Contract-based Design Research Articles

Pacti: Assume-Guarantee Contracts for Efficient Compositional Analysis and Design

Contract-based design is a method to facilitate modular design of systems. While there has been substantial progress on the theory of contracts, there has been less progress on practical algorithms for the algebraic operations in the theory. In this paper, we present 1) principles to implement a contract-based design tool at scale and 2) Pacti, a tool that can efficiently compute these operations. We illustrate the use of Pacti in a variety of case studies.

Modular assurance of an Autonomous Ferry using Contract-Based Design and Simulation-based Verification Principles

Abstract With the introduction of autonomous technology into our society, e.g. autonomous shipping, it is important to assess and assure the safety of autonomous systems in a real-world context. Simulation-based testing is a common approach to attempt to verify performance of autonomous systems, but assurance also requires formal evidence. This paper introduces the Assurance of Digital Assets (ADA) framework, a structured method for the assurance of digital assets, i.e. novel, complex, or intelligent systems enabled by digital technologies, using contract-based design. Results are shown for an autonomous ferry assurance case, focusing on collision avoidance during the ferry’s transit. Further, we discuss the role of simulation-based testing in verifying compliance to contract specifications, to build the necessary evidence for an assurance case.

Integrating scenario- and contract-based verification for automated vessels

Scenario-based verification defines the current state of the art for examining a vessel’s control systems for reliability and safety. However, software updates after release can only be covered to a limited extent. To take changes to a deployed system into account, the design and test phase must be harmonized with the operational phase. For all phases, regulatory, technical and safety requirements provide the scope to which the development process and the scenario-based tests need to be aligned and whose specifications the System under Test (SuT) must adhere to during operation. For this reason, a procedure is needed that converts the requirements into a format that can be utilized across all phases and measured in a structured manner comparing the original system to the updated version. This work does so by combining scenario-based verification methods with formal composition and monitoring techniques based on contract-based design into an integrated development approach. It is shown how safety requirements can be transferred into a Verification Descriptor that in turn provides the foundation for the division into model-based system development, contract-based virtual integration testing and a scenario-based test environment. For the entire lifecycle of the System under Test (SuT) to be included, the extended scenario and contract descriptors are carried forward up to the operational phase, such that the previously defined properties of the SuT can be monitored and validated during runtime. The approach is designed alongside a minimal-viable system and evaluated on an actual implementation of a safety-critical maritime LiDAR-based positioning system.

Information-flow interfaces

AbstractContract-based design is a promising methodology for taming the complexity of developing sophisticated systems. A formal contract distinguishes between assumptions, which are constraints that the designer of a component puts on the environments in which the component can be used safely, and guarantees, which are promises that the designer asks from the team that implements the component. A theory of formal contracts can be formalized as an interface theory, which supports the composition and refinement of both assumptions and guarantees. Although there is a rich landscape of contract-based design methods that address functional and extra-functional properties, we present the first interface theory designed to ensure system-wide security properties. Our framework provides a refinement relation and a composition operation that support both incremental design and independent implementability. We develop our theory for both stateless and stateful interfaces. Additionally, we introduce information-flow contracts where assumptions and guarantees are sets of flow relations. We use these contracts to illustrate how to enrich information-flow interfaces with a semantic view. We illustrate the applicability of our framework with two examples inspired by the automotive domain.

Contract-Based Design for Hybrid Dynamical Systems and Invariance Properties

This work establishes fundamental principles for verifying contract for interconnected hybrid systems. When system’s hybrid arcs conform to the contract for a certain duration but subsequently violate it, the composition of hybrid dynamical systems becomes challenging. The objective of this work is to analyze the temporal satisfaction of the contract, allowing us to reason about the compositions that do not violate the contract up to a certain point in a hybrid time. Notions of weak and strong satisfaction of an assume-guarantee contract are introduced. These semantics permits the compositional reasoning on hybrid systems of varying complexity depending on the interconnection’s type, feedback or cascade. The results show that both semantics are compatible with cascade composition, while strong semantic is required for feedback composition. Moreover, we have shown how one can go from weak to strong contract satisfaction. Finally, we have studied a particular class of hybrid systems and we have shown that the concept of forward (pre-)invariant relative to a contract makes it possible to deal with feedback compositions. These results are demonstrated throughout the paper with simple numerical examples.

