Developing High Assurance Avionics Systems with the Scr Requirements Method*

In high assurance avionics systems, such as systems for flight guidance, air traffic control, and collision avoidance, compelling evidence is required that the system behavior satisfies certain critical properties. Some critical properties are functional properties, properties of the services that the system delivers. For example, when another aircraft flies too close, a collision avoidance system must advise the pilot to move the aircraft up or down to avoid a collision. Besides functional properties, four other classes of critical system properties may be identified: security, safety, realtime, and fault-tolerance. In most cases, an avionics system must satisfy properties in more than a single class. For example, a collision avoidance system must satisfy not only functional properties, but real-time constraints, fault-tolerance properties, and safety properties.