%! %-12345X@PJL JOB NAME="Microsoft Word - tr-00-13.doc" @PJL SET RET=ON @PJL SET DUPLEX=ON @PJL SET BINDING=LONGEDGE @PJL SET ECONOMODE=OFF @PJL SET OUTBIN=UPPER @PJL SET PAGEPROTECT=AUTO @PJL SET PAPER=A4 @PJL SET RESOLUTION=600 @PJL SET BITSPERPIXEL=2 @PJL ENTER LANGUAGE=PCLXL ) HP-PCL XL;2;0;Comment Copyright Hewlett-Packard Company 1989-1998. Version 4.0.0.0 XXAH(&%Ctdd*u)v??+wNpKzj yj cTBSh,{TimesNewRmn BdBuo|Lk%SOFTWARE VERIFICATION RESEARCH CENTRE%:Q?FfKJFJFJ*?*JKE)QKJF:FJKJQJEKEKFuLk SCHOOL OF INFORMATION TECHNOLOGY ;JPQPEQ?*K?QK`JF)QJEEKPKPEQPKӿ_LkTHE UNIVERSITY OF QUEENSLANDEQEKJ*JFJ:)FKQ?QKEEJ;EKKKLkQueensland 4072P;/.;)4::4545x0Lk Australia K:*$.55, LkTECHNICAL REPORTEFJQK)KJFKF?PKFv Lk No. 00-13 K545$45ӳLk1A Comparison of MIL-STD 882C and MIL-STD 882D for1HH3R82,'282"^'C!8CH222H288^'C!7CH222H"2,LkAustralian Defence AcquisitionH8'!,228H,",8,,H,88'!28iLkBrenton Atchison, Peter LindsayF/.;#5:K#/:*4:?/$/.E:;)55OLk April, 2000 K;.45458LkPhone: +61 7 3365 1003?;4;/$<45554544555phLkFax: +61 7 3365 1533?55$<455545445451D(%C1D(%Ctdd*u)v??+wNpKzj yj cTBSh,{TimesNewRmn BuoӒLkGProduced under contract CA38809 with the Australian Defence AcquisitionG/)*)%%*))*%%*)%%8;*****:))%<) %&)<&&)%%;%*)!*)ӒLk9Organisation, Directorate of Software Acquisition Reform.9<)%) %*)=%%*%%*.*;%%;%*) +)7&*?TimesNewRmn BdBuoӒmLkNote: <*%TimesNewRmn BuojmLk-Most SVRC technical reports are available via-J* .<77%&)*%%%** %%%)%%*%)%ӒLk6anonymous FTP, from svrc.it.uq.edu.au in the directory6%)**)@+) .4/*? )%)*%+)%)))%*%%*(Ӓ-Lk /pub/SVRC/ *)*.<87--Lk&techreports. Abstracts and compressed&%&)%** ;* %% %)*%+?*% %*ӒLk<postscript files are available via http://svrc.it.uq.edu.au.<**  %*% %%%)&%*%)%)* )%)*%*)%)1D(%C1D(%Ctdd*u)v??+wNpKzj yj cTBSh,{TimesNewRmn BuoLk1*TimesNewRmn BuoLk<A Comparison of MIL-STD 882C and MIL-STD 882D for Australian<ZS@`?7*#1???*o*L*FLZ?>?S7??o*L*FLZ?>?Z*>*Z?1"*7##7?TimesNewRmn Buo LkDefence AcquisitionT4'4;44T3:; . ! :;TimesNewRmn BuoӞLk"Brenton Atchison, Peter A. Lindsay"H$0666N06*66<00$OB66*23FLk9Software Verification Research Centre, School of Computer9<6%N0$0N0$%0066H0*00%06H06%0<06766%H7S660%Lk=Science and Electrical Engineering, University of Queensland,=<00600066B00$00B66610$66O660$* 46%N6006*067ӛ Lk Australia N6*$00ӂ Lkemail: {brenton, pal}@0S146$0666605c|  Lksvrc.uq.edu.au*7$06607606TimesNewRmn BdBuo~ LkAbstractH8'!,2,!TimesNewRmn BuoR/ LkQThis report compares the use of the system safety standard MIL-STD 882C with MIL-Q4) %**$*?*%% )%* %*)% !) &@ &%) &)*%* J2.4< ***7!:) J3R LkUSTD 882D for the use of Australian Defence Acquisition. It summarises the differencesU.4<*)*<*)%) %*<)!%%)<&&)%%;%*) *)!*A@% % )%*%&)%% R LkRbetween the standards and examines the implications of the transition from MIL-STDR*%:%&)#)%$ %)*%* #%)*#&)%@)& $)%$@*%%+) $*$)%$%* +)$+?