Contract-based specification of mode-dependent timing behavior

The design of safety-critical systems calls for rigorous application of specification and verification methods. In this context, a comprehensive consideration of safety aspects, which inevitably include timing properties, requires explicit addressing of operating modes and their transitions in the system model as well as in the respective specifications. As a side effect, this helps to reduce verification complexity. This paper presents an extension of a framework for the specification of timing properties following the contract-based design paradigm. It provides enhancements of the underlying specification language, which enables specifying modes, mode transitions, and mode-dependent behavior. A formal semantics is given in order to enable reasoning about such specifications as well as about contract operations like refinement and composition, thus enabling to make statements about mode composition. The results are discussed using a real-world example.

Lifecycle Management of Automotive Safety-Critical Over the Air Updates: A Systems Approach

With the increasing importance of Over The Air (OTA) updates in the automotive field, maintaining safety standards becomes more challenging as frequent incremental changes of embedded software are regularly integrated into a wide range of vehicle variants. This necessitates new processes and methodologies with a holistic view on the backend, where the updates are developed and released, and the frontend (vehicle), to which the updates are deployed. In this paper, we introduce an approach, including a process and a methodology, for continuous contract-based design, validation and deployment of modular updates for variant-rich automotive systems. The approach considers the vehicle as part of its connected environment enclosing a backend and concentrates on safety-critical applications. In addition, we present the UPDateable Automotive Test dEmonstratoR (UPDATER), which is a mock-up for modern Electric/Electronic architectures including a backend and a frontend part. It serves as a prototype for developing, deploying and monitoring automotive OTA updates. In a case study based on UPDATER, we apply the approach to three exemplary updates of a variable Advanced Driver Assistance System (ADAS). We show how the updates development and management may be achieved in an efficient and agile way.

Product-line assurance cases from contract-based design

Assurance cases are used to argue in a structured, and evidence-supported way, that a property such as safety or security is satisfied by a system. In some domains however, instead of single systems, product lines with many system-variants are engineered, to satisfy the needs of different customers. In such context, single-system methods for assurance-case creation suffer from scalability issues because the underlying assumption is that the evidence and arguments can be created per system variant. This paper presents a novel method for product-line assurance-case creation where all the arguments and the evidence are created without analyzing each system variant. Consequently, the effort to create an assurance case scales with the complexity of system variants, instead with their number. The method is based on a contract-based design framework for cyber–physical systems, which is extended to define the conditions under which all system variants satisfy a particular property. These conditions are used to define an assurance-case pattern, which can be instantiated for arbitrary product lines. Moreover, the defined pattern is modular to enable step-wise assurance-case creation. Finally, an exploratory case study is performed on a real product-line from the heavy-vehicle manufacturer Scania to evaluate the applicability of the presented method.

Contract-Based Design of Symbolic Controllers for Safety in Distributed Multiperiodic Sampled-Data Systems

This article presents a symbolic control approach to the design of distributed safety controllers for a class of continuous-time nonlinear systems. More precisely, we consider systems made of components where each component is equipped with a sampled-data controller with its own sampling period, resulting globally in a distributed multiperiodic sampled-data system. Moreover, controllers receive partial information on the state of the other components. We propose a component-based approach to controller synthesis, which relies on the use of abstractions and continuous-time assume-guarantee contracts. The abstractions describe the dynamics of the system from the point of view of each component based on the information structure, whereas assume-guarantee contracts specify guarantees that a component must satisfy if assumptions on the other components are met. We show that our approach makes it possible to decompose a global safety control problem into local ones that can be solved independently. We then show how symbolic control techniques can be used to synthesize controllers that enforce the local control objectives. Illustrative applications in building automation and vehicle platooning are shown.

An MBSE Approach for Development of Resilient Automated Automotive Systems

Advanced driver assistance and automated driving systems must operate in complex environments and make safety-critical decisions. Resilient behavior of these systems in their targeted operation design domain is essential. In this paper, we describe developments in our Model-Based Systems Engineering (MBSE) approach to develop resilient safety-critical automated systems. An MBSE approach provides the ability to provide guarantees about system behavior and potentially reduces dependence on in-vehicle testing through the use of rigorous models and extensive simulation. We are applying MBSE methods to two key aspects of developing resilient systems: (1) ensuring resilient behavior through the use of Resilience Contracts for system decision making; and (2) applying simulation-based testing methods to verify the system handles all known scenarios and to validate the system against potential unknown scenarios. Resilience Contracts make use of contract-based design methods and Partially Observable Markov Decision Processes (POMDP), which allow the system to model potential uncertainty in the sensed environment and thus make more resilient decisions. The simulation-based testing methodology provides a structured approach to evaluate the operation of the target system in a wide variety of operating conditions and thus confirm that the expected resilient behavior has indeed been achieved. This paper provides details on the development of a utility function to support Resilience Contracts and outlines the specific test methods used to evaluate known and unknown operating scenarios.

