Formal Specification and Verification of Avionics Software



Similar documents
F-22 Raptor. Agenda. 1. Motivation

Design by Contract beyond class modelling

Meeting DO-178B Software Verification Guidelines with Coverity Integrity Center

AC REUSABLE SOFTWARE COMPONENTS

Rigorous Software Development CSCI-GA

Checking Access to Protected Members in the Java Virtual Machine

Certification of a Scade 6 compiler

Formal Engineering for Industrial Software Development

KITES TECHNOLOGY COURSE MODULE (C, C++, DS)

Best Practices for Verification, Validation, and Test in Model- Based Design

Questions? Assignment. Techniques for Gathering Requirements. Gathering and Analysing Requirements

Certification Authorities Software Team (CAST) Position Paper CAST-10

Software Engineering Techniques

CS 111 Classes I 1. Software Organization View to this point:

AP Computer Science Java Subset

Implementation Aspects of OO-Languages

Safe Object-Oriented Software: The Verified Design-By-Contract Paradigm

Chapter 1 Fundamentals of Java Programming

VDM vs. Programming Language Extensions or their Integration

Overview Motivating Examples Interleaving Model Semantics of Correctness Testing, Debugging, and Verification

Monitors, Java, Threads and Processes

Chapter 4: Design Principles I: Correctness and Robustness

Java (12 Weeks) Introduction to Java Programming Language

Unit-testing with JML

Monitoring Java Code Using ConGu

Antonio Kung, Trialog. HIJA technical coordinator. Scott Hansen, The Open Group. HIJA coordinator

CS 141: Introduction to (Java) Programming: Exam 1 Jenny Orr Willamette University Fall 2013

Data Abstraction and Hierarchy

The new software standard for the avionic industry: goals, changes and challenges

AVIATION SPECIALIST. Inspects aviation schools for conformance with state laws, rules, and regulations.

Examples of Design by Contract in Java

Case studies: Outline. Requirement Engineering. Case Study: Automated Banking System. UML and Case Studies ITNP090 - Object Oriented Software Design

Object-Oriented Technology Verification Phase 2 Report Data Coupling and Control Coupling

Bachelor of Games and Virtual Worlds (Programming) Subject and Course Summaries

Semester Review. CSC 301, Fall 2015

Mining a Change-Based Software Repository

Java Memory Model: Content

Application Centric Infrastructure Object-Oriented Data Model: Gain Advanced Network Control and Programmability

Unified Static and Runtime Verification of Object-Oriented Software

Rigorous Methods for Software Engineering (F21RS1) High Integrity Software Development

CS193j, Stanford Handout #10 OOP 3

Programming by Contract. Programming by Contract: Motivation. Programming by Contract: Preconditions and Postconditions

Patterns in. Lecture 2 GoF Design Patterns Creational. Sharif University of Technology. Department of Computer Engineering

Systems Integration: Co C mp m onent- t bas a e s d s o s ftw ft a w r a e r e ngin i eeri r n i g

Concepts and terminology in the Simula Programming Language

Software Testing. Definition: Testing is a process of executing a program with data, with the sole intention of finding errors in the program.

Introduction to programming

Course Title: Software Development

Component visualization methods for large legacy software in C/C++

University of Twente. A simulation of the Java Virtual Machine using graph grammars

Requirements Engineering Management Findings Report

Programming Languages

White Papers: EDIDocument Crystal Universe Software Document Version: 1.2. Overview. General EDI Segment Structure

Die wichtigsten Use Cases für MISRA, HIS, SQO, IEC, ISO und Co. - Warum Polyspace DIE Embedded Code-Verifikationslösung ist.

CS 451 Software Engineering Winter 2009

CSCI 253. Object Oriented Programming (OOP) Overview. George Blankenship 1. Object Oriented Design: Java Review OOP George Blankenship.

Critical Systems and Software Solutions

Methodology: Agile development of safety critical systems Annex D1.1.d to deliverable D1.1

Certification Authorities Software Team (CAST) Position Paper CAST-13

The C Programming Language course syllabus associate level

Safety Management Challenges for Aviation Cyber Physical Systems

The Impact of RTCA DO-178C on Software Development

Compiling Object Oriented Languages. What is an Object-Oriented Programming Language? Implementation: Dynamic Binding

DO-178C: A New Standard for Software Safety Certification

Rigorous Software Engineering Hoare Logic and Design by Contracts

Handout 1. Introduction to Java programming language. Java primitive types and operations. Reading keyboard Input using class Scanner.

