Towards Certification of Network Calculus Marc Boyer, Lo¨ ıc Fejoz, Etienne Mabille, Stephan Merz Dagstuhl seminar 15182, April 2015 Boyer, Fejoz, Mabille, Merz Towards Certification of Network Calculus Dagstuhl 2015 1 / 20
Contents Motivation 1 Network Calculus 2 The Proof Assistant Isabelle/HOL 3 Certifying NC Computations in Isabelle/HOL 4 Boyer, Fejoz, Mabille, Merz Towards Certification of Network Calculus Dagstuhl 2015 2 / 20
Application of Formal Methods in Industry Scaling up for critical systems ◮ have a solid theory for system design: great! Boyer, Fejoz, Mabille, Merz Towards Certification of Network Calculus Dagstuhl 2015 3 / 20
Application of Formal Methods in Industry Scaling up for critical systems ◮ have a solid theory for system design: great! ◮ implemented in working prototype: even better! Boyer, Fejoz, Mabille, Merz Towards Certification of Network Calculus Dagstuhl 2015 3 / 20
Application of Formal Methods in Industry Scaling up for critical systems ◮ have a solid theory for system design: great! ◮ implemented in working prototype: even better! ◮ apply it to the next Airbus design: will you take the risk? Boyer, Fejoz, Mabille, Merz Towards Certification of Network Calculus Dagstuhl 2015 3 / 20
Application of Formal Methods in Industry Scaling up for critical systems ◮ have a solid theory for system design: great! ◮ implemented in working prototype: even better! ◮ apply it to the next Airbus design: will you take the risk? Qualification of design tools (DO 178, ECSS-Q-ST-80, . . . ) ◮ make sure your theory works in all border cases ◮ correctness of implementation: process-based quality assurance ◮ specification, documentation, tests, . . . Boyer, Fejoz, Mabille, Merz Towards Certification of Network Calculus Dagstuhl 2015 3 / 20
Application of Formal Methods in Industry Scaling up for critical systems ◮ have a solid theory for system design: great! ◮ implemented in working prototype: even better! ◮ apply it to the next Airbus design: will you take the risk? Qualification of design tools (DO 178, ECSS-Q-ST-80, . . . ) ◮ make sure your theory works in all border cases ◮ correctness of implementation: process-based quality assurance ◮ specification, documentation, tests, . . . ⇒ Are you convinced of costs vs. benefits? Boyer, Fejoz, Mabille, Merz Towards Certification of Network Calculus Dagstuhl 2015 3 / 20
Quality Assurance Through Result Certification Check results of individual runs ◮ solver provides a trace that can be checked independently ◮ verifying a solution is simpler than proving the implementation ◮ trusted code base shifts from solver to checker ◮ solver software can evolve without being requalified Boyer, Fejoz, Mabille, Merz Towards Certification of Network Calculus Dagstuhl 2015 4 / 20
Quality Assurance Through Result Certification Check results of individual runs ◮ solver provides a trace that can be checked independently ◮ verifying a solution is simpler than proving the implementation ◮ trusted code base shifts from solver to checker ◮ solver software can evolve without being requalified Result certification using a proof assistant ⊕ formalizing background theory increases trust ⊕ kernels of proof assistants are small and stable ⊖ checking large traces by the kernel may be inefficient Boyer, Fejoz, Mabille, Merz Towards Certification of Network Calculus Dagstuhl 2015 4 / 20
Quality Assurance Through Result Certification Check results of individual runs ◮ solver provides a trace that can be checked independently ◮ verifying a solution is simpler than proving the implementation ◮ trusted code base shifts from solver to checker ◮ solver software can evolve without being requalified Result certification using a proof assistant ⊕ formalizing background theory increases trust ⊕ kernels of proof assistants are small and stable ⊖ checking large traces by the kernel may be inefficient ⇒ efficiency may be acceptable for off-line checking ⇒ use code generation for more efficient checkers Boyer, Fejoz, Mabille, Merz Towards Certification of Network Calculus Dagstuhl 2015 4 / 20
Result Certification for Network Calculus Design of embedded networks ◮ regulated application domains: avionics, trains, cars (?) ◮ heterogeneous VLSI designs (NoC): errors are costly Established theory: network calculus (Le Boudec et al., 1990s) ◮ algebraic theory for computing memory and delay bounds ◮ industrial / academic tool sets (Rockwell Collins ConfGen) ◮ widely used, e.g. for designing AFDX backbone of Airbus A380 Objective of this work ◮ explore suitability of result certification approach ◮ provide a path towards complementing standard tool qualification Boyer, Fejoz, Mabille, Merz Towards Certification of Network Calculus Dagstuhl 2015 5 / 20
