信息技术 程序设计语言 在高集成系统中Ada编程语言的使用指南

[中文适用范围]： 本技术报告提供了在生产高完整性系统时使用 Ada 的指导。 在制作此类应用程序时，通常必须向独立机构证明遵守指南或标准。 这些指南或标准根据应用领域、工业部门或所涉及风险的性质而有所不同。 对于安全应用，国际通用标准是 [IEC 61508]，其中第 3 部分涉及软件。 对于安全系统，多国通用评估指南是[ISO CD 15408]。 对于特定部门的指导和标准，有： 机载民用航空电子设备：[DO-178B] 核电厂：[IEC 880] 医疗系统：[IEC 601-4] 制药：[GAMP] 对于国家/地区指导和标准，有英国国防：[DS 00-55] 欧洲铁路：[EN 50128] 欧洲安全：[ITSEC] 美国核能：[NRC] 英国汽车：[MISRA] 美国医疗：[FDA] 美国航天：[NASA]上述标准和指南在本技术报告中统称为标准。 上述列表并不详尽，但表明了本技术报告提供指导的标准类型。 上述具体标准并未单独讨论，但本技术报告是根据对其要求和建议的分析综合而成的。 1 范围内 本技术报告假设正在 Ada 中开发一个系统，以满足上面列出的标准或类似性质的标准。 本技术报告的主要目标是将一般要求转化为 Ada 特定要求。 例如，通用标准可能要求动态测试提供应用程序代码中所有语句的执行证据。 对于泛型，本技术报告将其解释为意味着应执行泛型的所有实例化。 本技术报告仅旨在提供指导，因此没有“必须”。 然而，本技术报告确定了应根据所采用的行业特定标准解决和记录的验证和确认问题。 以下主题属于本技术报告的范围： · 有助于验证和符合标准的语言功能的选择， · 需要额外验证步骤的语言功能的识别， · 辅助设计和验证的工具的使用， · 与用于高完整性应用程序的编译器资格相关的问题， · 工具，例如生成用户可以访问的 Ada 源代码的图形设计工具。 生成 Ada 源代码的工具需要特别考虑。 在生成的代码可能被修改或扩展的情况下，如果考虑了指南，将有助于扩展和整个系统的验证。 即使没有计划修改，对生成的代码的检查和分析也可能是不可避免的，除非生成器是可信的或根据适用的标准“合格”的。 最后，即使生成的代码既没有被修改也没有被检查，如果代码偏离了旨在促进测试和分析的准则，则整个验证过程可能会变得更加复杂。 此类工具的潜在用户应根据本技术报告中提供的指导评估其代码生成。 [外文原描述]： 1 Scope This Technical Report provides guidance on the use of Ada when producing high integrity systems. In producing such applications it is usually the case that adherence to guidelines or standards has to be demonstrated to independent bodies. These guidelines or standards vary according to the application area, industrial sector or nature of the risk involved. For safety applications, the international generic standard is [IEC 61508] of which part 3 is concerned with software. For security systems, the multi-national generic assessment guide is [ISO CD 15408]. For sector-specific guidance and standards there are: Airborne civil avionics: [DO-178B] Nuclear power plants: [IEC 880] Medical systems: [IEC 601-4] Pharmaceutical: [GAMP] For national/regional guidance and standards there are the following: UK Defence: [DS 00-55] European rail: [EN 50128] European security: [ITSEC] US nuclear: [NRC] UK automotive: [MISRA] US medical: [FDA] US space: [NASA] The above standards and guides are referred to as Standards in this Technical Report. The above list is not exhaustive but indicative of the type of Standard to which this Technical Report provides guidance. The specific Standards above are not addressed individually but this Technical Report is synthesized from an analysis of their requirements and recommendations. 1.1 Within the scope This Technical Report assumes that a system is being developed in Ada to meet a standard listed above or one of a similar nature. The primary goal of this Technical Report is to translate general requirements into Ada specific ones. For example, a general standard might require that dynamic testing provides evidence of the execution of all the statements in the code of the application. In the case of generics, this is interpreted by this Technical Report to mean all instantiations of the generic should be executed. ISO/IEC TR 15942:2000 (E) 2 © ISO/IEC 2000 - All rights reserved This Technical Report is intended to provide guidance only, and hence there are no ?shalls'. However, this Technical Report identifies verification and validation issues which should be resolved and documented according to the sector-specific standards being employed. The following topics are within the scope of this Technical Report: _ the choice of features of the language which aid verification and compliance to the standards, _ identification of language features requiring additional verification steps, _ the use of tools to aid design and verification, _ issues concerning qualification of compilers for use on high integrity applications, _ tools, such as graphic design tools, which generate Ada source code which is accessible to users. Tools which generate Ada source code require special consideration. Where generated code may be modified or extended, verification of the extensions and overall system will be assisted if the guidelines have been taken into account. Even where modification is not planned, inspection and analysis of the generated code may be unavoidable unless the generator is trusted or ?qualified' according to an applicable standard. Finally, even if generated code is neither modified nor inspected, the overall verification process may be made more complicated if the code deviates from guidelines intended to facilitate testing and analysis. Potential users of such tools should evaluate their code generation against the guidance provided in this Technical Report. 1.2 Out of scope The following topics are considered to be out of scope with respect to this Technical Report: _ Domain-specific standards, _ Application-specific issues, _ Hardware and system-specific issues, _ Human factor