11

Formal Verification of Formal Verification of Embedded Real-Time Embedded Real-Time

Software in Component-Software in Component-Based Application Based Application

FrameworksFrameworksPao-Ann Hsiung*, Win-Bin See, Trong-Yen Lee,Pao-Ann Hsiung*, Win-Bin See, Trong-Yen Lee,

Jih-Ming Fu, and Sao-Jie ChenJih-Ming Fu, and Sao-Jie Chen*National Chung Cheng University*National Chung Cheng University

Chiayi-621, Taiwan.Chiayi-621, Taiwan.

Asia-Pacific Software Engineering Conference, December 2001, Macau

22

OutlineOutline

Why Verification of Software?Why Verification of Software?What Issues?What Issues?Previous WorkPrevious WorkFormal Object-Oriented ModelFormal Object-Oriented ModelFormal Synthesis & Model CheckingFormal Synthesis & Model CheckingApplication ExampleApplication ExampleConclusions & Future WorkConclusions & Future Work

33

Why Verification of Software?Why Verification of Software?Software accounts for almost Software accounts for almost 80%80% of total of total

system functions!system functions!ExamplesExamples of real-time embedded of real-time embedded

systems: systems: home appliances, telecommunication home appliances, telecommunication devices, transportation facilities, ...devices, transportation facilities, ...

FlexibilityFlexibility COMPLEXITYCOMPLEXITY!!More complexMore complex than hardware! than hardware!Simple Simple glitches glitches system system FAILURE FAILURE!!

44

What Issues?What Issues?

Component-Based Object-Oriented AppliComponent-Based Object-Oriented Application Framework (COAF)cation Framework (COAF)

Formal Verification (FV)Formal Verification (FV)How to integrate FV into COAF???How to integrate FV into COAF???

System System ModelModel??Design Design MethodologyMethodology v/s Verification v/s Verification FramewFramew

orkorkGoals: Goals: SeamlessSeamless + + ScalableScalable Integration!!! Integration!!!

55

System Model?System Model?COAF View: Set of interacting objectsCOAF View: Set of interacting objects

FV View: Network of concurrent tasksFV View: Network of concurrent tasks

D

A

B

C

Complex Behaviors

!!!

………

………

………

………

………

Formal Syntax + Precise

Semantics

66

Design v/s Verification?Design v/s Verification? COAF: Design MethodologyCOAF: Design Methodology

FV: Verification FrameworkFV: Verification Framework

for x = 1…8 {

…………… …

while(1) { … }

}components

software

automata

Error Trace:….….….

analysis results

77

Previous WorkPrevious WorkCOAFsCOAFs for designing real-time embedded sof for designing real-time embedded sof

tware applications: tware applications: OORTSF, SESAG, VERTAF [RTAS’01]OORTSF, SESAG, VERTAF [RTAS’01]

Formal SynthesisFormal Synthesis: : Quasi-Static Scheduling of Free-Choice Petri netQuasi-Static Scheduling of Free-Choice Petri net

ssSynthesis of Codesign FSMSynthesis of Codesign FSM

Formal VerificationFormal Verification::When, Where, How to verify embedded sw?When, Where, How to verify embedded sw?Hybrid automata-based coverificationHybrid automata-based coverification

88

Formal Object-Oriented ModelFormal Object-Oriented Model

Compromise between OO and formal Compromise between OO and formal modelsmodels

For Task Specification:For Task Specification:Autonomous Timed ObjectAutonomous Timed Object (ATO) (ATO)

For Modeling Behavior:For Modeling Behavior:Autonomous Timed ProcessAutonomous Timed Process (ATP) (ATP)ATOs

ATPs

99

Autonomous Timed Object Autonomous Timed Object (ATO)(ATO)

ATO = PBO + TMOATO = PBO + TMOPBO = PBO = Port-Based ObjectPort-Based Object [IEEE-TSE’97] [IEEE-TSE’97]TMO = TMO = Time-triggered Message-triggered Time-triggered Message-triggered

ObjectObject [IEEE-Computer’00] [IEEE-Computer’00]Generic structure for embedded systemsGeneric structure for embedded systemsModels:Models:

