High prole systemic safety standards for Cyber-Physical Systems (CPS) development within the tran... more High prole systemic safety standards for Cyber-Physical Systems (CPS) development within the transportation domain have commonalities with regard to their view of the safety-related implications of tool usage. Their guidelines on tool qualication favour a bottom-up approach in which tools are dealt with in isolation and mostly if they may directly introduce faults into end products. This guidance may ignore risk introduced by the integration of software tools, especially if these risks are related to low levels of automation-such as process notications and improper graphical user interfaces. This paper presents a study that ties weaknesses in support environments to software faults. Based on the observed weaknesses guidelines for a top-down software tool chain qualication are suggested for inclusion in the next generation of safety standards. This has implications not only for the surveyed standards in the transportation domain, but also for other standards for safety-critical CPS development that do not include a broader view on risks related to tool usage. Furthermore, given the type of omission identied in the surveyed standards, it is suggested that researchers interested in the safety-related implications of tool integration should approach organizational research in search of possibilities to set up theory triangulation studies.
The tool integration research area emerged in the 1980s. This survey focuses on those strands of ... more The tool integration research area emerged in the 1980s. This survey focuses on those strands of tool integration research that discuss issues beyond technology. We reveal a discourse centered around six frequently mentioned non-functional properties. These properties have been discussed in relation to technology and high level issues. However, while technical details have been covered, high level issues and, by extension, the contexts in which tool integration can be found, are treated indierently. We conclude that this indierence needs to be challenged, and research on a larger set of stakeholders and contexts initiated. An inventory of the use of classication schemes underlines the diculty of evolving the classical classication scheme published by Wasserman. Two frequently mentioned redenitions are highlighted to facilitate their wider use. A closer look at the limited number of research methods and the poor attention to research design indicates a need for a changed set of research methods. We propose more critical case studies and method diversication through theory triangulation. Additionally, among disparate discourses we highlight several focusing on standardization which are likely to contain relevant ndings. This suggests that open communities employed in the context of (pre-)standardization could be especially important in furthering the targeted discourse.
Context: Exploratory Testing (ET) is a manual approach to software testing in which learning, tes... more Context: Exploratory Testing (ET) is a manual approach to software testing in which learning, test design and test execution occurs simultaneously. Still a developing topic of interest to academia, although as yet insufficiently investigated , most studies focus on the skills and experience of the individual tester. However, contextual factors such as project processes, test scope and organisa-tional boundaries are also likely to affect the approach. Objective: This study explores contextual differences between teams of testers at a MedTec firm developing safety-critical products to ascertain whether con-textual factors can influence the outcomes of ET, and what associated implications can be drawn for test management. Method: A development project was studied in two iterations, each consisting of a quantitative phase testing hypotheses concerning when ET would identify faults in comparison to other testing approaches and a qualitative phase involving interviews. Results: Influence on ET is traced to how the scope of tests focus learning on different types of knowledge and imply an asymmetry in the strength and number of information flows to test teams. Conclusions: While test specialisation can be attractive to software development organisations, results suggest changes to processes and organisational structures might be required to maintain test efficiency throughout projects: the responsibility for test cases might need to be rotated late in projects, and asymmetries in information flows might require management to actively strengthen the presence and connections of test teams throughout the firm. However, further research is needed to investigate whether these results also hold for non safety-critical faults.
The security and safety of Cyber-Physical Systems (CPS) often influence each other. Ensuring that... more The security and safety of Cyber-Physical Systems (CPS) often influence each other. Ensuring that this does not have negative implications might require a large and rigorous effort during the development of CPS. However, early in the life-cycle, quick feedback can be valuable helping security and safety engineers to understand how seemingly trivial design choices in their domain may have unacceptable implications in the other. We propose the Cyber Risk Assessment Framework (CRAF) for this purpose. The CRAF is based on openly available and widely used taxonomies from the safety and security domains, and a unique mapping of where loss of data security may impact aspects of data with safety implications. This paper represents the first time these different elements have been brought together into a single framework with an associated process. Through examples from within our organisations we show how this framework can be put to good use.
Master students at our institute were graduating without acceptable research proficiency. We inte... more Master students at our institute were graduating without acceptable research proficiency. We intervened by shifting our research training from teaching-centred to student-centred, and from research-related subject content to research-related processes. We performed a mixed methods study aimed to confirm there was improved research proficiency without a negative trade-off for our students' engineering skills. Results indicated improvements to research proficiency, which our students were able to transfer to engineering-related learning activities to increase their ability to achieve engineering synthesis. This outcome was potentially supported by our courses including several perspectives on scientific knowledge production. This implies that research training, rather than having a negative effect on engineering skills, can be helpful in learning diametrically opposing aspects of thinking required by current engineering. As engineering education evolves towards more cross-disciplinary cooperation, this implies the need to pursue the increased opportunities for students to learn about different perspectives on knowledge production.
