure further relates to a computer program that may be used in the apparatus and / or method for testing a system. [Background technology]

[0002] The system is a technical system that includes, among other things, software and / or hardware components. The creation and / or design of such systems is typically carried out within the framework of model-based systems engineering. The systems are modeled, for example, using UML or SysML, typically in the form of components with ports and connections between these ports. The systems can also be modeled as hierarchical models, in which a component can contain one or more further components.

[0003] Model-based safety analysis, or MBSA for short, takes advantage of these models by adding a more safety-oriented view to the system. One possibility consists in attaching so-called safety contracts to the components. Safety contracts are derived from contract-based design and are already known from the state of the art, for example from [1].

[0004] A safety contract details the configuration specification of the safety requirements of a safety-related system, which follows the component structure of and is linked to a hierarchical system model. For each component, a safety contract details the safety-related "assumments" that must be fulfilled by the component's immediate surroundings (e.g. components above it) and the corresponding safety-related "guarantees" that the component must provide.

[0005] The goal of the safety contract is to assist developers and safety managers in assessing the safety of a system model, and in particular the ability of a selected component structure to fulfill all safety requirements. [Prior art documents] [Non-patent literature]

[0006] [Non-Patent Document 1] Warg, F.; Vedder, B.; Skoglund, M. & Soaderberg, A.: “Safety ADD: A Tool for Safety-Contract Based Design” In: 2014 IEEE International Symposium on Software Reliability Engineering Workshops, 2014, p.527-529. Summary of the Invention

[0007] One embodiment relates to a method for testing, inter alia, a safety-related technical system including, inter alia, software and / or hardware components, wherein the system is represented by a model including at least two or more components, and wherein assumptions regarding the safety-related system of each one of the components and guarantees to the safety-related system of each one of the components are specified by a safety contract, characterized in that in one step, executable program code is generated based on the at least one assumption and the at least one guarantee, and in a further step the safety-related system is tested by execution of the program code.

[0008] From the state of the art, it is known to generate program code for testing the functionality of a system during or after its development and to derive it from the implemented functionality of the system. However, the specification may differ from the actual implementation of the functionality in the final product. In this case, deriving the program code from the implementation cannot guarantee that the final product will actually fulfill the specification.

[0009] In contrast, the method according to the present disclosure proposes to generate program code for testing the system based on the assumptions and guarantees specified in the safety contract, i.e., the execution of the program code tests whether the assumptions and guarantees specified in the safety contract have been fulfilled during the implementation of the system.

[0010] Components typically contain ports, inter alia, inputs for receiving data and outputs for sending data. Further couplings between the ports of various components are modeled in the model.

[0011] The assumptions of each component may be fulfilled by components located around it, for example above it. The assumptions are therefore usually related to the data received at the inputs of the component.

[0012] The guarantees of each one of the components can be fulfilled by this component itself, and therefore usually relate to the data transmitted at the output of the component.

[0013] According to one embodiment, it is contemplated that generating the program code includes generating program code for testing at least one function of at least one component to check whether guarantees of the component based on the safety contract are met.

[0014] According to one embodiment, it is contemplated that the testing further includes executing program code to test the functionality of at least one component. According to one embodiment, it is contemplated that the generation of the program code comprises the generation of program code for monitoring at least one component, in particular the inputs of this component, to check whether the component's assumptions based on the safety contract are respected.

[0015] According to one embodiment, it is contemplated that the testing further comprises the execution of program code for monitoring at least one component, particularly during operation of the safety-related system, particularly at runtime of the safety-related system.

[0016] According to one embodiment, the generation of the program code is performed automatically. It is contemplated that if the safety contracts are formalized, the generation of the program code, and therefore also the testing of the system, may be performed automatically.

[0017] The assumptions and guarantees, which are expressed in the safety contract, for example, in natural language, can be automatically converted into logical formulas, for example, using text recognition methods. The logical formulas are then converted into corresponding program code. The chain of assertions can, in particular, be successively converted into corresponding expressions in the program code.

