Compositional Verification of Timed Systems. A Concept. Bengt Jonsson Leonid Mokrushin Xiaochun Shi Wang Yi Uppsala University Sweden Distributed Embedded Systems Workshop , Lorentz Center

Informationsteknologi Institutionen för informationsteknologi | The Problem: Robot Controller ABCD CommandsHigh-level instructions Precise moves Requests Welding program 2.5·10 6 LoC

Informationsteknologi Institutionen för informationsteknologi | Properties of Interest Buffer Overflow/Underflow  component D never stops when welding Sufficient Buffer Sizes Schedulability  components execute tasks on a single CPU Task Response Times (and its reserve) ABCD CommandsHigh-level instructions Precise moves Requests

Informationsteknologi Institutionen för informationsteknologi | Verification Using TA Models System abstraction  TA model Tasks, Scheduler  TA model Properties  TCTL formulae U PPAAL /T IMES : trying to search for bugs in ”all the combinations of local states”: S 1 || S 2 ||... || S m || q 1 || q 2 ||... || q n Very difficult, often impossible

Informationsteknologi Institutionen för informationsteknologi | Stream Transformers System/Component = Stream Transformer Kahn Process Networks [Kahn74] One-way Infinite FIFO Queues Deterministic Model  Queue data is independent of the process firing order A2 A3 A1 Q1 Q eee..e.ee....aa..a...a...bb..b...cc..ccc...dd..d..dd

Informationsteknologi Institutionen för informationsteknologi | Abstract Stream Transformers Network Calculus  Arrival Curves [Recent work, 90s-2005] A2 A3 A1 Q1 Q2 Set of streams

Informationsteknologi Institutionen för informationsteknologi | Abstract Stream t window sizeslide Slide a timed window of a fixed size Count max/min number of events in the window Choose another window etc. t window size events [0,4] [1,5][1,5]

Informationsteknologi Institutionen för informationsteknologi | Arrival Curve # of events window size C L(C)=Set of streams (set of event streams satisfying all bounds for all window sizes) lower bound upper bound

Informationsteknologi Institutionen för informationsteknologi | Modular Analysis (no feedback) A1 System/Component = Arrival Curve Transformer A2A2 Assumption On The Environment The “Maximal Component Capability” Q1 This can be done modularly if there is no feedback We may need a buffer to connect them Comparing the curves we will answer:  if A1 and A2 can “work together”? (all the events generated by A1 will be received and processed by A2)  what is the sufficient size of the buffer?  what is the output curve of A2?

Informationsteknologi Institutionen för informationsteknologi | Transforming Curves Using TA TA Model of a System Component Event Generator Event Observer L(EG) = L(AC) Arrival Curve Departure Curve Verification(s) in UPPAAL inputoutput F

Informationsteknologi Institutionen för informationsteknologi | What About Feedback? We may first assume some input curves e.g. the “worst case” or the “maximum capability” Compute the output curves by approximations Iterate… ABCD

Informationsteknologi Institutionen för informationsteknologi | Resources & Scheduling FPS, priority order: Priority(A)<Priority(B)<Priority(C)<Priority(D) Service Curves  Same as arrival curves but express available resource within windows Service Curve Generators/Observers ABCD 100% <100%

Informationsteknologi Institutionen för informationsteknologi | Putting It All Together Given input data and resource curves 1. Propagate resource to the left Assuming “worst case” for data 2. Propagate “real” data to the right Using pre-computed resources 3. Using new data refine step Using new resource refine step Iterate until it stabilizes (e.g. output/resource) ABCD 100% Input RESOURCE DATA

Informationsteknologi Institutionen för informationsteknologi | Cons & Pros One component at a time (no big product, GALP) Composability analysis (buffers) Possibility to parallelize verification Heterogeneous systems (a potential to combine different formalisms) Preemptive FPS Feedback Bound on max window size EDF Shared resources Precedence constraints