PeriodicPeriodic Task TaskAperiodicAperiodic Task Task

1010

ATO Generic StructureATO Generic Structure

ATO Name

Event-Triggered Methods

Time-Triggered Methods

In Ports Out Ports

Resource Ports

Configuration Ports

1111

Autonomous Timed Process Autonomous Timed Process (ATP)(ATP)

1 or more ATP associated with 1 ATO1 or more ATP associated with 1 ATOCreate ATP on ATO declarationCreate ATP on ATO declarationUpdateUpdate system state system state2 types of interrupts:2 types of interrupts:

EventEvent: aperiodic task, ETM: aperiodic task, ETMTimerTimer: periodic task, TTM: periodic task, TTM

After method exec, After method exec, check violationcheck violation If violated, Error state, handle error, resetIf violated, Error state, handle error, reset

1212

ATP State DiagramATP State Diagram

Created

ATO Declaration

Instantiated

Configuration

Status Update

Updated

Periodic Task Activated

Timer Interrupt

Aperiodic Task

Activated

Event Interrupt

Event-Triggered Method

Execution

Time-Triggered Method

Execution

Error Terminated

Constraint Checking

Constraint Violated Kill Signal

Reset Kill Signal

1313

Event & Process Tables, Call Event & Process Tables, Call GraphGraph

Event TableEvent Table: record all inter ATP events: record all inter ATP events Call GraphCall Graph: event relationships: event relationships Process TableProcess Table: record all ATPs and related info: record all ATPs and related info

rmationrmation Purposes:Purposes:

resource allocation,resource allocation, conflict resolution,conflict resolution, schedulability analysis, andschedulability analysis, and verification.verification.

1414

Formal Synthesis & Model Formal Synthesis & Model CheckingChecking

What is What is formal synthesisformal synthesis??A formally modeled system is synthesized A formally modeled system is synthesized to satisfy a given logic specification.to satisfy a given logic specification.Eg: TFCPN / TRSEg: TFCPN / TRS

What is What is model checkingmodel checking??A formally modeled system is checked for A formally modeled system is checked for satisfaction of a given logic specification.satisfaction of a given logic specification.Eg: TA / TCTLEg: TA / TCTL

1515

Target ProblemTarget Problem

COAF-FV Technology IntegrationCOAF-FV Technology Integration

Given an embedded real-time system Given an embedded real-time system described in a Component-Based described in a Component-Based Object-Oriented Application Framework Object-Oriented Application Framework ((COAFCOAF) using the Formal Object-) using the Formal Object-Oriented Model (Oriented Model (FOOMFOOM) along with a set ) along with a set of temporal constraints, the of temporal constraints, the generated generated software code is to besoftware code is to be formally verified formally verified to satisfy all given constraintsto satisfy all given constraints..

1616

Timed Automaton (TA)Timed Automaton (TA)

x ≤ 3

y ≤ 7

x=0 y=0

x = 3

y 7

x:=0 y:=0

y := 0

M0

M1 M2

M3

invariant conditio

n

triggering

condition

initial conditio

n

clock resets

state

transition

1717

Timed Computation Tree Logic Timed Computation Tree Logic (TCTL)(TCTL)

A logic for specification of A logic for specification of propertiesproperties of of embedded real-time systemsembedded real-time systems

Syntax:Syntax: ::= ::= | | □□ ' | ' | 'U'U~c~c | | ' | ' | ' '

Reachability propertiesReachability propertiesLiveness propertiesLiveness propertiesTemporal propertiesTemporal properties

1818

Compositional VerificationCompositional Verification

Compositionally_Verify(ATP_Set, Constraints) {Compositionally_Verify(ATP_Set, Constraints) { = = Gen_TCTLGen_TCTL(Constraints);(Constraints);ATA_Set = ATA_Set = Gen_TAGen_TA(ATP_Set);(ATP_Set);STA_Set = STA_Set = ScheduleSchedule(ATA_Set, SchedAlg);(ATA_Set, SchedAlg);while (|STA_Set|>1) {while (|STA_Set|>1) {