[0018] According to one embodiment, it is contemplated that the generation of the program code further comprises the generation of program code at a system level, in particular for testing at least one function of the safety-related system and / or for monitoring the safety-related system.

[0019] According to one embodiment, it is contemplated that the testing further comprises the execution of program code at a system level, in particular for testing at least one function of the safety-related system and / or for monitoring the safety-related system.

[0020] According to one embodiment, the method further comprises generating an executable program code based on at least one of the following system requirements: safety, comfort, authentication. The system requirements, which are expressed in natural language, e.g., in the specification, can be automatically converted into logical formulas, e.g., using text recognition methods. The logical formulas are then converted into program code accordingly. A chain of assertions can, inter alia, be successively converted into a corresponding representation in the program code.

[0021] According to a further embodiment, it is contemplated that by applying the method a system may be designed, for example it may be analyzed whether a particular component can be replaced by another component having, among other things, similar functionality, and therefore whether the assumptions and guarantees under the safety contract will still be fulfilled.

[0022] Further embodiments relate to the application of the method for testing control equipment, including software and / or hardware components, for example for driving, braking, steering or assistance systems of at least partially automated vehicles, which can be tested for safety-critical requirements by applying the method.

[0023] Further embodiments relate to apparatus, which are configured to perform the methods according to the embodiments. A further embodiment relates to a computer program comprising executable program code, the program code being based on a safety contract between a safety-related system and at least one component of the safety-related system, the safety contract comprising at least one assumption of the component regarding the safety-related system and / or at least one guarantee of the component to the safety-related system.

[0024] Further features, applicability and advantages of the present invention will become apparent from the following description of exemplary embodiments of the invention as illustrated in the drawing figures, in which all described or illustrated features, alone or in any combination, are subject to the present invention, regardless of the summary of features in the patent claims or their dependent claims, and regardless of the expression or illustration of the features in the description or drawings. [Brief explanation of the drawings]

[0025] [Figure 1] 1 is a flow diagram that outlines steps of a method for testing a technical system according to one embodiment; [Figure 2] 1 is a schematic diagram of a model technical system; [Figure 3] FIG. 4 is a block diagram illustrating schematically the steps of a method according to a further embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0026] A method 100 for testing a technical system is described below with reference to FIG. The technical system is a safety-relevant system that includes, inter alia, software and / or hardware components.

[0027] This system, according to the illustrated embodiment, is represented by model 200 (see FIG. 2). Model 200 illustratively includes component 210 and additional component 220, according to the illustrated embodiment.

[0028] Components 210, 220 include ports 230, particularly inputs for receiving data and outputs for transmitting data. Connections 240 are modeled between the ports 230 of components 210, 220.

[0029] Model 200 further includes a safety contract that specifies assumptions A of components 210, 220 with respect to the system, particularly with respect to further components 210, 220 of the system, and guarantees G of components 210, 220 to the system, particularly with respect to further components 210, 220 of the system. The assumptions A of component 210 with respect to component 220 and the guarantees G of component 210 with respect to component 220 are shown schematically in Figure 2.

[0030] The system is, for example, a technical system of a vehicle. Component 210 is, for example, a control device or a computing unit of a control device, inter alia, for driving a motor vehicle. Component 220 is, for example, a sensor, inter alia, for optical acquisition and / or an actuator, inter alia, for controlling a drive unit of the vehicle and / or a steering unit of the vehicle. Component 220, inter alia, a sensor, transmits data to component 210, inter alia, a control device. Component 210 also transmits data to component 220. In this case, assumption A of component 210 is, for example, an assumption that component 220 will transmit data to component 210 at a configurable time. Guarantee G of component 210 is, for example, a guarantee that component 210 will transmit data to component 220 at a configurable time.

[0031] The method 100 for testing is further described below, again with reference to FIG. According to the illustrated embodiment, in step 110 of method 100, executable program code is generated based on the assumptions and guarantees of the safety contract.

[0032] According to the illustrated embodiment, in step 120 of method 100, the safety-related system is tested by executing program code. According to one embodiment, it is contemplated that generating 110 the program code includes generating program code for testing at least one function of at least one component to check whether the guarantees of the component based on the safety contract are respected.