Tightening the contract refinements of a system architecture

Contract-based design is an emerging paradigm for correct-by-construction hierarchical systems: components are associated with assumptions and guarantees expressed as formal properties; the architecture is analyzed by verifying that each contract of composite components is correctly refined by the contracts of its subcomponents. The approach is very efficient, because the overall correctness proof is decomposed into proofs local to each component. However, the process for the contract specification and refinement is quite expensive because the requirements are formalised into formal properties, where part of the complexity is delegated to the designer, who has the burden of specifying the contracts. Typical problems include understanding which contracts are necessary, and how they can be simplified without breaking the correctness of the refinement and other refinements in case some subcontracts are shared. In this paper, we tackle these problems by proposing a technique to understand and simplify the contract refinements of a system architecture during the development process for the contract specification and refinement. The technique, called tightening, is based on parameter synthesis. The idea is to generate a set of parametric proof obligations, where each parameter evaluation corresponds to a variant of the original(s) contract refinement(s), and to search for tighter variants of the contracts that still ensure the correctness of the refinement(s). We cast this approach in the OCRA framework, where contracts are expressed with LTL formulas, and we evaluate its performance and effectiveness on a number of benchmarks.

Vibration suppression of a tool in a lathe machine through contract-based design

Machine design is one of the most important tasks in the present scenario. Presently, machine design is done taking into account all the variables and operating conditions. The process is time consuming, error prone, and inefficient design methodology. Due to lack of optimization of the performance of individual components, the performance of the machine as a whole deteriorates. This paper aims at demonstrating the versatility of contract-based design methodology to design machines and overcome some of the drawbacks of the traditional designing process. The process variables involved in such a complex process are best modeled as fuzzy variables as they take non-discrete values. These fuzzy variables are analyzed using contract-based design. An illustration of lathe machine is used to enhance the machining capability by suppressing vibrations using a fuzzy controller and contract-based design. This leads to accurate machining with better tolerances and surface finish.

Contract-Based Design of Embedded Systems Integrating Nominal Behavior and Safety

The distributed design process for safety-critical embedded systems has become an increasingly difficult challenge: Electronic Control Units (ECUs) in vehicles, for instance, participate in many vehicle functions, while each vehicle function, in turn, is spread across several ECUs. Many suppliers participate in systems design and many partial functions are reused from past projects, not always knowing the assumptions at the time of their development. In particular, efficient allocation of safety mechanisms and a sound safety case are difficult tasks for original equipment manufacturers (OEMs). Contract-based development has gained popularity as an approach for supporting distributed development by explicitly annotating assumptions and guarantees to components, but an integrated process covering specification of nominal behavior and safety has not been described so far. We present such an integrated development approach that encompasses the systematic breakdown of nominal system behavior using contracts, the consistent derivation of safety analysis by interpreting several types of contract violations as a specification for failure modes, and the subsequent integration of safety mechanisms that cover these failure modes through safety contracts. The approach equally fits hardware and software and is therefore applicable on the system level. We demonstrate it by an electric drive example. The extensibility of our approach towards Cyber Physical Systems, which compose themselves at runtime, is briefly outlined at the end of the article.

A tag contract framework for modeling heterogeneous systems

Development of distributed systems can be supported effectively by a contract-based methodology as contracts can ensure interoperability of components and adherence to specifications. Such development can become very complex since distributed systems can consist of components which are heterogeneous in terms of computational and interactive model. Several frameworks, both operational and denotational, have been proposed to handle heterogeneity using a variety of approaches. However, the application of those frameworks to contract-based design has not yet been investigated. In this work, we adopt the operational mechanism of tag machines to represent heterogeneous systems and construct a full contract model. We introduce heterogeneous composition, refinement, dominance and compatibility between contracts, altogether enabling a formalized and rigorous design process for heterogeneous systems. Besides, we also develop a method to synthesize or refine the component models so that their composition satisfies a given contract.

