Specifying and verifying reactive systems in a multi-language environment

Abstract The multi-language environment Synchronie supports the design and formal verification of synchronous reactive systems. It integrates three synchronous languages and also three ways to specify properties: the temporal logic with future operators CTL, the temporal logic with past operators Past TL, and observers, which are particular synchronous programs. It is argued that this multi-language feature provides an answer to two major issues of formal verification: facility of formalizing properties and facility of verifying large systems. The approach is illustrated with the case study of a time-triggered protocol

Verifying the Safety of a Flight-Critical System

This paper describes our work on demonstrating verification technologies on a flight-critical system of realistic functionality, size, and complexity. Our work targeted a commercial aircraft control system named Transport Class Model (TCM), and involved several stages: formalizing and disambiguating requirements in collaboration with do- main experts; processing models for their use by formal verification tools; applying compositional techniques at the architectural and component level to scale verification. Performed in the context of a major NASA milestone, this study of formal verification in practice is one of the most challenging that our group has performed, and it took several person months to complete it. This paper describes the methodology that we followed and the lessons that we learned.Comment: 17 pages, 5 figure

Modular Compilation of a Synchronous Language

Synchronous languages rely on formal methods to ease the development of applications in an efficient and reusable way. Formal methods have been advocated as a means of increasing the reliability of systems, especially those which are safety or business critical. It is still difficult to develop automatic specification and verification tools due to limitations like state explosion, undecidability, etc... In this work, we design a new specification model based on a reactive synchronous approach. Then, we benefit from a formal framework well suited to perform compilation and formal validation of systems. In practice, we design and implement a special purpose language (LE) and its two semantics~: the ehavioral semantics helps us to define a program by the set of its behaviors and avoid ambiguousness in programs' interpretation; the execution equational semantics allows the modular compilation of programs into software and hardware targets (c code, vhdl code, fpga synthesis, observers). Our approach is pertinent considering the two main requirements of critical realistic applications~: the modular compilation allows us to deal with large systems, the model-based approach provides us with formal validation

Synthesizing Modular Invariants for Synchronous Code

In this paper, we explore different techniques to synthesize modular invariants for synchronous code encoded as Horn clauses. Modular invariants are a set of formulas that characterizes the validity of predicates. They are very useful for different aspects of analysis, synthesis, testing and program transformation. We describe two techniques to generate modular invariants for code written in the synchronous dataflow language Lustre. The first technique directly encodes the synchronous code in a modular fashion. While in the second technique, we synthesize modular invariants starting from a monolithic invariant. Both techniques, take advantage of analysis techniques based on property-directed reachability. We also describe a technique to minimize the synthesized invariants.Comment: In Proceedings HCVS 2014, arXiv:1412.082

Flux observer algorithms for direct torque control of brushless doubly-fed reluctance machines

Direct Torque Control (DTC) has been extensively researched and applied to most AC machines during the last two decades. Its first application to the Brushless Doubly-Fed Reluctance Machine (BDFRM), a promising cost-effective candidate for drive and generator systems with limited variable speed ranges (such as large pumps or wind turbines), has only been reported a few years ago. However, the original DTC scheme has experienced flux estimation problems and compromised performance under the maximum torque per inverter ampere (MTPIA) conditions. This deficiency at low current and torque levels may be overcome and much higher accuracy achieved by alternative estimation approaches discussed in this paper using Kalman Filter (KF) and/or Sliding Mode Observer (SMO). Computer simulations accounting for real-time constraints (e.g. measurement noise, transducer DC offset etc.) have produced realistic results similar to those one would expect from an experimental setup

AUTSEG: Automatic Test Set Generator for Embedded Reactive Systems

Part 2: Tools and FrameworksInternational audienceOne of the biggest challenges in hardware and software design is to ensure that a system is error-free. Small errors in reactive embedded systems can have disastrous and costly consequences for a project. Preventing such errors by identifying the most probable cases of erratic system behavior is quite challenging. In this paper, we introduce an automatic test set generator called AUTSEG. Its input is a generic model of the target system, generated using the synchronous approach. Our tool finds the optimal preconditions for restricting the state space of the model. It only works locally on significant subspaces. Our approach exhibits a simpler and efficient quasi-flattening algorithm than existing techniques and a useful compiled form to check security properties and reduce the combinatorial explosion problem of state space. To illustrate our approach, AUTSEG was applied to the case of a transportation contactless card

Distributed Verification of Rare Properties using Importance Splitting Observers

Rare properties remain a challenge for statistical model checking (SMC) due to the quadratic scaling of variance with rarity. We address this with a variance reduction framework based on lightweight importance splitting observers. These expose the model-property automaton to allow the construction of score functions for high performance algorithms. The confidence intervals defined for importance splitting make it appealing for SMC, but optimising its performance in the standard way makes distribution inefficient. We show how it is possible to achieve equivalently good results in less time by distributing simpler algorithms. We first explore the challenges posed by importance splitting and present an algorithm optimised for distribution. We then define a specific bounded time logic that is compiled into memory-efficient observers to monitor executions. Finally, we demonstrate our framework on a number of challenging case studies