Title: Design, Implementation, and Validation of Embedded Software (DIVES)
1Design, Implementation, and Validation
ofEmbedded Software (DIVES)
Rajeev Alur, Vijay Kumar, Insup Lee (PI), George
Pappas, Oleg Sokolsky Department of Computer and
Information Science Department of Electrical
Engineering Department of Mechanical Engineering
and Applied Mechanics University of
Pennsylvania 30 January 2003
2Topic Area 1. Administrative
3Administrative Information
- Project title Design, Implementation, and
Validation of Embedded Software (DIVES) - PI Insup Lee (215-898-3532, lee_at_cis.upenn.edu)
- Co-PI Rajeev Alur, Vijay Kumar, George Pappas
- Organization University of Pennsylvania
- Contract number DARPA ITO MOBIES
F33615-00-C-1707 - AO Number K230
- Award end date May 16, 2003
- Agent Dale Harper, Air Force Research Laboratory
4DIVES Team
- Faculty
- Rajeev Alur (CIS)
- Vijay Kumar (MEAM)
- Insup Lee (CIS)
- George Pappas (EE)
- Oleg Sokolsky (CIS)
PhD Students Calin Belta Mikhail
Bernadsky Yerang Hur Franjo Ivancic Usa
Sammapun Wenkai Tan
Research Associates Jesung Kim Li Tan Herbert
Tanner
Part-time Programmers Peter Finin Valya
Sokolskaya
5Topic Area 2. Subcontractors and Collaborators
6Collaborators
- CMU-Penn Allenberry Workshop (Jan 9, 2003)
- CMU Krogh, Rajkumar
- Penn Alur, Kumar, Lee, Pappas, Sokolsky
- More than 15 students and postdocs
- Hybrid systems modeling, analysis, simulation,
test generation, code generation techniques - Interactions with HSIF group
- Berkeley, Ford, CMU, Kestrel, GM, SRI, Vanderbilt
7Topic Area 3. Project Goals and Problem
Description
8Project Overview
- Project Objective
- Develop languages, algorithms and tools for
hybrid systems to facilitate the development of
reliable embedded systems - Project Description main research directions
- Compositional semantics to support hierarchical,
modular specifications of hybrid systems - Reachability analysis of embedded systems
- Compositional analysis and optimal controller
synthesis of hybrid systems - Model-based testing and validation of hybrid
systems to provide an additional level of
reliability
9Topic Area 4. Project Status (Update from last PI
Meeting)
10Progress since last meeting
- Progress on schedule
- Recently developed techniques
- Counter-example guided predicate abstraction
- Model-based code generation
- Model-based test generation
- CHARON to HSIF translation
- Publication during last six months
- 5 journal papers, 6 conference and workshop
papers - PhD Theses Ivancic (Aug 03), Hur (Dec 03)
11CHARON Toolkit
- Input
- Hierarchical, Concurrent, Hybrid systems
- Functionality modeling, simulation, assertion
checking, test generation, code generation,
reachability analysis - Output
- Simulation trace including assertion violation
- C code
- HSIF model
- Counter examples
12CHARON toolkit enhancements
- CHARON language version 2
- Inspired by HSIF development
- Supports signals and shared variables directly
- analog/discrete variable type replaced with
signal/shared - Respects signal dependencies
- Changes in the computation of enabled transitions
- Parser, type checker, export/import routines
updated to new version - Updated simulator under construction
13CHARON toolkit enhancements
- Simulator improvements
- Adaptive simulation step-size implemented
- Event detection algorithm implemented
- Improved support for parametric simulations
- Parameters can be external to the model
- Allow parameter modification within the same
model - Reachability analysis enhancements
g(x)
x(t)
Event !