Contents Motivation 1 Network Calculus 2 The Proof Assistant Isabelle/HOL 3 Certifying NC Computations in Isabelle/HOL 4 Boyer, Fejoz, Mabille, Merz Towards Certification of Network Calculus Dagstuhl 2015 6 / 20
Mathematical Basis Representation of network flows ◮ F ( t ) : amount of data transmitted up to time t ◮ non-decreasing function F : R ∞ ≥ 0 → R ∞ ≥ 0 ◮ actual flows are usually unknown, but consider upper bounds Mathematical representation as a dioid ◮ pointwise minimum ⊓ , addition + , ordering ≤ ◮ further operations on flows convolution ( F ∗ G )( t ) = inf { F ( t − s ) + G ( s ) : 0 ≤ s ≤ t } ( F ⊘ G )( t ) = sup { F ( t + s ) − G ( s ) : 0 ≤ s } deconvolution F ∗ = F ⊓ ( F ∗ F ) ⊓ ( F ∗ F ∗ F ) ⊓ · · · sub-add. closure Boyer, Fejoz, Mabille, Merz Towards Certification of Network Calculus Dagstuhl 2015 7 / 20
Convolution: Example G F 0 Boyer, Fejoz, Mabille, Merz Towards Certification of Network Calculus Dagstuhl 2015 8 / 20
Convolution: Example F * G G F 0 Boyer, Fejoz, Mabille, Merz Towards Certification of Network Calculus Dagstuhl 2015 8 / 20
Common Classes of Functions δ d ( t ) = if t ≤ d then 0 else ∞ Step function Linear functions γ δ β ◮ β R , T ( t ) = if t ≤ T then 0 else R ( t − T ) ◮ γ r , b ( t ) = if t ≤ 0 then 0 else rt + b Boyer, Fejoz, Mabille, Merz Towards Certification of Network Calculus Dagstuhl 2015 9 / 20
Common Classes of Functions δ d ( t ) = if t ≤ d then 0 else ∞ Step function Linear functions γ δ β ◮ β R , T ( t ) = if t ≤ T then 0 else R ( t − T ) ◮ γ r , b ( t ) = if t ≤ 0 then 0 else rt + b (Ultimately) periodic piecewise linear functions Explicit representation of NC operations for these functions ◮ closed-form formulas for computing (de)convolution etc. Boyer, Fejoz, Mabille, Merz Towards Certification of Network Calculus Dagstuhl 2015 9 / 20
Further Notions of Network Calculus γ Distances between two flows β ◮ horizontal distance measures worst delay h ( γ , β ) ◮ vertical distance measure buffer use v ( γ , β ) Boyer, Fejoz, Mabille, Merz Towards Certification of Network Calculus Dagstuhl 2015 10 / 20
Further Notions of Network Calculus γ Distances between two flows β ◮ horizontal distance measures worst delay h ( γ , β ) ◮ vertical distance measure buffer use v ( γ , β ) F � α Arrival curve of a flow ◮ upper bound on the rate of arrival of new data ∀ t , s ≥ 0 : F ( t + s ) − F ( t ) ≤ α ( s ) ◮ equivalent formulation: F ≤ F ∗ α Boyer, Fejoz, Mabille, Merz Towards Certification of Network Calculus Dagstuhl 2015 10 / 20
Servers and Service Curves F S G Representation of a simple server ◮ total relation S where ( F , G ) ∈ S implies G ≤ F ◮ S has service curve β if F ∗ β ≤ G whenever ( F , G ) ∈ S Boyer, Fejoz, Mabille, Merz Towards Certification of Network Calculus Dagstuhl 2015 11 / 20
Servers and Service Curves F S G Representation of a simple server ◮ total relation S where ( F , G ) ∈ S implies G ≤ F ◮ S has service curve β if F ∗ β ≤ G whenever ( F , G ) ∈ S Compute arrival curves for server output ◮ assume given input arrival curve α and service curve β ◮ the following formulas are valid arrival curves for the output ( α ⊘ δ h ( α , β ) ) ∗ α ⊘ β α ⊘ δ h ( α , β ) ◮ choice based on shape of curves and effort of computation Boyer, Fejoz, Mabille, Merz Towards Certification of Network Calculus Dagstuhl 2015 11 / 20
Servers and Service Curves F S G Representation of a simple server ◮ total relation S where ( F , G ) ∈ S implies G ≤ F ◮ S has service curve β if F ∗ β ≤ G whenever ( F , G ) ∈ S Compute arrival curves for server output ◮ assume given input arrival curve α and service curve β ◮ the following formulas are valid arrival curves for the output ( α ⊘ δ h ( α , β ) ) ∗ α ⊘ β α ⊘ δ h ( α , β ) ◮ choice based on shape of curves and effort of computation Extensions to servers with multiple inputs/outputs Boyer, Fejoz, Mabille, Merz Towards Certification of Network Calculus Dagstuhl 2015 11 / 20
Contents Motivation 1 Network Calculus 2 The Proof Assistant Isabelle/HOL 3 Certifying NC Computations in Isabelle/HOL 4 Boyer, Fejoz, Mabille, Merz Towards Certification of Network Calculus Dagstuhl 2015 12 / 20
Recommend
More recommend