HRELTL: A temporal logic for hybrid systems

Hybrid traces are useful to describe behaviors of dynamic systems where continuous and discrete evolutions are combined. The ability to represent sets of traces by means of formulas in temporal logic has recently found important applications in various fields, such as requirements analysis, compositional verification, and contract-based design. In this paper we present HRELTL, a temporal logic to characterize hybrid traces. The logic is highly expressive: it allows the description of continuous behaviors, by expressing mathematical constraints over derivatives, and discrete behaviors, by constraining values of variables across instantaneous transitions. HRELTL combines the power of temporal operators and regular expressions, and enjoys important properties such as sampling invariance.We demonstrate that the satisfiability problem for a fragment of HRELTL allows for a satisfiability-preserving reduction to RELTL(RA), a logic over discrete traces with atoms in non-linear Real Arithmetic for which automated reasoning procedures are being developed.

Contracts-refinement proof system for component-based embedded systems

Contract-based design is an emerging paradigm for the design of complex systems, where each component is associated with a contract, i.e., a clear description of the expected interaction of the component with its environment. Contracts specify the expected behavior of a component by defining the assumptions that must be satisfied by the environment and the guarantees satisfied by the component in response. The ultimate goal of contract-based design is to allow for compositional reasoning, stepwise refinement, and a principled reuse of components that are already pre-designed, or designed independently.In this paper, we present fully formal contract framework based on temporal logic (a preliminary version of this framework has been presented in [1]). The synchronous or asynchronous decomposition of a component into subcomponents is complemented with the corresponding refinement of its contracts. The framework exploits such decomposition to automatically generate a set of proof obligations. Once verified, the conditions allow concluding the correctness of the architecture. This means that the components ensure the guarantee of the system and the system ensures the assumptions of the components. The framework can be instantiated with different temporal logics. The proof system reduces the correctness of contracts refinement to entailment of temporal logic formulas. The tool support relies on an expressive property specification language, conceived for the formalization of embedded system requirements, and on a verification engine based on automated SMT techniques.

Taming Dr. Frankenstein: Contract-Based Design for Cyber-Physical Systems*

Cyber-physical systems combine a cyber side (computing and networking) with a physical side (mechanical, electrical, and chemical processes). In many cases, the cyber component controls the physical side using sensors and actuators that observe the physical system and actuate the controls. Such systems present the biggest challenges as well as the biggest opportunities in several large industries, including electronics, energy, automotive, defense and aerospace, telecommunications, instrumentation, industrial automation. Engineers today do successfully design cyber-physical systems in a variety of industries. Unfortunately, the development of systems is costly, and development schedules are difficult to stick to. The complexity of cyber-physical systems, and particularly the increased performance that is offered from interconnecting what in the past have been separate systems, increases the design and verification challenges. As the complexity of these systems increases, our inability to rigorously model the interactions between the physical and the cyber sides creates serious vulnerabilities. Systems become unsafe, with disastrous inexplicable failures that could not have been predicted. Distributed control of multi-scale complex systems is largely an unsolved problem. A common view that is emerging in research programs in Europe and the US is “enabling contract-based design (CBD),” which formulates a broad and aggressive scope to address urgent needs in the systems industry. We present a design methodology and a few examples in controller design whereby contract-based design can be merged with platform-based design to formulate the design process as a meet-in-the-middle approach, where design requirements are implemented in a subsequent refinement process using as much as possible elements from a library of available components. Contracts are formalizations of the conditions for correctness of element integration (horizontal contracts), for lower level of abstraction to be consistent with the higher ones, and for abstractions of available components to be faithful representations of the actual parts (vertical contracts).

A Boolean Algebra of Contracts for Assume-guarantee Reasoning

Contract-based design is an expressive paradigm for a modular and compositional specification of programs. It is in turn becoming a fundamental concept in mainstream industrial computer-aided design tools for embedded system design. In this paper, we elaborate new foundations for contract-based embedded system design by proposing a general-purpose algebra of assume/guarantee contracts based on two simple concepts: first, the assumption or guarantee of a component is defined as a filter and, second, filters enjoy the structure of a Boolean algebra. This yields a structure of contracts that is a Heyting algebra.