Automatic Verification of Embedded Control Software with ASTRÉE and beyond Patrick Cousot State of Practice Jerome C. Hunsaker Visiting Professor Department of Aeronautics and Astronautics, MIT c o u s o t mi t e d u w w w . mi t . e d u / ~ c o u s o t École normale supérieure, Paris c o u s o t e n s f r w w w . d i . e n s . f r / ~ c o u s o t Workshop on Critical Research Areas in Aerospace Software Aero. Astro. Dept., MIT, August 9 th , 2005 August 9 th , 2005 Critical Research Areas in Aerospace Software, MIT — 2 — ľ P. Cousot The software challenge for next 10 years An example among many others (Matlab code) » h=get(gca,’children’); - Present-day software engineering is almost exclusively - - apple.awt.EventQueueExceptionHandler Caught Throwable : java.lang.ArrayIndexOutOfBoundsException: 2 >= 2 java.lang.ArrayIndexOutOfBoundsException: 2 >= 2 manual, with very few automated tools; at java.util.Vector.elementAt(Vector.java:431) at com.mathworks.mde.help.IndexItem.getFilename(IndexItem.java:100) at com.mathworks.mde.help.Index.getFilenameForLocation(Index.java:706) - Trust and confidence in specifications and software can - - at com.mathworks.mde.help.Index.access$3100(Index.java:29) at com.mathworks.mde.help.Index$IndexMouseMotionAdapter.mouseMoved(Index.java:768) at java.awt.AWTEventMulticaster.mouseMoved(AWTEventMulticaster.java:272) no longer be entirely based on the development process at java.awt.AWTEventMulticaster.mouseMoved(AWTEventMulticaster.java:271) at java.awt.Component.processMouseMotionEvent(Component.java:5211) (e.g. DO178B); at javax.swing.JComponent.processMouseMotionEvent(JComponent.java:2779) at com.mathworks.mwswing.MJTable.processMouseMotionEvent(MJTable.java:725) at java.awt.Component.processEvent(Component.java:4967) - In complement, quality assurance must be ensured by - - at java.awt.Container.processEvent(Container.java:1613) at java.awt.Component.dispatchEventImpl(Component.java:3681) at java.awt.Container.dispatchEventImpl(Container.java:1671) new design, modeling, checking, verification and certi- at java.awt.Component.dispatchEvent(Component.java:3543) at java.awt.LightweightDispatcher.retargetMouseEvent(Container.java:3527) at java.awt.LightweightDispatcher.processMouseEvent(Container.java:3255) fication tools based on the product itself. at java.awt.LightweightDispatcher.dispatchEvent(Container.java:3172) at java.awt.Container.dispatchEventImpl(Container.java:1657) at java.awt.Window.dispatchEventImpl(Window.java:1606) at java.awt.Component.dispatchEvent(Component.java:3543) at java.awt.EventQueue.dispatchEvent(EventQueue.java:456) at java.awt.EventDispatchThread.pumpOneEventForHierarchy(EventDispatchThread.java:234) at java.awt.EventDispatchThread.pumpEventsForHierarchy(EventDispatchThread.java:184) at java.awt.EventDispatchThread.pumpEvents(EventDispatchThread.java:178) at java.awt.EventDispatchThread.pumpEvents(EventDispatchThread.java:170) at java.awt.EventDispatchThread.run(EventDispatchThread.java:100) » August 9 th , 2005 August 9 th , 2005 Critical Research Areas in Aerospace Software, MIT — 3 — ľ P. Cousot Critical Research Areas in Aerospace Software, MIT — 4 — ľ P. Cousot
Static analysis tools - Determine automatically from the program text pro- - - gram properties of a certain class that do hold at run- State of the Art in Automatic time (e.g. absence of runtime error); - Based on the automatic computation of machine repre- - - Static Program Analysis sentable abstractions 1 of all possible executions of the program in any possible environment; - Scales up to hundreds of thousands lines; - - - Undecidable whence false alarms are possible 2 - - 1 sound but (in general) uncomplete approximations. 2 cases when a question on the program runtime behavior cannot be answered automatically for sure August 9 th , 2005 August 9 th , 2005 Critical Research Areas in Aerospace Software, MIT — 5 — ľ P. Cousot Critical Research Areas in Aerospace Software, MIT — 6 — ľ P. Cousot Degree of specialization The ASTRÉE static analyzer - Specialization for a class of runtime properties (e.g. ab- - - - ASTRÉE is a static program analyzer aiming at proving - - sence of runtime errors) the absence of Run Time Errors (started Nov. 2001) - Specialization for a programming language (e.g. PolySpace - - - C programs, no dynamic memory allocation and recur- - - Suite for Ada, C or C++) sion - Specialization for a programming style (e.g. C Global - - - Encompass many (automatically generated) synchro- - - Surveyor) nous, time-triggered, real-time, safety critical, embed- - Specialization for an application type (e.g. ASTRÉE for - - ded software embedded real-time synchronous 3 autocodes) - automotive, energy and aerospace applications - - The more specialized, the less false alarms 4 ! ) e.g. No false alarm on the electric flight control codes ) for the A340 (Nov. 2003) and A380 (Nov. 2004) gener- 3 deterministic ated from SAO/SCADE. 