Software Classification Methodology and Standardisation 07 March 2003 1/10
Table of Contents 1. INTRODUCTION a Galileo system overview Ε b Master schedule Ε 2. GALILEO SAFETY CASE APPROACH Ε 3. SYSTEM HAZARDS AND SOFTWARE CLASSIFICATION METHODOLOGY a System safety hazards definition and software DAL classification Ε b System hazards and software DAL determination process Ε 4. GALILEO SOFTWARE STANDARD a Objectives Ε b Content Ε 5. CONCLUSION Ε 2/10
GALILEO System Overview Regional Components Global MEO Constellation & Ground Control Local Components SAR User Segment Service Centres 3/10
Master Schedule DEFINITION DEV & VALIDATION DEPLOYMENT OPERATIONS 2000 2003 2004 2005 2006 2008 Definition Development & Validation PHASE B2 PHASE CD PDR CDR SQR In-Orbit Validation (IOV) Test Bed (GSTB) Full Deployment IOVR Operations Local Elements User Receiver / Applications PDR: Preliminary Design Review CDR: Critical Design Review SQR: System Qualification Review IOVR: In-Orbit Validation Review Launches 4/10
GALILEO Safety Case Approach (TBC) Certification Requirements? Certification Authorities? GALILEO operation phase Safety Case? Safety Operational File? System Operator (JU)? GALILEO development phase Safety Assurance File ESA Development processes (safety, system, software, configuration management ) System and segments safety requirements (definition and verification report) Safety Risk management and RAM analyses Software qualification datapackage (SDP, COTS/re-used/tools justification, verification & validation reports, ) Safety deviations and waivers 5/10
System Safety Hazards Definition and Related Software Classification Severity System safety hazards Direct classical Indirect navigation-related Software DAL Catastrophic Loss of life, life threatening or permanently disabling injury or occupational illness Loss of launch site facilities Long-term detrimental environmental effects None A Critical Temporarily disabling but not life threatening injury or temporarily occupational illness Short-term environmental detrimental environmental effects Loss or damage to public or private property The position error exceeds the specified Alert Limit and the user is not informed within the Time to Alert (Hazardous Misleading information / Integrity event) B Major Temporarily loss of satellite or ground facility not leading to catastrophic or critical event Loss of continuity Loss of Search and Rescue Service C Minor None Degradation of mission performances not leading to catastrophic / critical / major consequences (loss of availability) D Negligible All others None E DAL = Development Assurance Level 6/10
System Hazards and Software DAL System hazards Determination Process System functions System RAM analyses Segments hazards Software DAL Segment functions Segment RAM analyses Units hazards Software DAL Unit functions Unit RAM analyses Software components DAL Hardware components 7/10
Software Standards : Objectives To define a How project standard in response to the what from ESA ECSS standards (E40B and Q80B) To have Software engineering and product assurance commonality (many European companies involved) To tailor ESA ECSS standards to Galileo software DAL (DO178B/IEC61508 and other standards used within relevant industry sectors - i.e. aviation, maritime, rail, road are not applicable) To plan future software qualification means for Galileo certification purpose (currently no certification authority and no European certification requirements) 8/10
Software Standards : Content Software life-cycles vs. software types (I.e: algorithms, database, MMI, tool ) Software engineering methods (specification, design, coding, tests) Software documentation templates Software configuration management Software safety analyses Software re-used and COTS procedures Audits procedures Quality model and metrication Traceability Matrix to ESA ECSS E40B/Q80B Software DAL Applicability matrix 9/10
Conclusion No certification authorities and requirements established yet Safety case is the responsibility of the system operator only The current Safety Case approach will have to be validated with certification authorities Safety Assurance File is applicable to space, ground and user segments Diversity of industries involved in Galileo needs to define a common Galileo software standard Galileo Software standard is written so as to cover the DO178B objectives Complex software is covered by Galileo SW standard (I.e. algorithms, COTS, re-used software ) 10/10