Horizontal Dependencies. The horizontal interfaces are addressed in ConSerts [18] [19] [20]. ConSerts stands for Conditional Safety Certificates. The approach utilizes modular conditional certificates and operates between horizontal interfaces of systems. ConSerts are post-certification artifacts (i.e., certification has been conducted in the traditional way) equipped with variations points bound to formalized external dependencies that are meant to be resolved at runtime. This characteristic is what makes the certificates “conditional” and provides the flexibility in the certificates that is required to be useful for a sufficiently wide range of concrete integration scenarios. The conditional certificates must also be modular in order to conduct the certification process at the level of the units composing the targeted systems of systems. The conditional certificates are to be evaluated automatically and autonomously by the system at the moment of integration at runtime, based on runtime representations of the certificates of the involved compositional units. Once all conditions have been resolved and the evaluation is finished, an overall certificate variant can be determined for the actual composition that has been formed. In a sense, the final certification step has thereby been postponed to runtime and we can thus speak of “runtime certification”. Whenever the overall system composition changes or the system adapts itself, a re-evaluation of the conditional certificates must be conducted and the overall certificate for the composition must be updated. Such a re-evaluation might well be triggered by a minor dynamic adaptation in one of the subsystems or even an update, which, however, can easily trigger a chain reaction in related components leading to complex reconfiguration sequences. Therefore, there is a strong interdependency between dynamic adaptations and the dynamic evaluations of the conditional certificates. An adaptation might lead to an invalidation of the current certificate and thus to a re-evaluation and the determination of a new certificate. This might then violate given top-level trust requirements, which might again trigger additional adaptations in order to regain sufficient trust guarantees (e.g., via graceful degradation, which could imply a loss of application features).
