How to Achieve Qualifiable Model-based Software for Avionics Systems Development?

Is the use of domain-specific modeling (DSM) for avionics systems development without subsequent costly verification and validation a wishful thinking? No, this paper presents the qualifiable part of a framework for domain-specific modeling, as well as the steps and measures taken to achieve it. DSM offers several advantages in the development of highly complex cyber-physical systems. Complex relationships can be captured clearly in the language of the domain expert with the help of formal representations and relationships. In addition, efficient automation and processing is enabled. Nevertheless, when utilized in the safety-critical avionics domain, it often has a supportive role with the drawback of huge effort for verification of generated artifacts. This would be different, if the DSL tool itself is qualified. The generated artifacts could then be used without further verification resulting in less expensive development processes. This paper introduces the core of DOMAINES, a novel DSM framework that aims to be qualifiable. The core is a simplified meta-modeling language (MOD), its safety-critical implementation (RUNMDB), and a model interaction interface. MOD is designed to achieve the functionality required for the development of avionics systems. The RUNMDB is the implementation of MOD and utilizes the programming language Ada (and partly SPARK) as well as simplified, comprehensive, traceable and testable algorithms. To support qualification, a sophisticated test unit is implemented which checks the RUNMDB for correctness. The current implementation of the DOMAINES framework enables loading the Open Avionics Architecture Model (OAAM) as a domain-specific language and creating associated avionics system models based on textual commands. This provides the foundation for model-based development of qualified artifacts for safety-critical systems, e.g. unchecked IMA configuration generation from OAAM.