Verification Of Critical Systems Research Articles

ADEPT 2022 workshop: a summary of strengths and weaknesses of the AADL ecosystem

The Architecture Analysis and Design Language (AADL) is a SAE Standard for the modeling of both the hardware and the software of embedded systems. The AADL standard is now mature and is today employed by numerous stakeholders in the domain of critical embedded real-time systems to address a large set of concerns: performances (latency, schedulability), safety, or security, ... The ADEPT workshop aims to present and report on current projects in the field of design, implementation, and verification of critical systems where AADL is a first-citizen technology. This article is a summary of the ADEPT 2022 workshop.

Verification of critical systems described in real-time TiMo

We present a simple prototyping language for describing real-time systems including specific features as timeouts, explicit locations, timed migration and timed communication. The parallel execution of a step is provided by multiset labelled transitions. To illustrate its features, we describe a railway control system, and define some behavioural equivalences matching multisets of actions that could happen in a given interval of time. We define strong time-bounded bisimulation and strong open time-bounded bisimulation, and prove that the latter one is a congruence. By using various bisimulations over the behaviours of real-time systems, we can check which behaviours are closer to an optimal and safe behaviour. Automatic analysis is performed using a verification platform called TiMo@PAT which supports the verification of domain-specific properties like process location reachability, time-bounded properties, as well as optimizing resources.

Model-based construction and verification of critical systems using composition and partial refinement

This article introduces a new model-based method for incrementally constructing critical systems and illustrates its application to the development of fault-tolerant systems. The method relies on a special form of composition to combine software components and a set of proof rules to obtain high confidence of the correctness of the composed system. As in conventional component-based software development, two (or more) components are combined, but in contrast to many component-based approaches used in practice, which combine components consisting of code, our method combines components represented as state machine models. In the first phase of the method, a model is developed of the normal system behavior, and system properties are shown to hold in the model. In the second phase, a model of the required fault-handling behavior is developed and "or-composed" with the original system model to create a fault-tolerant extension which is, by construction, "fully faithful" (every execution possible in the normal system is possible in the fault-tolerant system). To model the fault-handling behavior, the set of states of the normal system model is extended through new state variables and new ranges for some existing state variables, and new fault-handling transitions are defined. Once constructed, the fault-tolerant extension is shown, using a set of property inheritance and compositional proof rules, to satisfy both the overall system properties, typically weakened, and selected fault-tolerance properties. These rules can often be used to verify the properties automatically. To provide a formal foundation for the method, formal notions of or-composition, partial refinement, fault-tolerant extension, and full faithfulness are introduced. To demonstrate and validate the method, we describe its application to a real-world, fault-tolerant avionics system.