MROFMROF(STA_Set);(STA_Set); // merging// mergingrr = = FBRSFBRS(STA_Set);(STA_Set); // reduction sequen// reduction sequen

ceceReduceReduce(STA_Set, (STA_Set, rr); }); }

if (if (Model_CheckModel_Check(STA_Set, (STA_Set, ) return Verified;) return Verified;else return Constraints_Violated;else return Constraints_Violated;

}}

1919

Compositional VerificationCompositional Verification

………

Constraints

Autonomous Timed

Process

Timed Automato

n

Scheduled Timed

Automaton

Merged Timed

Automaton

Reduced Timed

Automaton

TCTL

formula

Model Checking(S ┝ ?)

S

Verified OK!or

CounterEx

2020

Merge Related Objects First Merge Related Objects First (MROF)(MROF)

Hierarchical Merge StrategyHierarchical Merge StrategySame FamilySame Family: (Syntax): (Syntax)

Merge all TA representing the same ATO.Merge all TA representing the same ATO.Near RelativesNear Relatives: (Semantics): (Semantics)

(A(Aii, A, Ajj) = ) = #Shared_Vars(A#Shared_Vars(Aii, A, Ajj) + ) + #Channels(A#Channels(Aii, A, Ajj))

Highest proximity Highest proximity merge first! merge first!

2121

Find Best Reduction Sequence Find Best Reduction Sequence (FBRS)(FBRS)

State-Graph Manipulators (SGM) Tool:State-Graph Manipulators (SGM) Tool:http://www.cs.ccu.edu.tw/~pahsiung/sgm/http://www.cs.ccu.edu.tw/~pahsiung/sgm/

Four reduction techniques Four reduction techniques (manipulators):(manipulators):Symmetry ReductionSymmetry ReductionClock ShieldingClock ShieldingRead-Write ReductionRead-Write ReductionInternal Transition BypassInternal Transition Bypass

Experiment with different sequencesExperiment with different sequences

2222

Find Best Reduction Sequence Find Best Reduction Sequence (FBRS)(FBRS)

No clock variables No clock variables skip clock skip clock shieldingshielding

No discrete variables No discrete variables skip read-write skip read-write reductionreduction

Perform symmetry reduction after Perform symmetry reduction after read-write reductionread-write reduction

Perform internal transition bypass Perform internal transition bypass after read-write and clock shieldingafter read-write and clock shielding

Permute reduction sequence to decide Permute reduction sequence to decide symmetry reduction ordersymmetry reduction order

2323

Application ExampleApplication Example

Autonomous Intelligent Cruise ControllerAutonomous Intelligent Cruise Controller (AICC), Saab automobile [Hansson 1996].(AICC), Saab automobile [Hansson 1996].

Receive info from road signs (speed limit) Receive info from road signs (speed limit) adapt speedadapt speed

Slow front vehicleSlow front vehicle maintain safe distancemaintain safe distance

Receive info from traffic lights Receive info from traffic lights avoid stop and goavoid stop and go

2424

AICC Example: System AICC Example: System ArchitectureArchitecture

ElectronicServo Throttle

(SW)

EBS Gateway(HW/SW)

DS Gateway(HW/SW)

SRC Gateway(SW)

SRC MMI(SW)

System ControlUnit (HW)

Main InstrumentController(HW/SW)

ElectronicBrake System

DistanceSensor

Short RangeCommunication

TransponderDisplay

Throttle speed brake

RS232 RS232

Cruise ControlSwitches

Controller Area Network (CAN)-bus

RS232

2525

AICC Example: FOOM ModelAICC Example: FOOM Model

Traffic

Light Info

(SRC)

Speed

Limit Info

(SRC)

SRC

T=200ms

Preceding Vehicle

Estimator

(Distance Sensor)

Speed

Sensor

(EBC)

Distance

Control

Greenwave

Control

Speed Limit

ControlICC Regulator

T=100ms

CruiseSwitches

(MainInstrumentController)

ICC

Main

Control

Coordination &

Final Control

CruiseInfo(Main

InstrumentController)

SpeedActuator

(EST)

