Don’t Retest Everything: Auditable Regression Scoping for Safety-Critical Systems

Abstract

In safety-critical software development, changes often span technical and organisational boundaries, e.g., repositories, interfaces, libraries, and teams. Under certification and traceability requirements, these changes create a difficult regression-testing problem: organisations must determine what must be revalidated and provide an auditable justification for those decisions. In practice, the resulting uncertainty often drives overly conservative strategies, where large portions of the system are retested after changes or updates, even when a narrower scope would suffice. In this paper, we present CoCoS, an automated regression-testing approach for safety-critical systems written in C and developed under traceability and certification constraints. Developed end-to-end with Thales Alenia Space Italia, a large international aerospace company, and grounded in avionics practice, CoCoS addresses real certification-driven needs rather than an abstract setting. It combines semantic differencing, abstract syntax tree analysis, and function-level call-graph propagation to identify semantically relevant changes across repository and component boundaries, and to derive conservative regression scopes with human-readable justifications. CoCoS prioritizes conservativeness, explainability, and auditability, thereby supporting defensible regression-scoping decisions in regulated workflows. We evaluate CoCoS in an industrial setting with Thales Alenia Space Italia, using a realistic multi-repository aerospace software environment involving application code and external libraries. The results show that CoCoS supports the conservative bounding of regression scopes while preserving compliance-oriented reasoning and providing practical evidence for test planning in safety-critical environments.