4 but the less specialized, the larger commercial market (and the less client satisfaction)! August 9 th , 2005 August 9 th , 2005 Critical Research Areas in Aerospace Software, MIT — 7 — ľ P. Cousot Critical Research Areas in Aerospace Software, MIT — 8 — ľ P. Cousot
Ellipsoid Abstract Domain for Filters Filter Example 2 d Order Digital Filter: t y pedef enum { FALSE = 0, TRUE = 1} BOOLEAN; BOOLEAN I NI T; f l oat P, X; ¸ X n ` 1 + ˛ X n ` 2 + Y n v oi d f i l t er ( ) { a b - Computes X n = - - I n - s t at i c f l oat E[ 2] , S[ 2] ; - The concrete computation is bounded, which - - i f ( I NI T) { S[ 0] = X; P = X; E[ 0] = X; } + + z -1 + z -1 must be proved in the abstract. t el s e { P = ( ( ( ( ( 0. 5 * X) - ( E[ 0] * 0. 7) ) + ( E[ 1] * 0. 4) ) Unit delay Unit delay Switch - There is no stable interval or octagon. - - Switch + ( S[ 0] * 1. 5) ) - ( S[ 1] * 0. 7) ) ; } x(n) j B i E[ 1] = E[ 0] ; E[ 0] = X; S[ 1] = S[ 0] ; S[ 0] = P; Switch - The simplest stable surface is an ellipsoid. - - / * S[ 0] , S[ 1] i n [ - 1327. 02698354, 1327. 02698354] * / } v oi d mai n ( ) { X = 0. 2 * X + 5; I NI T = TRUE; whi l e ( 1) { X = 0. 9 * X + 35; / * s i mul at ed f i l t er i nput * / F(X) f i l t er ( ) ; I NI T = FALSE; } X X } F(X) X U F(X) X U F(X) Reference execution trace unstable interval stable ellipsoid see h t t p : / / w w w . a s t r e e . e n s . f r / August 9 th , 2005 August 9 th , 2005 Critical Research Areas in Aerospace Software, MIT — 9 — ľ P. Cousot Critical Research Areas in Aerospace Software, MIT — 10 — ľ P. Cousot Arithmetic-Geometric Progressions (Example 1) Arithmetic-geometric progressions % c at c ount . c t y pedef enum { FALSE = 0, TRUE = 1} BOOLEAN; - Abstract domain: ( R + ) 5 - - 5 v ol at i l e BOOLEAN I ; i nt R; BOOLEAN T; - Concretization (any function bounded by the arithmetic- - - v oi d mai n( ) { R = 0; geometric progression): whi l e ( TRUE) { ‚ 2 ( R + ) 5 7 ` ! } ( N 7 ! R ) __ASTREE_l og_v ar s ( ( R) ) ; potential overflow! i f ( I ) { R = R + 1; } ‚ ( M ; a; b; a 0 0 ; b ) = el s e { R = 0; } “ ) k ” T = ( R >= 100) ; –x . ax + b ‹ ( –x . a 0 0 f f j 8 k 2 N : j f ( k ) j » x + b ( M ) g __ASTREE_wai t _f or _c l oc k ( ( ) ) ; } } % c at c ount . c onf i g __ASTREE_v ol at i l e_i nput ( ( I [ 0, 1] ) ) ; __ASTREE_max _c l oc k ( ( 3600000) ) ; Reference % as t r ee –ex ec - f n mai n –c onf i g- s em c ount . c onf i g c ount . c | gr ep ’ | R| ’ see h t t p : / / w w w . a s t r e e . e n s . f r / | R| <= 0. + c l oc k * 1. <= 3600001. 5 here in R August 9 th , 2005 August 9 th , 2005 Critical Research Areas in Aerospace Software, MIT — 11 — ľ P. Cousot Critical Research Areas in Aerospace Software, MIT — 12 — ľ P. Cousot
Arithmetic-geometric progressions (Example 2) v oi d m ai n( ) % c at r et r o. c { FI RST = TRUE; t y pedef enum { FALSE=0, TRUE=1} BOOL; whi l e ( TRUE) { BOOL FI RST; dev ( ) ; v ol at i l e BOOL SW I TCH; FI RST = FALSE; v ol at i l e f l oat E; __ASTREE_wai t _f or _c l oc k ( ( ) ) ; f l oat P, X, A, B; Towards System Verification Tools } } % c at r et r o. c onf i g v oi d dev ( ) __ASTREE_v ol at i l e_i nput ( ( E [ - 15. 0, 15. 0] ) ) ; { X=E; __ASTREE_v ol at i l e_i nput ( ( SW I TCH [ 0, 1] ) ) ; i f ( FI RST) { P = X; } __ASTREE_m ax _c l oc k ( ( 3600000) ) ; el s e | P| <= ( 15. + 5. 87747175411e- 39 { P = ( P - ( ( ( ( 2. 0 * P) - A) - B) * 4. 491048e- 03) ) ; } ; / 1. 19209290217e- 07) * ( 1 B = A; + 1. 19209290217e- 07) ˆ c l oc k i f ( SW I TCH) { A = P; } - 5. 87747175411e- 39 / el s e { A = X; } 1. 19209290217e- 07 <= } 23. 0393526881 August 9 th , 2005 August 9 th , 2005 Critical Research Areas in Aerospace Software, MIT — 13 — ľ P. Cousot Critical Research Areas in Aerospace Software, MIT — 14 — ľ P. Cousot Computer controlled systems Software test Approximations: program ! precise, system ! precise Abstractions: program ! none, system ! precise August 9 th , 2005 August 9 th , 2005 Critical Research Areas in Aerospace Software, MIT — 15 — ľ P. Cousot Critical Research Areas in Aerospace Software, MIT — 16 — ľ P. Cousot
Recommend
More recommend
