Adaptive MILS Evidential Tool Bus slides.

1. Adaptive MILS
Evidential Tool Bus
University Grenoble Alpes
Univ. Grenoble Alpes Adaptive MILS Evidential Tool Bus 1

2. Certification Assurance Plane
 Interactions and role in CITADEL
Adaptive–MILS Evidential Tool Bus
 Concept and Objectives
 Design, Interfaces and Workflows
 Implementation
Examples
Outline
Univ. Grenoble Alpes Adaptive MILS Evidential Tool Bus 2

3.  create and maintain the certification
evidence for the system
 two usages foreseen for evidence
construction
 a-priori construction, before startup
and/or before a reconfiguration step
 just-in-time construction, for the
current running configuration
Certification Assurance Plane
Univ. Grenoble Alpes Adaptive MILS Evidential Tool Bus 3

4. The CITADEL vision
Univ. Grenoble Alpes Adaptive MILS Evidential Tool Bus 4

5.  certification assurance artifact repository
 rely on the prior D-MILS work on
assurance case construction in GSN
 develop modular assurance cases for
Dynamic-MILS systems
 develop assurance case patterns and
pattern instantiation mechanisms
 separation of concerns
 construction and manipulation of evidence
 extraction and presentation through
specific documents required for
certification
AM-ETB Evidence Database
Univ. Grenoble Alpes Adaptive MILS Evidential Tool Bus 5

6.  run verification/other tools
 according to specific workflows
 create/update parts of the assurance case
 offline/online verification tools need
 (annotated) models of the policy
architecture, platform, configuration, …
 properties to be checked
 access to monitoring results / properties, …
 platform introspection facilities, …
AM-ETB Functionality
Univ. Grenoble Alpes Adaptive MILS Evidential Tool Bus 6

7. View of Certification Assurance
Univ. Grenoble Alpes Adaptive MILS Evidential Tool Bus 7
Assurance
Case
Top
Goals/Props
Platf
Arg(s)
Comp’t
Arg(s)
Compos’n
Arg(s)
Sub-Goals/Props
Provenance
of Evidence
. . .
Config’n
Correctness
Arg(s)
Conformance Property
Evidence
Certification Assurance Artifact Repository
AM-ETB
Verification
Tools
Models Props Configs
A.C.
Patterns
Tool
Flows
Models
Models
Props
Props
Configs
Configs

8.  D2.4 - ETB – Evidential Tool Bus
Overall coordination for the production
and maintenance of an assurance case for
Adaptive-MILS systems
 D2.4 - AR - Assurance Repository
Manage concrete representation and
access to assurance case during its
construction by AM-ETB
Two Categories of Requirements
Univ. Grenoble Alpes Adaptive MILS Evidential Tool Bus 8

9. Certification Assurance Plane
 Interactions and role in CITADEL
Adaptive–MILS Evidential Tool Bus
 Concept and Objectives
 Design, Interfaces and Workflows
 Implementation
Examples
Outline
Univ. Grenoble Alpes Adaptive MILS Evidential Tool Bus 9

10.  relationship to other CITADEL components
Univ. Grenoble Alpes Adaptive MILS Evidential Tool Bus 10
AM-ETB Architecture
Patterns
Repository
Evidence
Repository
AM-ETB
Core Workflow
Assurance
Case
Assurance
Case
Pattern
System
Models
System
Properties
AM-ETB
Tool Agent
External
Tool
Error
Log

11.  AC Patterns
 generic fragments of AC arguments
 decouple the AC argument from
concrete system information / evidence
 GSN with formal parameters denoting
 system/modelling concepts and
 techniques/tools for building evidence
 a textual representation defined
 term-based
Univ. Grenoble Alpes Adaptive MILS Evidential Tool Bus 11
Assurance Case Patterns

12. Univ. Grenoble Alpes Adaptive MILS Evidential Tool Bus 12
Assurance Case Patterns
Goal
Policy {P} is deadlock-free
Strategy: for all modes {M} of {P}
Goal
Policy {P} in mode {M} is
deadlock-free
Assumption:
finite number of
modes
Evidence
formal verification :
policy {P} in mode
{M} is deadlock free

13.  structured textual representation
Univ. Grenoble Alpes Adaptive MILS Evidential Tool Bus 13
Assurance Case Patterns
pattern(policy_deadlock_freedom,
[ P : Policy ],
goal(g1, "policy {P} is deadlock-free", [],
[ strategy(s1, "adress all operating modes",
[ M : Mode in P.modes() ],
[ assumption(finite number of operating modes) ],
[ goal(g2, "policy {P} is deadlock-free in mode {M}", [],
[ evidence("Policy-Verification",
"formal verification of deadlock-freedom
for {P} in mode {M}", [])
])
])
])
)

