Safety Standards and WCET Analysis Tools

In automotive, railway, avionics, automation, and healthcare industries more and more functionality is im-plemented by embedded software. A failure of safety-critical software may cause high costs or even endan-ger human beings. Also for applications which are not highly safety-critical, a software failure may necessitate expensive updates. Contemporary safety standards – including DO-178B, DO-178C, IEC-61508, ISO-26262, and EN-50128 – re-quire to identify potential functional and non-functional hazards and to demonstrate that the software does not vi-olate the relevant safety goals. For ensuring functional program properties automatic or model-based testing, and formal techniques like model checking become more and more widely used. For non-functional prop-erties like timing identifying a safe end-of-test crite-rion is a hard problem since failures usually occur in corner cases and full test coverage cannot be achieved. For code-level timing analysis this problem is solved by abstract-interpretation-based static analysis techniques which provide full coverage and yield provably correct results. In this article we focus on static analyses of worst-case execution time, which are increasingly adopted by industry in the validation and certification process for safety-critical software. First we will give an overview of the most important safety standards with a focus on the requirements for non-functional software prop-erties. We then explain the methodology of abstract-interpretation-based analysis tools and identify crite-ria for their successful application. The integration of static analyzers in the development process requires in-terfaces to other development tools, like code genera-tors or scheduling tools. Using them for certification re-quires an appropriate tool qualification. We will address each of these topics and report on industrial experience.