Contractual specification of reliable software

Abstract

Within the context of this chapter, high-integrity software will be taken as meaning software which must satisfy the integrity requirements of an external body: this could be an aviation authority for safety-critical software in an aircraft, security authorities for software protecting classified data, or the safety boards in the various industries where computers are used to control hazardous processes. Procedures in these various fields are far from being fixed, let alone standardized, but inevitably there are factors which are common to the production of approved software for no matter what application. In particular, the roles played by the interested parties will be similar. As we are concerned with the contractual situation, there will always be a procurer and an implementor for the software. For high-integrity software, there must always be an approver who is responsible for allowing the system to be used. In most situations, neither the procurer nor the approver will have enough detailed knowledge about a system to decide whether it is trustworthy or not. Consequently, from the contractual point of view, the problem is not so much a question of producing high-integrity software as of demonstrating its integrity to the approver. The system must not only be trustworthy, but must be seen to be trustworthy in the approver’s eyes. In cases where the public is at risk from the incorrect operation of software, accountability requires that approvers should be able to demonstrate their mechanisms of approval and the evidence on which a given approval was based.