Intents and upgrades in component-based highassurance systems

Summary. This chapter addresses challenges for model-driven development of embedded systems in industrial practice. These are rooted in the necessity of flexible development of new functionality at low development cost. Where a dependability requirement is added, e.g. support for assurance of safety requirements, then extending functionality by pluging in a new component, or modifying an existing component, without extensive safety-related and fault tolerance tests, is far from today’s industrial practice. The chapter highlights lessons learnt from three applications of model-driven development for high-assurance software components. The components were embedded in vehicular safety restraints, aerospace, and secure radio communication systems respectively. While our experiences in these three fields of application are compared and contrasted, the emphasis will be placed on the specific requirements of safety-critical software in aerospace systems with the following three characteristics: long life, high level of assurance, and forthcoming demands on efficient upgrades of assemblies of components. We discuss the need for relating intent specifications to formally verified design models from which safety-critical code is generated