-171- XA TEST PROCEDURES ON THE OBJECT CODE OF I&C SAFETY SYSTEMS SOFTWARE. E-U. MAINKA, D. HAAKE TUV Nord, Hamburg Germany

Transcription

1 -171- XA TEST PROCEDURES ON THE OBJECT CODE OF I&C SAFETY SYSTEMS SOFTWARE E-U. MAINKA, D. HAAKE TUV Nord, Hamburg Germany

2 TOV NORD G R U P P E i j Test procedures on the object code of I&C safety systems software I&C system TELEPERM XS Assessment procedure and assessors V&V steps Static analyzer toolset CATS Assessment steps based on static object code analysis Configuration test tool Object code based configuration check Summary Vorirag zum IAEA specialists meeting , Folie 1

3 TUV NORD GRUPPE ' [,.' * "' Jj *2*.. I&C system TELEPERM XS (TXS). Siemens AG TXS is a distributed I&C system designed for applications important to safety in NPP TXS consists of about 20 different hardware modules, among them 1 microprocessor based processing module and 2 different microprocessor based communication modules about 15 software components, among them the application independent system software components the application dependent software components Most of system software components run on processing modules and communication modules, some of them only on processing modules or communication modules Application independent system software is mainly specified and implemented manually. Application software (plant specific functionality) is graphically specified and automatically generated by code generators. «Gruppe Rechnergestutzte Systeme Folie 2

4 TOV NORD GRUPPE Assessment procedure and assessors In addition to Software quality management and V&V activities to be performed and documented by the developer the qualification for safety applications in NPP according to the German law includes a two-step assessment by an independent test organisation: Application independent module type test + application independent system (integration) test and Plant specific checks and tests These assessment activities were ordered by,,bayrisches Staatsministerium fur Landesentwicklung und Umweltfragen" as licensing authority in Bavaria. Assessor organisations were GRS (main contractor) ISTec (project leader software) TUV Nord e.v. (software, project leader hardware) TUV Rheinland (hardware) Vortragzum IAEA specialists meeting , Folie 3

5 TUV NORD GRUPPE 1,1 7%; IP 5 ' V&V steps Application software System software. Function blocks SPACE (graphical FP/FPG spec.) Code Generators Database consistency checks Development documentation: Requirement spec. SW requirement spec. Design spec. Implementation doc. Source code c u m e n t r FPG and AU source files "RETRANS V & V <r 1 s 1 1 M U L A 1 T 1 1 I 0 1 N ' * Compiler Linker i application object files 1 Simulator. object files prelinks Linker Compiler Linker test executables Tests Test specification Test report T CATS Objectcode based verification Configuration _check executable program CATS Objectcode based verification Confjgijratipn_ched< \ Loader Identity check by segment CRC's V&V by functional tests TXS processing unit Folie /Dr.Haa, Mai

6 TUV NORD GRUPPE II Static analyzer toolset CATS object file (executable code) map file (program relocation map) start address files (manually edited) Disassembler metric overview assembler list Programanalyzer metric overview program decomposition Routine analyzer Control flow analyzer metric overview detailed routine control flow Data flow analyzer metric overview detailed routine data flow Operation time analyzer metric overview detailed routine runtime amount Gruppe Rechnergestutzte Systeme Folie /Dr.Haa, Mai

7 TUV NORD GRUPPE Application fields of CATS Analysing of program code written in assembler Verification of consistency between code documentation and executable code Verification of global code features like Usage of resources (memory, I/O ports) Function/procedure nesting (code sharing, calling depth) Evaluation of runtime behavior Verification of compilation and linking procedures Evaluation of program metrics Gruppe Rechnergestlitzte Systeme Folie 6

8 TUV NORD GRUPPE 111 v Objectcode based assessment activities Analysis of self test code (system software, manually implemented, partly in assembler) Aim: Formal check of code quality, functional check on complete configuration Tools used: Disassembler, Program Analyser, Controlflow Analyser Results: Self test was correct configured (all tests activated) Disassembler hinted on error of the C-compiler used Program Analyser overview results showed a wrong code nesting Analysis of function plan group (FPG) operation code Aim: Check on correct calling sequence of function blocks (FB) in the function plans (FP) involved Tools used: Disassembler, Program Analyser Results: The manual interpretation of calling hierarchy and sequence of FP and FB calls as delivered by the tools enabled the assessor to verify and confirm correct FPG and FP composition from FP and FB. The calling sequence of FB as generated by code generators has been verified. Folie 7

9 TOV NORD GRUPPE Configuration test tool object file (executable code) configuration test tool Segment CRC Versions and dates of system software components function plan groups function plans function blocks I/O drivers f map file (program relocation map) Motivation: Getting able to verify the software configuration in the final product - the code running in the I&C system Test method: Identification and interpretation of SW ID strings in the object code Verification of segment CRC calculated from code interpreted against segment CRC's as they are calculated in I&C system while downloading code 10 Folie /Dr.Haa, Mai

10 TOV NORD GRUPPE Objectcode based configuration check ' verification optical disk with SW documentation including all sources and executables executable code configuration test tool Segment CRC Revisions and dates of system software function plan groups function plans function blocks I/O drivers TXS I&C system I verification I Aim: Check of versions of system and application software executed in the I&C system against the type tested system software versions as documented on optical disk (copy of the development environment) and in the type test documentation. Results: The object code based check offers a simple and efficient way to verify the consistency of SW configuration of executed I&C software in the plant. oo o Folie /Dr.Haa, Mai

11 -$ ; TUV NORD GRUPPE Summary Object code based software analysis offers additional possibilities to perform some verification tasks on I&C software: It closes gaps in the area of code verification for low level assembler code It enables the assessor to get additional informations about the integrated (linked) executable code like: Complexity of the integrated product Concurrent usage of memory and I/O resources Correctness of compilation and linking processes Informations about the runtime consumption oo I The parsing of executable code for software components identification offers an efficient way to perform a configuration check of the software really executed. uruppe Rechnergestiitzte Systeme Folie 10