$J3.4LkZdirection. In some cases, the developer may choose to limit liability by closely involvingZ.()..!.!$.F)!))$)$ .) .)-).-)!F)-!)...$)!.!F!)--!.-").#)-".-.-.-ӽLk/the U.S. Government in the procurement process./.)B3B.-).F)..-)..)-)F)..-))#$Symbol Bmo'RLk*Arial BuoQRLk lTimesNewRmn BuoӽRLkPThe system safety process developed around previous revisions of MIL-STD-882 areP9.(0$-$)F0$)(-0..()$$0-)-)..(.1)....1-)-..#1)-#.-$1.0R939C...1))ӽLkZexpected to be well known and accepted through industry, particularly Defence contractors.Z)..)()..-)B)-..B.)..())(.(.-..-..-.$--)).)-B)).)()..)).$TimesNewRmn Buoӽ+LkProject Offices are also 8!2,,%H!!-,'%,",%,'2%TimesNewRmn Buoӭ+Lk?expected to be familiar with safety programs. In fact, detailed?)..)))-#.".)$)F($B.$$((-$..-)F$$.$))$.()).ӽLkOtasks of MIL-STD-882C not included in MIL-STD 882D can now be found in modifiedO)$-$#."R939C...=#..#-).-).#.#R939B#...B#)).#-.B#.)"....".#F..).ӽLk-form in the US Defense Acquisition Deskbook [-.F.-)B3B)).$)A)..$-.B)$-...-ӧ Lk5. Lk].Symbol Bmo'Lk*Arial BuoQLk lTimesNewRmn BuoӽLkWThe U.S. Department of Defence has an extensive safety regulatory process and technicalW9.(B3B).(F).-B)).)).)$).)-)-$-)$((-)-.).-..()$$)..))-.))ӽLkYreview boards, and provides a valuable source of guidance for determining suitable systemY)-)B..(.$)..-.-.)#)-).(.)$.-))--..)-))..))F..-$-(.)$-#)Fӽ~Lksafety programs.$)(-..-)F$Ӫ!LkYDue to these factors, the short-term use of MIL-STD-882D is not expected to change the USYB.)(.'.)#)()).#(-))$.-)F).$)).(R939C...B)$)..()..()).)-)).(.-)).))B3ӪLk^Defence acquisition process significantly. However, changes in the long term are expected when^B)).() )(..$.- .-))$# #-.))-- B.B)-) ).(.-)$ . .) ..-!(F!))!).-)().!B.(.ӪLk5safety programs begin to vary from accepted practice.5$)(-..-)F$.)-..-)-.F)))).)..)(()TimesNewRmn BdBuoӑLk52Arial BdBuoLk TimesNewRmn BdBuoELk&Acquisition of Non-Development Systems&H,88'!281"H28!H,2,28S,8!82'!-R'TimesNewRmn BuoӑLkYThe introduction of MIL-STD-882D also has implications for Australian acquisition of Non-Y9.(0--..(.-0./R939C...B0)$.0.($0F.()..$/-1B.$().1)(..$.-1.1B-.ӑLkeDevelopment systems, particularly U.S. systems. In this instance, the close level of interaction witheB)-)..F).$-$)F$.)(.(-B3$-$)F$..$.$).)(-)(.$))-)..)()..A.ӑcLk[Contractors expected by MIL-STD-882D cannot be relied upon, particularly for acquisition of[=..()-$*)..()(.+.-+R939C...B+))...+.)*((.,..-.,.()-)-,.+)).-#..,-ӑLk_existing systems. Given the greater freedom in the safety approach, DAO also cannot assume that_).#.-$-$)F$B-)..)-)()))..F..)#)(-)..-)).BBB($.))..-($$.F).(ӑ6Lkause of the standard has produced a suitably rigorous safety program. Instead, assurance of safetya.