Agile Specification-Driven Development

Cisco Discovery 3: Introducing Routing and Switching in the Enterprise hours teaching time

Habanero Extreme Scale Software Research Project

Programming and Software Development CTAG Alignments

CS 2112 Spring Instructions. Assignment 3 Data Structures and Web Filtering. 0.1 Grading. 0.2 Partners. 0.3 Restrictions

PRESENTATION. Patrick Ky Executive Director EUROPEAN COMMISSION

Schema Classes. Polyhedra Ltd

How To Write A Test Engine For A Microsoft Microsoft Web Browser (Php) For A Web Browser For A Non-Procedural Reason)

Structural Design Patterns Used in Data Structures Implementation

Embedded Systems Conference April 3-7, San Jose [ESC-447] Safety-Critical Design Techniques for Secure and Reliable Systems

Introducing Formal Methods. Software Engineering and Formal Methods

Embedded/Real-Time Software Development with PathMATE and IBM Rational Systems Developer

DO-178B compliance: turn an overhead expense into a competitive advantage

Umbrello UML Modeller Handbook

Static Analysis and Validation of Composite Behaviors in Composable Behavior Technology

GOAL-BASED INTELLIGENT AGENTS

StaRVOOrS: A Tool for Combined Static and Runtime Verification of Java

SOFTWARE VERIFICATION RESEARCH CENTRE SCHOOL OF INFORMATION TECHNOLOGY THE UNIVERSITY OF QUEENSLAND. Queensland 4072 Australia TECHNICAL REPORT

Object-Oriented Software Specification in Programming Language Design and Implementation

Specification and Analysis of Contracts Lecture 1 Introduction

Glossary of Object Oriented Terms

Computer Programming I

11 November

Safety Verification of the Small Aircraft Transportation System Concept of Operations

MPI-Checker Static Analysis for MPI

Transcription:

Formal Specification and Verification of Avionics Software June 7th, 2006

Outline 1 Introduction Software in the avionics domain Certification requirements Object-oriented technologies 2 Specification 3 Runtime Assertion Checking Verification 4 Wrap-up

Software in the avionics domain Software in the avionics domain Certification requirements Object-oriented technologies Commercial airplanes feature a high degree of computerization. Many onboard computer systems are safety-critical. Navigation and Pilotage Assistance. Engine Control and Breaking Systems. Fly-by-Wire. Airborne software products must be officially certified.

Software in the avionics domain Software in the avionics domain Certification requirements Object-oriented technologies Commercial airplanes feature a high degree of computerization. Many onboard computer systems are safety-critical. Navigation and Pilotage Assistance. Engine Control and Breaking Systems. Fly-by-Wire. Airborne software products must be officially certified.

Software in the avionics domain Software in the avionics domain Certification requirements Object-oriented technologies Commercial airplanes feature a high degree of computerization. Many onboard computer systems are safety-critical. Navigation and Pilotage Assistance. Engine Control and Breaking Systems. Fly-by-Wire. Airborne software products must be officially certified.

Software in the avionics domain Software in the avionics domain Certification requirements Object-oriented technologies Commercial airplanes feature a high degree of computerization. Many onboard computer systems are safety-critical. Navigation and Pilotage Assistance. Engine Control and Breaking Systems. Fly-by-Wire. Airborne software products must be officially certified.

Software in the avionics domain Software in the avionics domain Certification requirements Object-oriented technologies Commercial airplanes feature a high degree of computerization. Many onboard computer systems are safety-critical. Navigation and Pilotage Assistance. Engine Control and Breaking Systems. Fly-by-Wire. Airborne software products must be officially certified.

Software in the avionics domain Software in the avionics domain Certification requirements Object-oriented technologies Commercial airplanes feature a high degree of computerization. Many onboard computer systems are safety-critical. Navigation and Pilotage Assistance. Engine Control and Breaking Systems. Fly-by-Wire. Airborne software products must be officially certified.