14Publication List
- Selected publications since the last PI meeting
- I. Lee, A. Philippou, O. Sokolsky, "Process
Algebraic Modelling and Analysis of Power-Aware
Real-Time Systems", IEE Computing and Control
Engineering Journal, 13(4), pp. 180-188, August
2002. - Insik Shin, Insup Lee, and Sang Lyul Min,
Embedded System Design Framework for Minimizing
Code Size and Guaranteeing Real-Time
Requirements, Proc. IEEE Real-Time Systems
Symposium, Austin, Dec 2002. - Na Young Lee, Insup Lee, Yerang Hur, Jin Young
Choi, Il Soon Hwang, Seung Rok Oh, A Framework
for the Hybrid Modeling and Analysis of Nuclear
IC Systems, Proceedings of ISOFIC 2002
(International Symposium On the Future IC for
NPP), Seoul, Nov 2002. - R. Fierro, A. Das, J. Spletzer, Y. Hur, R. Alur,
J. Esposito, G. Grudic, V. Kumar, I. Lee, J. P.
Ostrowski, G. Pappas, J. Southall and C. J.
Taylor, A Framework and Architecture for
Multirobot Coordination, Int. Journal of
Robotics Research (IJRR), 2003. - Rajeev Alur, Thao Dang, Joel Esposito, Yerang
Hur, Franjo Ivancic, Vijay Kumar, Insup Lee,
Pradyumna Mishra, George Pappas, and Oleg
Sokolsky, Hierarchical Modeling and Analysis of
Embedded Systems, To appear in Proceedings of
the IEEE, 2003.
15Publication List
- George J. Pappas, Bisimilar Linear Systems,
Automatica. To appear in 2003. - R. Alur, T. Dang, F. Ivancic, Counter-example
guided predicate abstraction for hybrid systems,
TACAS 2003 - R. Alur, T. Dang, F. Ivancic, Progress on
reachability analysis of hybrid systems using
predicate abstraction, HSCC 2003 - R. Alur, La Torre, Madhusudan. Modular
strategies fo recursive game graphs, TACAS 2003 - Oleg Sokolsky, Anna Philippou, Insup Lee, and
Kyriakos Christou, Modeling and Analysis of
Power-Aware Systems, TACAS 2003. - Hyoung Seok Hong, Sung Deok Cha, Insup Lee, Oleg
Sokolsky, Hasan Ural, Data Flow Testing as Model
Checking, Int. Conf. on Software Engineering
(ICSE), May 2003.
16Counter-Example Guided Refinement of Predicate
Abstraction
- Rajeev Alur
- Thao Dang
- Franjo Ivancic
17Overall Structure
Hybrid system
Linear predicates
Charon code
additional predicates
Safety property
Counter-example found!
Property holds
?
Concrete counter- example found
?
18Current Implementation
- We focus on hybrid systems with linear continuous
dynamics, linear guards, linear invariants, and
linear reset expressions. - The continuous dynamics can have uncertain,
bounded input, that is dx/dt Ax Bu, where u
is uncertain input within a bounded range. - We only consider linear predicates.
- Builds on routines for manipulating polyhedra
from d/dt.
193-State Thermostat Example
- 2 variables T (Temperature) and t (timer)
- Initially t 0 , 5 lt T lt 10
- Unsafe Check, T lt 4.5
Heat dT 2 Tlt10,tlt3
t gt 2 -gt t 0
T gt 9
T lt 6 -gt t 0
Check dT-T/2 tlt1
t gt 0.5 -gt t 0
Cool dT-T Tgt5
20Thermostat Abstraction
10 predicates t lt 0 , t gt 0.5, , T gt5 , T
lt 6, Only 36 valid continuous abstract
states
temperature
10
9
6
5
4.5
time
3
0
0.5
1
2
21A Sample Abstract Path
t lt 0 9 lt T lt 10
1 lt t lt 2 9 lt T lt 10
1 lt t lt 2 9 lt T lt 10
35 abstract states reachable. All states are
safe, thus the concrete system is also safe.
0.5 lt t lt 1 9 lt T lt 10
t lt 0 6 lt T lt 9
2 lt t lt 3 9 lt T lt 10
0.5 lt t lt 1 9 lt T lt 10
0.5 lt t lt 1 6 lt T lt 9
t gt 3 5 lt T lt 6
0.5 lt t lt 1 5 lt T lt 6
t lt 0 9 lt T lt 10
t lt 0 5 lt T lt 6
2 lt t lt 3 9 lt T lt 10
22Whats new ?
