While the majority of research on Model-Based Software Engineering revolves around open-source modelling frameworks such as the Eclipse Modelling Framework, the use of commercial and closed-source modelling tools such as RSA, Rhapsody, MagicDraw and Enterprise Architect appears to be the norm in industry at present. This technical gap can prohibit industrial users from reaping the benefits of state-of-the-art research-based tools in their practice. In this paper, we discuss an attempt to bridge a proprietary UML modelling tool (PTC Integrity Modeller), which is used for model-based development of safety-critical systems at Rolls-Royce, with an open-source family of languages for automated model management (Epsilon). We present the architecture of our solution, the challenges we encountered in developing it, and a performance comparison against the tool's built-in scripting interface. In addition, we use the bridge in a real-world industrial case study that involves the coordination with other bridges between proprietary tools and Epsilon.

Software is critical to the majority of functionality in avionics and aerospace systems. The amount of safety-related software in avionics is growing rapidly (doubling in size around every four years), and the costs of software programmes in industry are increasingly unaffordable – safety-related code can cost upwards of USD $150 per line. At the same time, demands from avionics customers for increased scope and new functionality is increasing, and quality is non-negotiable: it is fixed by standards and safety requirements. The SECT-AIR project is addressing these cost and demand issues by focusing on automation in software engineering, with particular emphasis on model-based development. In this paper we provide an overview of the motivation behind the project, which started in 2016, and some of the key tasks it will carry out to help improve productivity, increase customer scope and maintain quality.

Context: The paper addresses the use of a Software Product Line approach in the context of developing software for a high-integrity, regulated domain such as civil aerospace. The success of a Software Product Line approach must be judged on whether useful products can be developed more effectively (lower cost, reduced schedule) than with traditional single-system approaches. When developing products for regulated domains, the usefulness of the product is critically dependent on the ability of the development process to provide approval evidence for scrutiny by the regulating authority. Objective: The objective of the work described is to propose a framework for arguing that a product instantiated using a Software Product Line approach can be approved and used within a regulated domain, such that the development cost of that product would be less than if it had been developed in isolation. Method: The paper identifies and surveys the issues relating the adoption of Software Product Lines as currently understood (including related technologies such as feature modelling, component-based development and model transformation) when applied to high-integrity software development. We develop an argument framework using Goal Structuring Notation to structure the claims made and the evidence required to support the approval of an instantiated product in such domains. Any unsubstantiated claims or missing/sub-standard evidence is identified, and we propose potential approaches or pose research questions to help address this. Results: The paper provides an argument framework supporting the use of a Software Product Line approach within a high-integrity regulated domain. It shows how lifecycle evidence can be collected, managed and used to credibly support a regulatory approval process, and provides a detailed example showing how claims regarding model transformation may be supported. Any attempt to use a Software Product Line approach in a regulated domain will need to provide evidence to support their approach in accordance with the argument outlined in the paper. Conclusion: Product Line practices may complicate the generation of convincing evidence for approval of instantiated products, but it is possible to define a credible Trusted Product Line approach.

Generative programming and model transformation techniques are becoming widely used for the development of software components for product lines. The ability to develop components with identified common and variable parts, and rapidly instantiate product-specific versions is key to many software product line approaches. However if this approach is to be truly cost effective for high assurance applications, the instantiation process must be property-preserving, any verification evidence acquired on the product-line component must be demonstrably applicable to the instantiated component. In this paper we outline an approach that uses static analysis techniques and the SPARK language that can potentially demonstrate the correctness of model transformations.

Academic and commercial approaches to software product line development have concentrated on the rapid instantiation of source code assets to minimise product time to market. Generative programming and model-based software engineering approaches have been suggested as effective ways of achieving this. However, for high-integrity software systems the instantiated product source code has to be accompanied by development process assets that demonstrate and support the product assurance arguments. This paper describes an approach to the model-based development of software product lines that is specifically designed to address the needs of high-integrity software systems. The approach consists of a reference architecture model and component-based development style, supported by model transformations to instantiate the project-specific components and associated development assets.

This paper presents a software engineering process that includes family-based aspects for aero-engine control software. The process uses a "family capability" derived from family analysis of the embedding system. This analysis allows reuse capability to be designed into the process by exploiting prior knowledge of the differences between members of an engine family. The process described follows the traditional software lifecycle. However, the nature of the stages is modified to incorporate the use of the family capability, essentially to allow systematic application of both compositional and generational reuse throughout the development process. The process described was evaluated on a trial project to develop, and subsequently modify, a thrust reverser system for a small aero-engine. Initial results show that this process can reduce effort for both initial and subsequent developments through the use of the family capability.