RTCA/DO-178B Software in the avionics domain Certification requirements Object-oriented technologies RTCA/DO-178B is the major requirements specification. Software Considerations in Airborne Systems and Equipment Certification. Adopted as an official guideline by the FAA in 1993. Airborne software products must comply with stated objectives. Considers Structured Programming, not Object-Orientation. Objected-oriented technologies (OOT) are much less common in the avionics domain.

RTCA/DO-178B Software in the avionics domain Certification requirements Object-oriented technologies RTCA/DO-178B is the major requirements specification. Software Considerations in Airborne Systems and Equipment Certification. Adopted as an official guideline by the FAA in 1993. Airborne software products must comply with stated objectives. Considers Structured Programming, not Object-Orientation. Objected-oriented technologies (OOT) are much less common in the avionics domain.

Software in the avionics domain Certification requirements Object-oriented technologies Object-Oriented Technology in Aviation OOT is in many respects different from other approaches. For instance... RTCA/DO-178B requires the elimination of unused code. Polymorphism and dynamic dispatch obviously complicate this task. Objectet-Oriented Technology in Aviation-Program (OOTiA) addresses related issues and concerns. Initiated by FAA and NASA in 2001.

Software in the avionics domain Certification requirements Object-oriented technologies Object-Oriented Technology in Aviation OOT is in many respects different from other approaches. For instance... RTCA/DO-178B requires the elimination of unused code. Polymorphism and dynamic dispatch obviously complicate this task. Objectet-Oriented Technology in Aviation-Program (OOTiA) addresses related issues and concerns. Initiated by FAA and NASA in 2001.

Software in the avionics domain Certification requirements Object-oriented technologies Object-Oriented Technology in Aviation OOT is in many respects different from other approaches. For instance... RTCA/DO-178B requires the elimination of unused code. Polymorphism and dynamic dispatch obviously complicate this task. Objectet-Oriented Technology in Aviation-Program (OOTiA) addresses related issues and concerns. Initiated by FAA and NASA in 2001.

Elements of OOTiA Software in the avionics domain Certification requirements Object-oriented technologies Considerations and recommended techniques were compiled in a preliminary handbook. The major issues include: Subtypes and Subclasses Memory Management Dead and Deactivated Code

Elements of OOTiA Software in the avionics domain Certification requirements Object-oriented technologies Considerations and recommended techniques were compiled in a preliminary handbook. The major issues include: Subtypes and Subclasses Memory Management Dead and Deactivated Code

Elements of OOTiA Software in the avionics domain Certification requirements Object-oriented technologies Considerations and recommended techniques were compiled in a preliminary handbook. The major issues include: Subtypes and Subclasses Memory Management Dead and Deactivated Code The OOTiA-Handbook repeatedly mentions Design by Contract and Formal Methods as suggested methodologies for software development in the avionics domain.

Specification A Flight Manager is part of the onboard navigational equipment. A major task is the computation of trajectories. Must comply with air traffic rules. Has to consider the aircraft s agility. Should be efficient and economic. Further constraints. A reliable operation is critical for a safe flight. A failure is considered hazardous by RTCA/DO-178B (2nd highest category).

Specification A Flight Manager is part of the onboard navigational equipment. A major task is the computation of trajectories. Must comply with air traffic rules. Has to consider the aircraft s agility. Should be efficient and economic. Further constraints. A reliable operation is critical for a safe flight. A failure is considered hazardous by RTCA/DO-178B (2nd highest category).

Specification A Flight Manager is part of the onboard navigational equipment. A major task is the computation of trajectories. Must comply with air traffic rules. Has to consider the aircraft s agility. Should be efficient and economic. Further constraints. A reliable operation is critical for a safe flight. A failure is considered hazardous by RTCA/DO-178B (2nd highest category).

Specification Developed by Thales Avionics in Toulouse. For research purposes: Rapid prototyping of new features. Investigation of OOT-related risks and benefits. Java in the avionics domain. The lateral module is subject to the formal specification. About 70 classes. Major phenomena have been specified.

Specification Developed by Thales Avionics in Toulouse. For research purposes: Rapid prototyping of new features. Investigation of OOT-related risks and benefits. Java in the avionics domain. The lateral module is subject to the formal specification. About 70 classes. Major phenomena have been specified.