- A variety of optimizations to speed up the search
- Data structure binary space partition (BSP)
trees - Generalized predicate abstraction
- Vector flow analysis
- Guided search
- Counter-examples in abstract space
- Are they feasible in concrete system?
- Can they be used to derive abstraction
predicates? - Theoretical guarantees of the verification
technique - Completeness?
- Avoiding the same counter example in successive
searches
23Bounded Completeness
- Simulation can show unsafe behavior.
- Safety can only be shown using verification, but
undecidable. - Predicate abstraction introduces errors by
- approximating reachable sets with polyhedra
- coarse abstraction using predicates
- Predicate abstraction can prove bounded safety
- upto n discrete switches
- upto total time flow t
- if reachable set is separated from unsafe set by
Delta
24Guided Search
- Search of the abstract state-space is guided by a
priority function that measures the distance of
abstract states to unsafe states - Several priority functions considered
- Discrete Location Graph Measure
- Locations that are closer get higher priority
- Mask Priority
- Based on boolean vector representation of
predicate values. Fast!!! - Euclidean Distance Measure
- Reset Euclidean Distance Measure
- Accounts for the effect of resets by discrete
transitions
25Generalized Predicate Abstraction
- Cluster certain abstract states
- Reduction of abstract state-space!
- Example Location-specific predicates
- Specify per location which predicates are to be
used in particular location (invariant may be
important only in one location) - Abstract states are now (loc, (TF FFT T))
- Computation of continuous successors is not
affected! - Discrete updates need to consider switch of
predicates
26Binary Space Partition
- Frequent calls to create polyhedra that
correspond to abstract states
P123
P12
P12
P1
P123
P123
P
P1
P123
P
first predicate
P1
P1
second predicate
P12
P12
P12
?
third
P123
P123
P123
P123
P123
?
27Counter-example Analysis Algorithm
- Perform reachability following the path specified
by the counter-example. - For each abstract state si, compute the sub-space
Ri that is concretely reachable.
R0 conc(s0) n Init
s1
s0
for 1 lt i lt n
Ri Post(Ri-1,ti-1)nconc(si)
continuous
if Ri empty
R1
SPURIOUS!
if RnnBad not empty
Init
FEASIBLE!
R0
CPost (R0)
28Rk1 empty
Rk
Pre(sk1)
29Thermostat Example
- Remove predicate t lt 0 from predicate set.
- First run Spurious counter-example is found!
- Separation routine suggest to use 4 predicates
- 0.979265 T 0.202584 t lt 9.34423
- 0.872555 T 0.488515 t lt 8.16961
- 0.428587 T 0.9035 t lt 4.11184
- -0.0680518 T 0.997682 t lt -0.439659
- Second and third run still find counter-examples.
One of 15 suggested predicates - 0.0139043 T 0.999903 t lt 0.152558
- 28 predicates are enough to prove safety in
fourth iteration with 358 reachable states.
30Summary
- Tool applied to V-2-V and ETC
- New V2V will be a good benchmark
- Integrated into HSIF tool chain
- Improving scalability of hybrid systems
verification is ongoing long-term project - Innovations in algorithms
- Engineering of the tool
- Has Mobies made a difference?
