PFI-TT: An Analysis Tool Supporting the Safe Deployment of New Features in Evolving Software Systems

PFI-TT：支持在不断发展的软件系统中安全部署新功能的分析工具

• 批准号: 2122689
• 负责人: Jane Huang
• 金额: $ 24.98万
• 依托单位: University of Notre Dame
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2021
• 资助国家: 美国
• 起止时间: 2021-07-15 至 2023-08-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=2122689&HistoricalAwards=false
• 关键词: PFI; TT; Analysis; Tool; Supporting

The broader impact/commercial potential of this Partnerships for Innovation - Technology Translation (PFI-TT) project will develop a tool-supported environment designed to aid in the safety analysis of software intensive systems. Developing highly dependable software for medical infusion pumps, positive train controls, and robotics applications is a challenging process that requires rigorous and systematic hazard analysis. Such systems are traditionally developed within a carefully controlled process that emphasizes detailed planning, upfront design, and phase-based quality assurance gateways. Despite these efforts, products are recalled for life-threatening safety vulnerabilities. The challenges of developing safety systems have led to the phenomenon known as the "big freeze" in which the cost, effort, and risk of introducing new features inhibit product evolution. The proposed solution will aid software safety analysts and other stakeholders in identifying system-level changes while simultaneously building a safety-case for certification or internal audit purposes. These abilities enable an organization to evolve their products without sacrificing safety, security, or other critical concerns, thereby increasing their competitive advantage. The project trains a diverse cadre of women, minorities, and persons with disabilities in entrepreneurial activities. This project will utilize cutting-edge, deep learning technologies to train a domain-specific language model that will be used to automatically generate and evolve accurate trace links between artifacts such as requirements, design, code, and test cases. The generated trace links will be used to generate novel visualizations of hazards and their mitigation pathways (i.e., hazard slices), and to highlight changes that have been introduced across different versions of the system. In addition, the hazard-slices will be integrated into existing safety-analysis techniques such as fault-trees and safety-assurance cases. The novel hazard-based visualizations are designed to aid analysts and developers in addressing emergent safety concerns in large, complex, and evolving software projects. Finally, the work will provide tools for analyzing changes in the software system, generating explanations to aid in the identification of potential safety problems, and recommending actions that could be taken to mitigate safety risks introduced by the changes.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.

该创新合作伙伴关系 - 技术翻译 (PFI-TT) 项目的更广泛影响/商业潜力将开发一个工具支持的环境，旨在帮助对软件密集型系统进行安全分析。为医用输液泵、主动列车控制和机器人应用开发高度可靠的软件是一个具有挑战性的过程，需要严格和系统的危害分析。传统上，此类系统是在精心控制的流程中开发的，该流程强调详细规划、前期设计和基于阶段的质量保证网关。尽管做出了这些努力，产品还是因危及生命的安全漏洞而被召回。开发安全系统的挑战导致了一种被称为“大冻结”的现象，即引入新功能的成本、精力和风险抑制了产品的发展。拟议的解决方案将帮助软件安全分析师和其他利益相关者识别系统级变更，同时构建用于认证或内部审计目的的安全案例。这些能力使组织能够在不牺牲安全性、安保或其他关键问题的情况下发展其产品，从而提高其竞争优势。该项目在创业活动中培训由妇女、少数民族和残疾人组成的多元化干部队伍。该项目将利用尖端的深度学习技术来训练特定领域的语言模型，该模型将用于自动生成和发展需求、设计、代码和测试用例等工件之间的准确跟踪链接。 生成的跟踪链接将用于生成危害及其缓解路径（即危害切片）的新颖可视化，并突出显示不同版本系统中引入的更改。 此外，危险切片将集成到现有的安全分析技术中，例如故障树和安全保证案例。 新颖的基于危险的可视化旨在帮助分析师和开发人员解决大型、复杂和不断发展的软件项目中出现的紧急安全问题。最后，这项工作将提供工具来分析软件系统中的变化，生成解释以帮助识别潜在的安全问题，并建议可以采取的措施来减轻变化带来的安全风险。该奖项反映了 NSF 的法定使命和通过使用基金会的智力价值和更广泛的影响审查标准进行评估，该项目被认为值得支持。

项目成果

Prompts Matter: Insights and Strategies for Prompt Engineering in Automated Software Traceability

提示很重要：自动化软件可追溯性中提示工程的见解和策略

• DOI: 10.1109/rew57809.2023.00087
• 发表时间: 2023-09
• 期刊: IEEE
• 作者: Rodriguez, Alberto D.;Dearstyne, Katherine R.;Cleland
• 通讯作者: Cleland

SAFA: A Tool for Supporting Safety Analysis in Evolving Software Systems

SAFA：支持不断发展的软件系统安全分析的工具

• DOI: 10.1145/3551349.3559535
• 发表时间: 2022-10
• 期刊: 2022
• 作者: Rodriguez, Alberto D.;Newman, Timothy;Dearstyne, Katherine R.;Cleland
• 通讯作者: Cleland