Specification Developed by Thales Avionics in Toulouse. For research purposes: Rapid prototyping of new features. Investigation of OOT-related risks and benefits. Java in the avionics domain. The lateral module is subject to the formal specification. About 70 classes. Major phenomena have been specified.

The lateral module Specification Computes the lateral part of a trajectory. The trajectory construction is done in three subsequent steps: Stage 1: A loose set of legs. Stage 2: Fixed positions connected by straight lines. Stage 3: The final trajectory.

The lateral module Specification Computes the lateral part of a trajectory. The trajectory construction is done in three subsequent steps: Stage 1: A loose set of legs. Stage 2: Fixed positions connected by straight lines. Stage 3: The final trajectory.

The lateral module Specification Computes the lateral part of a trajectory. The trajectory construction is done in three subsequent steps: Stage 1: A loose set of legs. Stage 2: Fixed positions connected by straight lines. Stage 3: The final trajectory.

The lateral module Specification Computes the lateral part of a trajectory. The trajectory construction is done in three subsequent steps: Stage 1: A loose set of legs. Stage 2: Fixed positions connected by straight lines. Stage 3: The final trajectory.

The lateral module Specification Computes the lateral part of a trajectory. The trajectory construction is done in three subsequent steps: Stage 1: A loose set of legs. Stage 2: Fixed positions connected by straight lines. Stage 3: The final trajectory.

The Specification Specification The specification is usually model-based. Contracts are based on abstract model. Well supported by model fields in JML. It refrains from using JML s specification library. Java types are usually sufficient. Heavy burden for verification. Emphasis on invariants instead of contracts. Reflect characteristics of entity. Some benefits Formal specs convey an unambigous description. Enforce reflections on a system s characteristics. Provide access for CASE tools.

The Specification Specification The specification is usually model-based. Contracts are based on abstract model. Well supported by model fields in JML. It refrains from using JML s specification library. Java types are usually sufficient. Heavy burden for verification. Emphasis on invariants instead of contracts. Reflect characteristics of entity. Some benefits Formal specs convey an unambigous description. Enforce reflections on a system s characteristics. Provide access for CASE tools.

The Specification Specification The specification is usually model-based. Contracts are based on abstract model. Well supported by model fields in JML. It refrains from using JML s specification library. Java types are usually sufficient. Heavy burden for verification. Emphasis on invariants instead of contracts. Reflect characteristics of entity. Some benefits Formal specs convey an unambigous description. Enforce reflections on a system s characteristics. Provide access for CASE tools.

The Specification Specification The specification is usually model-based. Contracts are based on abstract model. Well supported by model fields in JML. It refrains from using JML s specification library. Java types are usually sufficient. Heavy burden for verification. Emphasis on invariants instead of contracts. Reflect characteristics of entity. Some benefits Formal specs convey an unambigous description. Enforce reflections on a system s characteristics. Provide access for CASE tools.

Example I: A Leg Transition Specification Model fields Fix specpivotfix ; Fix specturnstart ; Fix specturnend ; Fix speccirclecenter ; double specangular Distance ;... Invariants specdirection = speclogicaldirection = specturnstart specpivotfix fp specbearingtofix specdirection speclogicaldirection = specturnstart specpivotfix fp (specbearingtofix + 180) 360 specturnstart specpivotfix fp spectad...

Example I: A Leg Transition Specification Model fields Fix specpivotfix ; Fix specturnstart ; Fix specturnend ; Fix speccirclecenter ; double specangular Distance ;... Invariants specdirection = speclogicaldirection = specturnstart specpivotfix fp specbearingtofix specdirection speclogicaldirection = specturnstart specpivotfix fp (specbearingtofix + 180) 360 specturnstart specpivotfix fp spectad...

Example I: A Leg Transition Specification Model fields Fix specpivotfix ; Fix specturnstart ; Fix specturnend ; Fix speccirclecenter ; double specangular Distance ;... Invariants specdirection = speclogicaldirection = specturnstart specpivotfix fp specbearingtofix specdirection speclogicaldirection = specturnstart specpivotfix fp (specbearingtofix + 180) 360 specturnstart specpivotfix fp spectad...