$)!-!-)!#)..(.!-)$!-..-)).")!$.)--"-..-$"$((-"..-)F#.$))."($$-).))!."$()-ӑLkawill need to be assessed through documentation. Significant effort may be required to review suchaB.))..-))#$)#$)..-.-...).F).(..3-.().).F)-.))..)..)-)B$-).1D(%Ctdd*u)v??+wNpKzj yj cTBSh,{TimesNewRmn BuoӥLk4*TimesNewRmn Buoӥ LkCdocumentation or produce it in instances where it is not available.C..).F).)..--...().-$).)($B.()$.-)-))-)ӥLkfIn some cases, it may be possible to liase with other certification agents where pre-certified systemsf.$/F)))$)$F)-.)..$$.(.)$)A-.-))))(..)-).$B.)(.)))(.$-$)F$ӥLkYare acquired with limited modifications. However, care should be taken to ensure that anyY))4().-(.4B.4F).4F..)(..$5B.B)-)4)))5$-...4.)4)-).5.4).$-)4.(5).-ӥLk'assumptions on the operational use and ')$$.F..-$...)-.))..(.#))-.[Lkenvironment are not violated.).--.F).))-.--().TimesNewRmn BdBuoӥsLk62Arial BdBuosLk TimesNewRmn BdBuoYsLkConclusions and RecommendationsH28,8'28'278H,,2RS-882!28'TimesNewRmn BuoӥLkSThe revision of MIL-STD-882C to MIL-STD-882D applies the principles of U.S. DefenceS9.(7)-#..7-7R939B...=8.8R939B...B8)..)$7.(8..(.)$8-8B38B)).()ӥLk[acquisition reform to system safety programs by reducing standard requirements to a minimal[))..$..+)-F+.+$-$)F+$)(-+..-)F$+.-,)..).-,$)..(.,).-)F).#,.,(,F.F)ӥLk`number. This presents much greater freedom to the Contractor and Project Office to implement the`..F.)9-$-)#)-$F.).-))(()..F..)<..)(.)..2-)(B().F.)F)..(ӥ[Lk0safety program in accordance with project needs.0$)(-..-)F.))(.-).))A..-)(-)).$ӥLk[However, the freedom offered by MIL-STD-882D is accompanied by a greater responsibility for[B.B)-)!.)!))..F".().!.-"R939C...B"$"))(.F.).).".-")"-)((")$..-$--"-ӥhLk`each project to define and execute a suitable safety program. It is not sufficient to invoke the`))).)--)()-).).())..().)(.)())$-).))$((-)..-)F*)$)..)$.)).(.(.-.-)*.)ӥLk^standard and assume that an adequate safety program will be followed. Instead, the Project and^$).-)-%)..$)$$.F)%.(%)-%).(..()%#)(-%..-)F%B%-)%-.B).&.$)).%.(&3-)(&)-.ӥ; Lk`Contractor must take an active role to define an approach to safety engineering and ensure it is`=..()-$F.$$)-)$).$)(-)#.)$.#.).)#).$)-.-)).$.%$((-%).-.)).-%)..%(.$-)%$$ӥ Lk\implemented. Defining a suitable safety program is a significant challenge since recommended\F.)F).).)B)..-)))$.)-))#))-)..-)F)$)))#-.)(.().((.-)*$.()*)).GF)..).ӥ Lkpractice for safety programs .)()).$))-..-)F$ LkHvaries substantially, particularly for software-intensive systems. To beH-))$$..#)-)-.))-(--$-A)).)-$-)$-$)F$9..(ӥw Lk?successful, access to specialist skills and knowledge is vital.?$.))($#.))()$$.#.)()#$-#)..-..B(.