- 2000 d/dt about 4 continuous variables (subsets
of R4) - 2003 Charon about 8 continuous variables
(subsets of R8) - Caveat Key to successful application of
verification technology is scaling down of the
problem (zooming to the critical core)
31Generating Embedded Software from Hierarchical
Hybrid Models
- Rajeev Alur
- Franjo Ivancic
- Jesung Kim
- Insup Lee
- Oleg Sokolsky
32Objective
- To design a software tool that generates
platform-specific executable code from a
platform-independent CHARON model - Input CHARON model Platform description
- Output Executable code faithful to the model
33Example Robot dog AIBO
GetUp
Walk
Walk
x
tokenMYTOKEN
UpDown(1)
OnGround
L1
j1
y gt y_lift
token (token1)4
L2
ground
j2
Forward
UpDown(-1)
(x, y)
g_stop
j2 acos(f(x, y))
y
d(x) -v
34Challenges Our Approach
- Discretization of the continuous model
- Fixed step-size simulation
- Validation
- Transition errors
- ?-lookahead agent
- Numerical errors
- Instrumented Hybrid Automata
- Code quality
- Modular C code
- Platform-independent optimization
- Static scheduling
- Platform dependency
- Makefile-like script
35Current Work
- Code validation
- Numerical errors
- Computation / IO delays
- Code optimization
- Platform-independent / platform-specific
- Platform-specific (glue) code generation
- Case study Penn UAV testbed
36Penn UAV Testbed
- Avionics
- CloudCapTechs Piccolo
- Totally user-customizable architecture
- Airframe
- ¼ Scale Piper J-3 Cub 104
- Higher level Control
- Onboard Laptop PC
- CHARON
- G. Pappas
37Topic Area 5. Technology Integration into OEP(s)
38HSIF WG participation
- We actively participated in the HSIF working
group - Syntax development
- Semantics development
- New synchronous semantics proposed and
implemented - Bi-weekly HSIF teleconferences
- Selection and preparation of HSIF examples
39HSIF semantics
- New synchronous semantics developed
- Signals vs. shared variables
- Automata interact by means of signals
- Single-writer property for each signal
- Semantics preserves signal dependencies
- A new signal value is simultaneously observed by
all automata that depend on it - For shared variables dependencies are not
preserved - Multiple writers are allowed
- Having both signals and shared variables allows
us to express both control and computer system
problems.
40CHARON HSIF conversion
- CHARON-to-HSIF converter
- Flattens mode and agent hierarchies
- Each atomic agent becomes an automaton
- The top-level agent becomes the network
- Each atomic mode becomes a location in an
automaton
41CHARON HSIF conversion
- HSIF-to-CHARON converter
- Translates automata into agents
- Translates states into modes
- Produces flat CHARON
Agent1
Agent3
Agent4
Agent2
42Topic Area 6. Project Plans and Capability
Advances
43Project Plans
- Describe your project's plans for next 6 months
- Optimize reachability analysis techniques
- Improve the simulation and analysis tools
- Perform OEP experiments using these techniques
and tools - Refine model-based code generation techniques and
tool implementation - Refine model-based test generation techniques
- Randomization coverage method
- Property-based coverage
- Participate in HSIF development
- Identify specific performance goals
- Demonstrate superior performance of the
counterexample-guided analysis tool on large case
studies - Demonstrate the feasibility of model-based test
generation - Demonstrate the faithfulness of generated code,
both theoretically and in case studies
44Project schedule and milestones
1. Design language
HSIF development
2. Software toolkit
3a. Semantics
3e. Controller synthesis
3f. Abstraction techniques
3g. Code generation
3h. Test generation
3FY00
4FY00
1FY01
2FY01
3FY01
4FY01
1FY02
2FY02
3FY02
4FY02
1FY03
2FY03
Milestone on schedule
Milestone completed ahead of schedule
Deliverable
45Project schedule and milestones
- Past milestones
- Q3FY02 Analysis Techniques and Tool Suite.
Milestone achieved but research and enhancement
continue - Deliverables 2 research reports on abstraction
techniques and analysis algorithms tool
implementation - Q1FY03 Optimal control synthesis. Milestone
achieved but research continues - Deliverables 2 research reports on
input-to-state stability prototype
implementation - Upcoming milestones
- Q2FY03 Model-based generation. Progress on
schedule. Research report available, prototype
implementation for a robot platform - Additional self-imposed milestone algorithms and
tools for test generation. Two research reports
available. Implementation in progress
46Topic Area 7. Technology Transition/Transfer
47Technology Transition
- Use of CHARON and its toolkit
- CARA (Computer Assisted Resuscitation Algorithm)
Infusion pump system developed by WRAIR (Walter
Reid Army Institute for Research) - Design specification, analysis, code generation
- Goal enhance FDA approval process for embedded
medical devices - NIST conformance test suite generation from
metrology interface specifications - Modeling and analysis of biological processes
such as protein transduction (DARPA BioComp
program) - fits the hybrid systems paradigm very well
- enhances state-of-the-art in biological research
with analysis capabilities - Commercialization of bio sketch pad (powered by
Charon)
48The End.