The first invariant in JML Specification public instance invariant ( specdirection == speclogicaldirection ) == > Cmp. appreq ( BasicGeo. computebd ( specturnstart. speclatitude, specturnstart. speclongitude, specpivotfix. speclatitude, specpivotfix. speclongitude )[0], specbearingtofix ); JML-Specs are often lenghty and verbose. Difficult to comprehend and maintain. Facilitates introduction of errors. Leads to programming-style specifications. Many typecasts. Numerous method calls.

The first invariant in JML Specification public instance invariant ( specdirection == speclogicaldirection ) == > Cmp. appreq ( BasicGeo. computebd ( specturnstart. speclatitude, specturnstart. speclongitude, specpivotfix. speclatitude, specpivotfix. speclongitude )[0], specbearingtofix ); JML-Specs are often lenghty and verbose. Difficult to comprehend and maintain. Facilitates introduction of errors. Leads to programming-style specifications. Many typecasts. Numerous method calls.

Example II: A double-linked tree Specification Used as a hierarchic route representation. Properties of the tree should be expressed by invariants. For each node must hold: The parent reference of all children must point to this. If there is a parent node, it must have a child reference to this.

Example II: A double-linked tree Specification Used as a hierarchic route representation. Properties of the tree should be expressed by invariants. For each node must hold: The parent reference of all children must point to this. If there is a parent node, it must have a child reference to this.

Problems with these invariants Specification public boolean add (Object o) { ((TreePart)o). setparent(this); return super.add(o); } The atomicity of structural operations cannot be ensured. The use of Object.clone() to clone a node violates the invariants. setparent() and super.add() have both public visibility. Invariants get violated according to JML s Visible State semantics. Invariants hold with KeY s Observable State semantics. Can be fixed through refactoring. Inheritance relation to superclass has to be broken.

Introduction Specification Problems with these invariants Object.clone The atomicity of structural operations cannot be ensured. The use of Object.clone() to clone a node violates the invariants. The first attempt to adjust the cloned object s references breaks the invariant. A clone method can be implemented without Object.clone(). Nevertheless: Visible State semantics too restrictive?

Runtime Assertion Checking Runtime Assertion Checking Verification Runtime Assertion Checking (RAC) allows to test constraints at runtime. The JML-Distribution includes a RAC-Compiler (jmlc). Benefits An easy means to test both the code and the specification. Specification errors are usually quickly detected through tests. Allows a clear separation of code and tests. Tests can be switched off at will to improve performance. No further defensive checks within the code necessary. An additional benefit at no extra cost. If a specification exists, no further effort is necessary. jmlc accepts all legal JML and Java code.

Runtime Assertion Checking Runtime Assertion Checking Verification Runtime Assertion Checking (RAC) allows to test constraints at runtime. The JML-Distribution includes a RAC-Compiler (jmlc). Benefits An easy means to test both the code and the specification. Specification errors are usually quickly detected through tests. Allows a clear separation of code and tests. Tests can be switched off at will to improve performance. No further defensive checks within the code necessary. An additional benefit at no extra cost. If a specification exists, no further effort is necessary. jmlc accepts all legal JML and Java code.

Runtime Assertion Checking Runtime Assertion Checking Verification Runtime Assertion Checking (RAC) allows to test constraints at runtime. The JML-Distribution includes a RAC-Compiler (jmlc). Benefits An easy means to test both the code and the specification. Specification errors are usually quickly detected through tests. Allows a clear separation of code and tests. Tests can be switched off at will to improve performance. No further defensive checks within the code necessary. An additional benefit at no extra cost. If a specification exists, no further effort is necessary. jmlc accepts all legal JML and Java code.

Runtime Assertion Checking Verification Runtime Assertion Checking (2) To consider Poor runtime performance. Not every assertion is executable. RAC tools depart from JML s logic. Runtimes for Route #Legs jmlc (ms) javac (ms) Belfast/Liverpool 5 4493 227 Liverpool/Luton 7 6751 265 Geneva/Nice 18 46412 285 Luton/Paris de Gaulle 24 122126 316 Palma de Mallorce/London 32 216660 397 Luton/Nice 33 309465 370 Liverpool/Nice 34 362443 402 Palma de Mallorca/London 37 391441 413

Runtime Assertion Checking (2) To consider Poor runtime performance. Not every assertion is executable. RAC tools depart from JML s logic. Runtime Assertion Checking Verification Limited executability of quantified expressions. It must be possible to restrict the range to a finite set. Frame conditions are not regarded. Invariant enforcement is limited. Invariants are only checked in the course of a method call.