[0033] According to one embodiment, it is contemplated that testing 120 further includes executing program code to test the functionality of at least one component. According to one embodiment, it is contemplated that generating 110 the program code includes generating program code for monitoring at least one component, in particular the inputs of the component, to check whether the component's assumptions based on the safety contract are respected.

[0034] According to one embodiment, it is contemplated that the testing 120 further includes the execution of program code for monitoring at least one component, particularly during operation of the safety-related system, particularly at runtime of the safety-related system.

[0035] According to one embodiment, it is contemplated that the generation 110 of the program code is performed automatically. The assumptions and guarantees, which are expressed in the safety contract, for example, in natural language, can be automatically converted into logical formulas, for example, using text recognition methods. The logical formulas are then converted into the program code accordingly. The chain of assertions can, among other things, be converted into a corresponding representation in the program code in a sequential manner.

[0036] According to one embodiment, it is contemplated that generating 110 the program code further comprises generating, at a system level, program code for, among other things, testing at least one function of the safety-related system and / or for, among other things, monitoring the safety-related system.

[0037] According to one embodiment, it is contemplated that the testing 120 further includes the execution of program code at a system level, particularly for testing at least one function of the safety-related system and / or for monitoring the safety-related system.

[0038] According to one embodiment, it is contemplated that the method 100 further comprises generating executable program code based on at least one of the following system requirements: safety, comfort, and authentication aspects.

[0039] 3 is a schematic diagram of the assumptions A and guarantees G of component 210. Based on the assumptions A and guarantees G, the method 100 generates executable program code C. [Explanation of symbols]

[0040] 100 ways 110 generation 120 Test 200 models 210, 220 components 230 ports, inputs, outputs 240 Combine A. Assumption C program code G Warranty

Claims

1. A method (100) executed by a computer device for testing a safety-related system including software and / or hardware components, wherein the safety-related system is represented by a model (200) including at least two or more components (210, 220) and at least one safety contract, and each of the at least one safety contract specifies an assumption (A) of a first component of the at least two or more components (210, 220) regarding a second component different from the first component, and a guarantee (G) of the first component to the second component, wherein the method (100) comprises: The assumption (A) and the guarantee (G) are expressed in a natural language, and the computer device converts the natural language into a logical formula using text recognition of the assumption (A) and the guarantee (G), and converts the logical formula into an executable program code (C), thereby generating the executable program code (C) (110); a step (120) of said computer device testing said safety-related system by executing said program code (C); A method (100) comprising:

2. A method (100) as claimed in claim 1, wherein the generating step (110) includes generating program code (C) for testing at least one function of at least one component (210, 220) to check whether the guarantee (G) of the component (210, 220) based on the safety contract is maintained.

3. The method (100) of claim 2, wherein the testing step (120) further comprises executing the program code (C) to test the functionality of at least one component (210, 220).

4. A method (100) according to any one of claims 1 to 3, wherein the generating step (110) includes generating program code (C) for monitoring at least one component (210, 220) to check whether the assumption (A) of the component (210, 220) based on the safety contract is adhered to.

5. The method (100) of claim 4, wherein the testing step (120) further comprises executing the program code (C) for monitoring at least one component (210, 220) during operation of the safety-related system.

6. A method (100) according to any one of claims 1 to 5, wherein the generating step (110) is performed automatically.

7. A method (100) according to any one of claims 1 to 6, wherein the generating step (110) further comprises generating, at a system level, program code (C) for testing at least one function of the safety-related system and / or for monitoring the safety-related system.

8. 8. The method (100) of claim 7, wherein the testing step (120) further comprises executing, at a system level, the program code (C) for testing at least one function of the safety-related system and / or for monitoring the safety-related system.

9. 9. The method (100) according to any one of claims 1 to 8, further comprising generating an executable program code (C) based on at least one of the following system requirements: safety, comfort, authentication aspects.

10. An apparatus configured to perform the method (100) of any one of claims 1 to 9.

11. A computer program causing a computer device to execute the method (100) according to any one of claims 1 to 9.

Images