14.  instantiation of AC patterns
 develop/instantiate recursively the
pattern goals for given parameters
(system model and properties, tools)
 produce a flat assurance case
 track errors
 when evidence nodes are encountered
trigger evidence (re-)construction and
(re-)validation
Univ. Grenoble Alpes Adaptive MILS Evidential Tool Bus 14
AM-ETB Core Workflow

15. Univ. Grenoble Alpes Adaptive MILS Evidential Tool Bus 15
AC Pattern Instantiation: Example
{P} is safe
{P} is deadlock-free
foreach standard {X} in iso-
xxx, iso-yyy
{P} conforms to {X}
{X} certificate for
{P}
S2S1
Policy architecture « A »
{P} is deadlock-free
foreach subject {S}
of {P}
{P} composition is
deadlock-free
{S} is deadlock-free
Proof-of-
deadlock-
freedom {S}
Deadlock-free
composition {P}
Top (main) AC pattern

16. Univ. Grenoble Alpes Adaptive MILS Evidential Tool Bus 16
AC Pattern Instantiation: Example
{P} is safe
{P} is deadlock-free
foreach standard {X} in iso-
xxx, iso-yyy
{P} conforms to {X}
{X} certificate for
{P}
S2S1
Policy architecture « A »
A is safe
A is deadlock-free foreach standard
A conforms to iso-
xxx
A certificate for
iso-xxx
A conforms to iso-
yyy
A certificate for
iso-yyy
Pattern « call » needing to be
further instantiated…

17. Univ. Grenoble Alpes Adaptive MILS Evidential Tool Bus 17
AC Pattern Instantiation: Example
{P} is deadlock-free
foreach subject {S}
of {P}
{P} composition is
deadlock-free
{S} is deadlock-free
Proof-of-
deadlock-
freedom {S}
Deadlock-free
composition {P}
S2S1
Policy architecture « A »
A is deadlock-free
foreach subject S of
A
A composition is
deadlock-free
S1 is deadlock-free
Proof-of-
deadlock-
freedom S1
Deadlock-free
composition of A
S2 is deadlock-free
Proof-of-
deadlock-
freedom S2

18. Univ. Grenoble Alpes Adaptive MILS Evidential Tool Bus 18
AC Pattern Instantiation: Example
A is deadlock-free
foreach subject S of
A
A composition is
deadlock-free
S1 is deadlock-free
Proof-of-
deadlock-
freedom S1
Deadlock-free
composition of A
S2 is deadlock-free
Proof-of-
deadlock-
freedom S2
S2S1
Policy architecture « A »
A is safe
A is deadlock-free foreach standard
A conforms to iso-
xxx
A certificate for
iso-xxx
A conforms to iso-
yyy
A certificate for
iso-yyy
Assurance Case for « A »
Current implementation available at svn/Tech-Notes/ETB1/code/v1/

19.  instantiation of AC patterns
 structure preserving
 storage of intermediate results – avoid re-
instantiation / evidence checking of the
same AC fragment
 workflow execution control
 sequential / concurrent instantiation
 synchronous / asynchronous evidence
checking
 time budget, etc
Univ. Grenoble Alpes Adaptive MILS Evidential Tool Bus 19
AM-ETB Core Workflow

20.  thin wrappers for invocation of
verification/analysis tools
(evidence construction)
 provide an unified view on tool
interactions from AM-ETB perspective
 initiate/perform the analysis
 provide the validity of the analysis result
(VALID / NOT VALID)
 record (justification of) valid results in the
evidence artefact repository
 one tool agent for a category of evidence
Univ. Grenoble Alpes Adaptive MILS Evidential Tool Bus 20
Tool Agents

21.  21 evidence categories
have been identified, organized into
 specification (5)
 configuration (3)
 verification & validation (4)
 safety analysis (2)
 FDIR (4)
 performability (1)
 standards compliance (2)
Univ. Grenoble Alpes Adaptive MILS Evidential Tool Bus 21
Assurance Evidence

22.  provide persistent storage
 define generic API access to the AC
representation / store
 provide AC inspection and export to
different notations/standards (e.g.,
text / GSN / SACM)
Univ. Grenoble Alpes Adaptive MILS Evidential Tool Bus 22
Assurance Cases

23. Certification Assurance Plane
 Interactions and role in CITADEL
Adaptive–MILS Evidential Tool Bus
 Concept and Objectives
 Design, Interfaces and Workflows
 Implementation
Examples
Outline
Univ. Grenoble Alpes Adaptive MILS Evidential Tool Bus 23

