Static Analysis of Control-Command Systems: Floating-Point and - PowerPoint PPT Presentation

Static Analysis of Control-Command Systems: Floating-Point and Integer Invariants Vivien Maisonneuve Thesis supervisors: Olivier Hermant François Irigoin Thesis defense Paris, February 6, 2015

Control-Command Systems A control-command system is a system that regulates the behavior of a device. command Control System Device actuators sensors 2 / 41

Control-Command Systems A control-command system is a system that regulates the behavior of a device. command Control System Device actuators sensors 2 / 41

Control-Command Systems Wide spectrum of control-command systems 3 / 41 Critical applications ⇒ need for reliability

Development Constraints Often implemented on embedded systems Extra constraints: • reactivity (real time) • autonomy • cost • energy, memory 4 / 41

low-level C program • thousands of LOC • computations • management of sensors • floating-point numbers How to ensure that the executed program is correct? Step-by-step refinements GCC, CLANG and actuators elementary operations decomposed into Description Levels Formalization Realization MATLAB, Simulink (stability) system behavior 4 control theory: (differential equations) 3 model of the environment 2 constraint specification 1 system conception 5 / 41 mathematical proofs of

Description Levels Realization How to ensure that the executed program is correct? Step-by-step refinements GCC, CLANG and actuators elementary operations decomposed into Formalization 5 / 41 MATLAB, Simulink (stability) system behavior 4 control theory: (differential equations) 3 model of the environment 2 constraint specification 1 system conception low-level C program • thousands of LOC • computations mathematical proofs of • management of sensors • floating-point numbers

Description Levels Realization How to ensure that the executed program is correct? Step-by-step refinements GCC, CLANG and actuators elementary operations decomposed into Formalization 5 / 41 MATLAB, Simulink (stability) system behavior 4 control theory: (differential equations) 3 model of the environment 2 constraint specification 1 system conception low-level C program • thousands of LOC • computations mathematical proofs of • management of sensors • floating-point numbers

Programming Critical Systems Combination of different methods: (dynamic allocation, global variables…) Successes in implementing critical software: software • documentation and specification of all software components • coding standard to limit “dangerous” programming techniques • extensive testing • zero bug in space shuttle code (400 KLOC) • after decades of civil aviation, no human casualty due to a defective 6 / 41

Drawbacks Long and expensive development process: 25 % of the total development cost electronic throttle control defect in Toyota Camry vehicles Exhaustive testing is impossible: can miss bugs. correctness. • 70 % of software development cost for Boeing 777, • development constraint sometimes poorly respected: ⇒ Interest in formal methods to provide mathematical insurances of 7 / 41

Context compute response each location in the code Numerical invariants: mathematical properties on program variables, at stability domain”: … “During execution, controller state variables // property P 4 send response to actuators // property P 3 // property P 2 Formalization input sensors // property P 1 input command repeat every 10ms: and a stability proof Output after formalization: MATLAB pseudocode of a discrete-time C code implementation controller with a frequency 8 / 41

Context Formalization C code implementation Output after formalization: MATLAB pseudocode of a discrete-time repeat every 10ms: input sensors // property P 2 compute response // property P 3 send response to actuators // property P 4 Numerical invariants: mathematical properties on program variables, at each location in the code controller with a frequency and a stability proof input command // property P 1 “During execution, controller state variables ∈ stability domain”: … � 8 / 41

Problems & Contributions Formalization C code implementation 1 Stability proof on real numbers Implementation on machine arithmetic • numeric constants • rounding errors in computations 9 / 41

• Linear systems • Floating-point & fixed-point arithmetic, parametric precision • [Feron ICSM’10]: open-loop 32 bits, closed-loop 117 bits Transposition of Stability Proof to Machine Arithmetic % d Implementation Functions Constants Machine (C) d % d Theoretical Framework Intermediate d % d % d Real (MATLAB) i % d Transpose code + invariants in two steps % d ′ = θ ( d , i ) 10 / 41

• Linear systems • Floating-point & fixed-point arithmetic, parametric precision • [Feron ICSM’10]: open-loop 32 bits, closed-loop 117 bits Implementation Functions Constants Machine (C) d % d % d Intermediate Theoretical Framework Transposition of Stability Proof to Machine Arithmetic d Real (MATLAB) i % d Transpose code + invariants in two steps % ˜ ı ˜ % d ′ = θ ( d , i ) d ′ = θ (˜ % ˜ d , ˜ ı ) 10 / 41