-)$-)ӥ LkZThe approach taken by MIL-STD-882D relies on an associated Defence acquisition environmentZ9.(").-.)(.#)-).#.-#R939C...B#))$#-.#).")$$-))(.#B)).))")).-#..#(.-..F).ӥ Lkithat may not transfer to Australian conditions. In particular, it assumes that acquisition is carried outi.(F)-..)-$(.B.#().)-..-.$..))-(($$.F)$.(().-$..$)()...ӥ Lk`with threat of litigation under U.S. Civil Law and that best practice will be maintained through`B.$.))$.$-)..%-..(%B3%=-%7)B%)..$.(%.($%-()))%A&.)&F)-)-).%.-.-.ӥW Lk]industry and government culture and regulatory oversight. Without such a suitable acquisition]...#-,)..,-.-).F).,)--),(..,)-.)--,.-)$-.+W...-$-).-),$.)-)-().-$..ӥ Lkbenvironment, the use of MIL-STD-882D increases the risk that a deficient or over-protective safetyb).-..F)..).#).R939C...B.)()$($-)$-.().)()-..-)..)(-)$((-ӥ* Lk]program will be implemented. Furthermore, the lack of detailed guidance may lead to increased]..-)F$B$.($F.)F).).$3--)F.)#.)#))-$.$-))).$-..(.))$F)-%)).%.%-)))#).ӥ LkXcosts when implementing the program, disputes with Commonwealth or certification delays.X).$$B.).F.)F)..-.)-.-)F.$.-)$A.=.FF..B)).-)()(...()-$ӥ6Lk\Accordingly, we do not recommend the use of MIL-STD-882D unless adequate controls are put in\B)).-.--B)....().GF)...).#).R939C...B..)$$).)-.))).-.#)).-.ӥLk9place. Such controls would include at least the following9.)()3.)-).--$B.-..(..)))($.(-.A.- Lk::;CLk1..Arial BuoӀCLk QTimesNewRmn BuoCLkPFor development systems the approach should be documented and agreed in a SystemP3.*.)-)-.F).*$-$)F$*.)*(..-)).)$..-.*.))..).F).).))..))-)).*.+)+3-$)FLkQSafety Management Plan (SSMP) prior to contract. Comparison with other approachesQ3)(-+R).)-)F).+3)-+33Q3+--+.+).-)(+=.F.)$-.+B.,..)+).-.))-)$LkVrecommended by other international standards may be useful in determining the adequacyV)).FF)..)..-..).).(..(#).-)-$F)-.).$)..-))F..-.)).)-.))-LkRof defined processes. Where development of SSMP is a significant undertaking, pre-R.0.(-).0-.)($$($0W-)(0.)-)..F).0-033R30$0)1#-.))-1..-))-.-1.)Lkcontract funding to preferred )..)(....-..((). Lktenderer(s) may be required.)..((#F)-.))..).;Lk2..Arial BuoӀLk QTimesNewRmn BuoLkRFor development systems, the Commonwealth should take an active role in the safetyR3.+.)-)-.F).+$-$)F$+.)+=.FF..B)).,$..-.+)-),).+))-),-)+.,-),#))-LkQmanagement process, as recommended by MIL-STD-882D. Where necessary, training andQF).)-*F)...))#$($().GF)..)..-R939B...BW.)).())#$)-(..-)..aLk?support services should be sought to obtain suitable expertise.?$....#)-)($$-....)#..-....).$.)-))..($);Lk3..Arial BuoӀLk QTimesNewRmn BuoLkWFor development systems, the results of the system safety program should be documented.W3..)-)-.F).$-$)F$.))#.$--)$-$)F$))-..-)F$.....).