T=100msSupervisor

Final ControlEST

T=50ms

• 5 ATO,

• 12 functions (11 software, 1 hardware) 11 ATP,

Call Graph

2626

AICC Example: Process TableAICC Example: Process TableIndex ATP ATO

Period (ms)

Execution Time (ms)

Deadline

1 Traffic Light Info SRC 200 10 400

2 Speed Limit Info SRC 200 10 400

3 Proceeding Vehicle Estimator ICCReg 100 8 100

4 Speed Sensor ICCReg 100 5 100

5 Distance Control ICCReg 100 15 100

6 Green Wave Control ICCReg 100 15 100

7 Speed Limit Control ICCReg 100 15 100

8 Coordination & Final Control(HARDWARE)

Final_Control 50 20 50

9 Cruise Switches Supervisor 100 15 100

10 ICC Main Control Supervisor 100 20 100

11 Cruise Info Supervisor 100 20 100

12 Speed Actuator EST 50 5 50

2727

AICC Example: ExperimentsAICC Example: Experiments

Sun UltraSPARC II 450 MHz (1 CPU)Sun UltraSPARC II 450 MHz (1 CPU)1 GB physical RAM1 GB physical RAMModel Versions:Model Versions:

FullFull: 11 TA: 11 TASimpleSimple: 6 TA: 6 TA

Communication Models:Communication Models:Shared MemoryShared MemoryMessage PassingMessage Passing

2828

AICC Example: ResultsAICC Example: Results## nn CC SeqSeq #M#M #T#T TimeTime

(sec)(sec)MeMemm

(MB)(MB)11 11

11SMSM

<mg1><mg1>>125>125

KK>1869>1869

KKN/AN/A O/MO/M

22 1111

SMSM<mg1, rw, sc, sm><mg1, rw, sc, sm> 270270 1,1381,138 50,2150,21

336262

33 66 MPMP<mg1><mg1>

19,7719,7766

26,67726,677 1,3911,391 211211

44 66 MPMP <mg2><mg2> 19,77619,776 26,67726,677 234234 7777

55 66 MPMP <mg1, rw, sc, sm><mg1, rw, sc, sm> 141141 320320 873873 1919

66 66 SMSM <mg1><mg1> 7,9127,912 16,55716,557 303303 5252

77 66 SMSM <mg1, rw, sc, bit, sm><mg1, rw, sc, bit, sm> 101101 290290 183183 66

88 66 SMSM <mg1, rw, sm, sc, bit><mg1, rw, sm, sc, bit> 7171 180180 193193 66

mg1: sequential merge, mg2: near-relatives merge

2929

AICC Example: ObservationsAICC Example: Observations

Near-relativesNear-relatives merge better than sequenti merge better than sequential merge (time, memory)al merge (time, memory)

SMSM better than MP (broadcast expensive) better than MP (broadcast expensive)11 TA, no reduction 11 TA, no reduction Out of memoryOut of memory! (Ex! (Ex

ponentially large state-space)ponentially large state-space)ReductionsReductions give smaller state-spaces give smaller state-spacesBest sequence: Best sequence: <mg1, rw, sm, sc, bit><mg1, rw, sm, sc, bit> (#m (#m

odes, #transitions)odes, #transitions)

3030

ConclusionsConclusions

Technology integrationTechnology integration: : Component-Based OO Application FrameworkComponent-Based OO Application FrameworkFormal VerificationFormal Verification

Common system model: Common system model: FOOMFOOM (ATO/ATP) (ATO/ATP)Proposed scheme implemented in Proposed scheme implemented in VERTAFVERTAF

A separate Verifier componentA separate Verifier component

Autonomous Intelligent Cruise ControllerAutonomous Intelligent Cruise Controller

3131

Future WorkFuture Work

Use Use design patternsdesign patterns to develop new to develop new state-space reduction techniquesstate-space reduction techniques

APIAPI for users to develop new state- for users to develop new state-space reduction techniquesspace reduction techniques

UML UML FOOMFOOM Integration of software Integration of software synthesissynthesis and and

verificationverification based on based on Petri NetsPetri Nets