• Linear systems • Floating-point & fixed-point arithmetic, parametric precision • [Feron ICSM’10]: open-loop 32 bits, closed-loop 117 bits Transposition of Stability Proof to Machine Arithmetic Theoretical Framework % d i Real (MATLAB) d Implementation Functions Constants Machine (C) d Intermediate Transpose code + invariants in two steps % ¯ % ˜ ı ˜ ¯ ı % d ′ = θ ( d , i ) d ′ = θ (˜ d ′ ⊃ θ (¯ % ¯ % ˜ d , ˜ ı ) d , ˜ ı ) ⊕ ε 10 / 41

Transposition of Stability Proof to Machine Arithmetic Intermediate % d i Implementation Real (MATLAB) Functions d Constants Machine (C) d Theoretical Framework Transpose code + invariants in two steps % ¯ % ˜ ı ˜ ¯ ı % d ′ = θ ( d , i ) d ′ = θ (˜ d ′ ⊃ θ (¯ % ¯ % ˜ d , ˜ ı ) d , ˜ ı ) ⊕ ε • Linear systems • Floating-point & fixed-point arithmetic, parametric precision • [Feron ICSM’10]: open-loop 32 bits, closed-loop 117 bits 10 / 41

Problems & Contributions Formalization C code implementation 2 Data acquisition through interrupt handlers outside the main loop SIGNAL (SIG_COMMAND) { ... } SIGNAL (SIG_SENSOR1) { ... } void main_loop() { ... } New invariant computation techniques 11 / 41 ⇒ different code structure ⇒ computation of global invariants to check the program runs at the ⇒ correct frequency • transformers • benchmark to compare tools and algorithms

Outline 1 Transformers: Scalability and Accuracy 2 Improvements in Transformer Computation Control-Path Transformers Iterative Analysis Arbitrary-Precision Numbers 3 Model Restructuring State Splitting State Merge 12 / 41

Linear Relation Analysis (LRA) [Cousot & Halbwachs POPL’78] // invariant (precondition) program instruction // invariant (postcondition) x 1 x 2 Good trade-off: computational cost vs. accuracy invariant = system of affine (in)equalities = convex polyhedron x 1 + 7 ≥ 2 x 2 x 2 ≥ 5 − x 1 x 2 ≥ 1 13 / 41

• Propagation • Branch output P 6 : either P 4 or P 5 • Branch output P 7 : • Loop invariant: P 2 entering the loop P 7 after one iteration 1 n 0 P 6 P 2 Linear Relation Analysis (LRA) P 7 [Halbwachs & Henry SAS’12] } else n = 0; if (n < 60) n++; if (rand()) while (rand()) int n = 0; void foo() { 14 / 41

• Branch output P 6 : either P 4 or P 5 • Branch output P 7 : • Loop invariant: P 2 entering the loop P 7 after one iteration 1 n 0 P 6 P 2 P 7 Linear Relation Analysis (LRA) [Halbwachs & Henry SAS’12] } else n = 0; if (n < 60) n++; if (rand()) while (rand()) int n = 0; void foo() { • Propagation // P 0 : true 14 / 41

• Branch output P 6 : either P 4 or P 5 • Branch output P 7 : • Loop invariant: P 2 entering the loop P 7 after one iteration 1 n 0 P 6 P 2 P 7 Linear Relation Analysis (LRA) [Halbwachs & Henry SAS’12] } else n = 0; if (n < 60) n++; if (rand()) while (rand()) int n = 0; void foo() { • Propagation // P 0 : true // P 1 : n = 0 14 / 41

• Branch output P 6 : either P 4 or P 5 • Branch output P 7 : • Loop invariant: P 2 entering the loop P 7 after one iteration 1 n 0 P 6 P 2 P 7 Linear Relation Analysis (LRA) [Halbwachs & Henry SAS’12] } else n = 0; if (n < 60) n++; if (rand()) while (rand()) int n = 0; void foo() { • Propagation // P 0 : true // P 1 : n = 0 // P 2 : n = 0 14 / 41

• Branch output P 6 : either P 4 or P 5 • Branch output P 7 : • Loop invariant: P 2 entering the loop P 7 after one iteration Linear Relation Analysis (LRA) [Halbwachs & Henry SAS’12] P 6 P 2 P 7 if (n < 60) n++; } else n = 0; n 1 if (rand()) while (rand()) int n = 0; void foo() { 0 • Propagation // P 0 : true // P 1 : n = 0 // P 2 : n = 0 // P 3 : n = 0 14 / 41

• Branch output P 6 : either P 4 or P 5 • Branch output P 7 : • Loop invariant: P 2 entering the loop P 7 after one iteration Linear Relation Analysis (LRA) } P 2 P 7 [Halbwachs & Henry SAS’12] if (n < 60) n++; else n = 0; n 0 1 if (rand()) while (rand()) int n = 0; void foo() { P 6 • Propagation in each branch // P 0 : true // P 1 : n = 0 // P 2 : n = 0 // P 3 : n = 0 // P 4 : n = 1 14 / 41