24.  textual syntax for AC patterns
 instantiation workflow, including protocols
for interaction with tool agents
 repository of assurance cases
 repository of evidence artifacts
 assurance case export (txt, html)
 integration within the CITADEL framework
 re-uses some software components
developed in the D-MILS project
 fully documented in Deliverable D5.2
Univ. Grenoble Alpes Adaptive MILS Evidential Tool Bus 24
AM-ETB Implementation

25. AMT-ETB major modes and actions
Univ. Grenoble Alpes Adaptive MILS Evidential Tool Bus 25
 nb: evidence update is desynchronized

26. A list of AC patterns and associated arguments:
APList = [ ’foundational_plane’-[Platform],
’person’-[’Alice’, ’AC Patterns Definition’],
’person’-[’Bob’, ’AM-ETB Development’],
’invariant_property’-[ModelId, ’p1’],
’invariant_property’-[ModelId, ’p2’]],
Output trace of AM-ETB:
?- instantiate:instantiate_pattern_list(APList, ’ac2’)
*** instantiating pattern foundational_plane ... done.
*** instantiating pattern foundational_plane_node ... done.
*** instantiating pattern foundational_plane_node ... done.
*** instantiating pattern foundational_plane_nsm ... done.
*** instantiating pattern foundational_plane_tsn ... done.
*** instantiating pattern person ... done.
*** instantiating pattern person ... done.
*** instantiating pattern invariant_property ... done.
*** instantiating pattern invariant_property ... done.
?-
AC Pattern list instantiation
Univ. Grenoble Alpes Adaptive MILS Evidential Tool Bus 26

27. AC export as HTML
Univ. Grenoble Alpes Adaptive MILS Evidential Tool Bus 27
 representation
preserving the
structure of the
patterns
 record information
about the
instantiation
process

28.  D2.4 - Requirements for CITADEL
Technology
 D5.1 – Interfaces and Workflow
Definition for AM-ETB
 D5.2 – AM-ETB Tool Bus for Tool
Integration and Assurance
 Koelemeijer et al: A Model-based
Approach to Certification of Adaptive
MILS. MILS@DSN 2018
References
Univ. Grenoble Alpes Adaptive MILS Evidential Tool Bus 28

29. Questions ?
Univ. Grenoble Alpes Adaptive MILS Evidential Tool Bus 29

30. Principal Objective:
 Assurance case presents the argument that a system will be acceptably safe in a
given context
An assurance case requires two elements:
 Supporting Evidence
Results of observing, analysing, testing, simulating and
estimating the properties of a system that provide the
fundamental information from which safety can be inferred
 High Level Argument
Explanation of how the available evidence can be
reasonably interpreted as indicating acceptable safety –
usually by demonstrating compliance with requirements,
sufficient mitigation / avoidance of hazards etc
Argument without Evidence is unfounded
Evidence without Argument is unexplained
Assurance Cases
Univ. Grenoble Alpes Adaptive MILS Evidential Tool Bus 30

31. Purpose of a Goal Structure
To show how goals are broken down into sub-goals,
and eventually supported by evidence (solutions)
whilst making clear the strategies adopted, the
rationale for the approach (assumptions, justifications)
and the context in which goals are stated
The Goal Structuring Notation
Univ. Grenoble Alpes Adaptive MILS Evidential Tool Bus 31
A/J

32. A Simple GSN Example
Univ. Grenoble Alpes Adaptive MILS Evidential Tool Bus 32
G1
Press is acceptably safe to
operate within Whatford Plant
C1
Press
specification
C2
Press operation
C3
Whatford Plant
S1
Argument by addressing
all identified operating
hazards
S2
Argument of compliance
with all applicable safety
standards and
regulations
C4
All identified
operating hazards
C5
All applicable safety
standards and
regulations
G2
Hazard of 'Operator Hands
Trapped by Press Plunger'
sufficiently mitigated
G3
Hazard of 'Operator Upper
Body trapped by Press
Plunger' sufficiently
mitigated
G4
Hazard of 'Operator Hands
Caught in Press Drive
Machinery' sufficiently
mitigated
G5
Press compliant with UK
HSE Provision and Use of
Work Equipment Regulations
G6
Press compliant with UK
enactment of EU Machinery
Directive
G7
PES element of press
design compliant with
IEC1508
Sn1
FTA
analysis
Sn2
Formal
verification
Sn3
SIL3
certificate
Sn4
Audit report
Sn5
Compliance
sheet