Runtime Assertion Checking (2) To consider Poor runtime performance. Not every assertion is executable. RAC tools depart from JML s logic. Runtime Assertion Checking Verification The expression a[x] == a[x] for a null field a or an out-of-range value x is: true in JML. causes an assertion error in jmlc.

Verification with KeY Runtime Assertion Checking Verification public boolean add (Object o) { ((TreePart)o). setparent(this); return super.add(o); } Trajectory construction has been partially verified, e.g.: Maintenance of invariants for the tree s add method. The specified behavior of LegFactory.merge- Procedures. Invariants of a double-linked tree. Hold with KeY s Observable State semantics. Two method calls. Method contracts are used. 200 Nodes, 70 Branches.

Verification with KeY Runtime Assertion Checking Verification public static void mergeprocedures(procedure t1, Procedure t2) { MyList l1 = t1.leaveslist(); while (l1.size() > t1index) { l1.remove(t1index); } MyList l2 = t2.leaveslist(); int remainderlength = l2.size() t2index; while (l2.size() > remainderlength) { l2.remove(0); } t1.add(t2); } Trajectory construction has been partially verified, e.g.: Maintenance of invariants for the tree s add method. The specified behavior of LegFactory.merge- Procedures. Concatenates two leg sequences. Truncated at the front and at the back, respectively. Two while-loops. 8950 Nodes, 204 Branches.

Wrap-up Introduction Wrap-up Scepticism towards OOT in the avionics domain. Incertitudes how certification requirements can be met. Formal methods and DBC address OOT-related safety issues. Explicitely suggested by the OOTiA-Handbook. Specification of the JFM indicates benefits and drawbacks. Unambiguous, enforces better design, accessibility to tools,... Verbosity, limited readability, difficult semantics, LSP,... RAC can be used with no extra effort. Although: limitations of current RAC compiler. Formal verification as the ultimate step towards integrity. Elaborate, but well justified for critical parts.

Wrap-up Introduction Wrap-up Scepticism towards OOT in the avionics domain. Incertitudes how certification requirements can be met. Formal methods and DBC address OOT-related safety issues. Explicitely suggested by the OOTiA-Handbook. Specification of the JFM indicates benefits and drawbacks. Unambiguous, enforces better design, accessibility to tools,... Verbosity, limited readability, difficult semantics, LSP,... RAC can be used with no extra effort. Although: limitations of current RAC compiler. Formal verification as the ultimate step towards integrity. Elaborate, but well justified for critical parts.

Wrap-up Introduction Wrap-up Scepticism towards OOT in the avionics domain. Incertitudes how certification requirements can be met. Formal methods and DBC address OOT-related safety issues. Explicitely suggested by the OOTiA-Handbook. Specification of the JFM indicates benefits and drawbacks. Unambiguous, enforces better design, accessibility to tools,... Verbosity, limited readability, difficult semantics, LSP,... RAC can be used with no extra effort. Although: limitations of current RAC compiler. Formal verification as the ultimate step towards integrity. Elaborate, but well justified for critical parts.

Wrap-up Introduction Wrap-up Scepticism towards OOT in the avionics domain. Incertitudes how certification requirements can be met. Formal methods and DBC address OOT-related safety issues. Explicitely suggested by the OOTiA-Handbook. Specification of the JFM indicates benefits and drawbacks. Unambiguous, enforces better design, accessibility to tools,... Verbosity, limited readability, difficult semantics, LSP,... RAC can be used with no extra effort. Although: limitations of current RAC compiler. Formal verification as the ultimate step towards integrity. Elaborate, but well justified for critical parts.

Wrap-up Introduction Wrap-up Scepticism towards OOT in the avionics domain. Incertitudes how certification requirements can be met. Formal methods and DBC address OOT-related safety issues. Explicitely suggested by the OOTiA-Handbook. Specification of the JFM indicates benefits and drawbacks. Unambiguous, enforces better design, accessibility to tools,... Verbosity, limited readability, difficult semantics, LSP,... RAC can be used with no extra effort. Although: limitations of current RAC compiler. Formal verification as the ultimate step towards integrity. Elaborate, but well justified for critical parts.

Thank you! Introduction Wrap-up Any questions?