The development of safety-critical embedded systems is supported by a number of development tools... more The development of safety-critical embedded systems is supported by a number of development tools, which are increasingly integrated into automated tool chains. Safety standards require these tool chains to be qualified, which is costly and requires a large effort. To reduce cost and effort tool chains can be composed of pre-qualified tools and then themselves pre-qualified by identifying the parts of tool chain software that have an impact on safety more exactly. In this paper we propose the use of a modeling language to describe this tool chain composition. This allows us to reduce effort even further by automatically analyzing the tool chain model for safety issues. It also promises to reduce the effort and cost of later steps in the deployment of the tool chain by formalizing the communication of safety issues and automating the generation of code for tool chain software.
Development environments for embedded systems are moving towards increased automation between Com... more Development environments for embedded systems are moving towards increased automation between Commercial Of The Shelf (COTS) engineering tools. While automation provides new opportunities for e.g. verification, it also to some extent decreases the possibility of identifying and acting on safety issues that arise during development. To investigate the relationship between tool integration and safety we performed a System-Theoretic Process Analysis
The use of innovative power sources in future cars has long-ranging implications on vehicle safet... more The use of innovative power sources in future cars has long-ranging implications on vehicle safety. We studied these implications in the context of the guidance on software tool qualification in the then current ISO 26262 draft, when building an urban concept vehicle to participate in the 2011 Shell Eco-Marathon. While the guidance on tool qualification is detailed, the guidance in regard to tools integrated into tool chains is limited. It only points out that the environment that tools execute in needs to be taken into consideration.
KTH Royal Institute of Technology and Scania are entering the GCDC 2011 under the name Scoop -Sto... more KTH Royal Institute of Technology and Scania are entering the GCDC 2011 under the name Scoop -Stockholm Cooperative Driving. This paper is an introduction to their team and to the technical approach they are using in their prototype system for GCDC 2011.
Abstr act. The typical development environment today consists of many specialized development too... more Abstr act. The typical development environment today consists of many specialized development tools, which are partially integrated, forming a complex tool landscape with partial integration. Traditional approaches for reasoning about tool integration are insufficient to measure the degree of integration and integration optimality in today's complex tool landscape. This paper presents a reference model that introduces dependencies between, and metrics for, integration aspects to overcome this problem. This model is used to conceive a method for reasoning about tool integration and identify improvements in an industrial case study. Based on this we are able to conclude that our reference model does not detract value from the principles that it is based on, instead it highlights improvements that were not well visible earlier. We conclude the paper by discussing open issues for our reference model, namely if it is suitable to use during the creation of new systems, if the used integration aspects can be subdivided further to support the analysis of secondary issues related to integration, difficulties related to the state dependency between the data and process aspects within the context of developing embedded systems and the analysis of non-functional requirements to support tool integration.
High prole systemic safety standards for Cyber-Physical Systems (CPS) development within the tran... more High prole systemic safety standards for Cyber-Physical Systems (CPS) development within the transportation domain have commonalities with regard to their view of the safety-related implications of tool usage. Their guidelines on tool qualication favour a bottom-up approach in which tools are dealt with in isolation and mostly if they may directly introduce faults into end products. This guidance may ignore risk introduced by the integration of software tools, especially if these risks are related to low levels of automation-such as process notications and improper graphical user interfaces. This paper presents a study that ties weaknesses in support environments to software faults. Based on the observed weaknesses guidelines for a top-down software tool chain qualication are suggested for inclusion in the next generation of safety standards. This has implications not only for the surveyed standards in the transportation domain, but also for other standards for safety-critical CPS development that do not include a broader view on risks related to tool usage. Furthermore, given the type of omission identied in the surveyed standards, it is suggested that researchers interested in the safety-related implications of tool integration should approach organizational research in search of possibilities to set up theory triangulation studies.
The tool integration research area emerged in the 1980s. This survey focuses on those strands of ... more The tool integration research area emerged in the 1980s. This survey focuses on those strands of tool integration research that discuss issues beyond technology. We reveal a discourse centered around six frequently mentioned non-functional properties. These properties have been discussed in relation to technology and high level issues. However, while technical details have been covered, high level issues and, by extension, the contexts in which tool integration can be found, are treated indierently. We conclude that this indierence needs to be challenged, and research on a larger set of stakeholders and contexts initiated. An inventory of the use of classication schemes underlines the diculty of evolving the classical classication scheme published by Wasserman. Two frequently mentioned redenitions are highlighted to facilitate their wider use. A closer look at the limited number of research methods and the poor attention to research design indicates a need for a changed set of research methods. We propose more critical case studies and method diversication through theory triangulation. Additionally, among disparate discourses we highlight several focusing on standardization which are likely to contain relevant ndings. This suggests that open communities employed in the context of (pre-)standardization could be especially important in furthering the targeted discourse.