-).F).).nLkWProgram results should be assessed by a Third Party suitably qualified to determine theW3.-)F%)$.$%#....%.)%)$#)$$(.&.-&)%9..&3(-&$-(.-&..))-&.&-))F.)&.)Lk[adequacy of the safety program and validity of results. If possible, the assessor should be[).)..()-.-)$((-..-)F)..-).-.)$-$  ..$$-).( )$#)$#. #..-. .)ALkFengaged throughout the project to provide feedback in a timely manner.F).-)-)....-....(..((...-.))).-))-.)F)-F)..)LkTFor non-development systems, documentation justifying acceptable risk should also beT3.,....)-)..F).,$-$)F$,..).F).)..+.#-.--))))-)-),$--$...--)$.-.)NLkWmade available and assessed prior to system acquisition. The assessment should validateWF).)$)-)).)$).-$)$#)$#).$--$.$$-$)F$)).-$..#9.($)$#)$$F).#$..-.%-)-))LkQthat any assumptions made in the operational use or environment of the system areQ.(1).-2)$$.F...$2F).)2.1.(2..().-)2-$)2-2).-..F).2.1.)1$-$)F2)) Lk$maintained in the target conditions.$F).)-).--)(-)(.....$1D(%Ctdd*u)v??+wNpKzj yj cTBSh,{TimesNewRmn BuoLk5*TimesNewRmn BdBuoӑLk72Arial BdBuoLk TimesNewRmn BdBuoELkAcknowledgementsH,882I,82,R,8!'TimesNewRmn BuoӑLk`The authors gratefully acknowledge the Australian Department of Defence, Directorate of Software`9.()-..$-))--))-..B).-).)B.#)).B(.)F)..B()-))B().()-3.B))ӑ Lk6Acquisition Reform for sponsorship of this report and 6B)..#..=(-F.$..-$.$.-..$)..(..ӎ Lk'Axel Wabenhorst, Chris Edwards and Tony'B.(W(.)..-#=.$7.B)-$)..8..-ӑsLk7Cant for comments on previous revisions of this report.7=)..(.GF).$...)-..$)-#..$-.$(..TimesNewRmn BdBuoӑKLk82Arial BdBuoKLk TimesNewRmn BdBuoEKLk References H,",,,8,,'TimesNewRmn Buo}Lk1,Arial BuoөLk TimesNewRmn Buo/LkBAustralian Department of Defence Contract CA38809, Specifying and BB.$)).B)-)F)..B()-))=.-))=B.-...3-))-.-)..\LkAcquiring Safety-B).-.-3)(./?Lk(Critical Software Systems, January 1999.(=()3-B()3-$)F$%(..(-....} Lk2,Arial Buoө Lk TimesNewRmn Buo/ LkU@o Lk.ӄ LkS1ӵ Lk. Lk Department of Defense. @',&D',+@&'+"'5 LkMIL-STD-882C, P617@,,,;ӝ Lk#System Safety Program Requirements,#1+"'D1''+0,+'D;',,'D',"/uLk January 1996. "',+'+,,+,}CLk3,Arial BuoөCLk TimesNewRmn Buo/CLkU@oCLk.ӄCLkS1ӵCLk.CLk Department of Defense. @',&D',+@&'+"'5CLkDraft MIL-STD-882D, ?&P717@,,,@n CLkSystem Safety, 1+"'D1'&+ӌ CLk April 1999. @,+,,,} Lk4,Arial Buoө Lk TimesNewRmn Buo/ LkPU.S. Department of Defense. DoD 5000.2-R, Mandatory Procedures for Major DefenseP@1@',&D',+@&'+"'@,@,,,+,;P',+'++1+''+,'",O&+@&&,"&/z Lk=Acquisition Programs and Major Automated Information Systems.=@',,",,0,+'D"'+,P&+@+,D'&,,,D',,1+"'D"}G Lk5,Arial BuoөG Lk TimesNewRmn Buo/G Lk9U.S. Department of Defense. Defense Acquisition Deskbook.9@1@',&D',+@&'+"'?'',!'@'+,",,@&"+,,,+1DIB%-12345X@PJL EOJ NAME="Microsoft Word - tr-00-13.doc" %-12345X