Context: Exploratory Testing (ET) is a manual approach to software testing in which learning, tes... more Context: Exploratory Testing (ET) is a manual approach to software testing in which learning, test design and test execution occurs simultaneously. Still a developing topic of interest to academia, although as yet insufficiently investigated , most studies focus on the skills and experience of the individual tester. However, contextual factors such as project processes, test scope and organisa-tional boundaries are also likely to affect the approach. Objective: This study explores contextual differences between teams of testers at a MedTec firm developing safety-critical products to ascertain whether con-textual factors can influence the outcomes of ET, and what associated implications can be drawn for test management. Method: A development project was studied in two iterations, each consisting of a quantitative phase testing hypotheses concerning when ET would identify faults in comparison to other testing approaches and a qualitative phase involving interviews. Results: Influence on ET is traced to how the scope of tests focus learning on different types of knowledge and imply an asymmetry in the strength and number of information flows to test teams. Conclusions: While test specialisation can be attractive to software development organisations, results suggest changes to processes and organisational structures might be required to maintain test efficiency throughout projects: the responsibility for test cases might need to be rotated late in projects, and asymmetries in information flows might require management to actively strengthen the presence and connections of test teams throughout the firm. However, further research is needed to investigate whether these results also hold for non safety-critical faults.
The security and safety of Cyber-Physical Systems (CPS) often influence each other. Ensuring that... more The security and safety of Cyber-Physical Systems (CPS) often influence each other. Ensuring that this does not have negative implications might require a large and rigorous effort during the development of CPS. However, early in the life-cycle, quick feedback can be valuable helping security and safety engineers to understand how seemingly trivial design choices in their domain may have unacceptable implications in the other. We propose the Cyber Risk Assessment Framework (CRAF) for this purpose. The CRAF is based on openly available and widely used taxonomies from the safety and security domains, and a unique mapping of where loss of data security may impact aspects of data with safety implications. This paper represents the first time these different elements have been brought together into a single framework with an associated process. Through examples from within our organisations we show how this framework can be put to good use.
Master students at our institute were graduating without acceptable research proficiency. We inte... more Master students at our institute were graduating without acceptable research proficiency. We intervened by shifting our research training from teaching-centred to student-centred, and from research-related subject content to research-related processes. We performed a mixed methods study aimed to confirm there was improved research proficiency without a negative trade-off for our students' engineering skills. Results indicated improvements to research proficiency, which our students were able to transfer to engineering-related learning activities to increase their ability to achieve engineering synthesis. This outcome was potentially supported by our courses including several perspectives on scientific knowledge production. This implies that research training, rather than having a negative effect on engineering skills, can be helpful in learning diametrically opposing aspects of thinking required by current engineering. As engineering education evolves towards more cross-disciplinary cooperation, this implies the need to pursue the increased opportunities for students to learn about different perspectives on knowledge production.
The development of safety-critical embedded systems is supported by a number of development tools... more The development of safety-critical embedded systems is supported by a number of development tools, which are increasingly integrated into automated tool chains. Safety standards require these tool chains to be qualified, which is costly and requires a large effort. To reduce cost and effort tool chains can be composed of pre-qualified tools and then themselves pre-qualified by identifying the parts of tool chain software that have an impact on safety more exactly. In this paper we propose the use of a modeling language to describe this tool chain composition. This allows us to reduce effort even further by automatically analyzing the tool chain model for safety issues. It also promises to reduce the effort and cost of later steps in the deployment of the tool chain by formalizing the communication of safety issues and automating the generation of code for tool chain software.
Development environments for embedded systems are moving towards increased automation between Com... more Development environments for embedded systems are moving towards increased automation between Commercial Of The Shelf (COTS) engineering tools. While automation provides new opportunities for e.g. verification, it also to some extent decreases the possibility of identifying and acting on safety issues that arise during development. To investigate the relationship between tool integration and safety we performed a System-Theoretic Process Analysis
The use of innovative power sources in future cars has long-ranging implications on vehicle safet... more The use of innovative power sources in future cars has long-ranging implications on vehicle safety. We studied these implications in the context of the guidance on software tool qualification in the then current ISO 26262 draft, when building an urban concept vehicle to participate in the 2011 Shell Eco-Marathon. While the guidance on tool qualification is detailed, the guidance in regard to tools integrated into tool chains is limited. It only points out that the environment that tools execute in needs to be taken into consideration.
KTH Royal Institute of Technology and Scania are entering the GCDC 2011 under the name Scoop -Sto... more KTH Royal Institute of Technology and Scania are entering the GCDC 2011 under the name Scoop -Stockholm Cooperative Driving. This paper is an introduction to their team and to the technical approach they are using in their prototype system for GCDC 2011.
Abstr act. The typical development environment today consists of many specialized development too... more Abstr act. The typical development environment today consists of many specialized development tools, which are partially integrated, forming a complex tool landscape with partial integration. Traditional approaches for reasoning about tool integration are insufficient to measure the degree of integration and integration optimality in today's complex tool landscape. This paper presents a reference model that introduces dependencies between, and metrics for, integration aspects to overcome this problem. This model is used to conceive a method for reasoning about tool integration and identify improvements in an industrial case study. Based on this we are able to conclude that our reference model does not detract value from the principles that it is based on, instead it highlights improvements that were not well visible earlier. We conclude the paper by discussing open issues for our reference model, namely if it is suitable to use during the creation of new systems, if the used integration aspects can be subdivided further to support the analysis of secondary issues related to integration, difficulties related to the state dependency between the data and process aspects within the context of developing embedded systems and the analysis of non-functional requirements to support tool integration.
Uploads
Papers by F. Asplund