1. Information Extraction for Real-time Embedded Systems Sebastian Fischmeister University of Waterloo esg.uwaterloo.ca 1

2. Aim of the Talk Provide an overview of the research done within or associated with the project ORF-RE 03-045: “Certification of Safety-critical Software-intensive Systems” Create an opportunity for integrating of research results and collaborating 2

3. Assumptions / Facts Software is where the innovation is happening! Features sell, apps everywhere Software size and complexity is the challenge! 3 Illustrating one root cause: Bridge from Tokyo to Vancouver

4. Assumptions / Facts Computing systems are now beyond deep human comprehension. Evidence: – Software size is growing exponentially – Processor complexity is growing exponentially – 80% of the developer’s time is debugging – We have software with 100M lines of code! 4

5. 100M LOC? Nuclear shutdown system: 40k lines of code F-22 Raptor (‘97): 1.7M lines of code F-35 Joint Strike Fighter (‘06): 5.7M lines of code Boeing 787 (‘09): 6.5M lines of code Current generation limousine: 100M LOC 5 Can we comprehend such software?

6. 6 10 000 dots 100K? 10M?

7. Trying to Understand the Certification Problem Toronto: 2,503,281 Ontario: 13,210,667 USA: 300M 7 You need to ensure that each person is doing the right thing at the right time.

8. PROJECT SAMPLER: REAL-TIME EMBEDDED SOFTWARE GROUP @ UNIVERSITY OF WATERLOO 8

9. Vision: Information Extraction Time aware instrumentation Coverage criterion [RTAS’09, TII] ISA extension [TR] Time-triggered runtime verification Crit. CFG & sampling [FM’11] Mem vs. sampl. tradeoff [RV’11] Time-triggered execution monitoring Markers [LCTES’10] bitvec+ [LCTES’11] Observability in software Super-loop [LCTES’11] Preemptive [OPODIS’11] Debugging, tracing & monitoring framework for RT embedded applications 9 Tagging Basics [TR] Security [TR]

10. Understanding Complex Programs Problem: Can we efficiently trace information flow in a software system? => Tagging Implemented in QNX at the kernel level Applied to tracing, resource scheduling, and security Applicable to testing, monitoring non-functional req. 10 Process Network Tag X

11. Understanding Complex Programs Problem: Can we instrument programs without changing the timing (thus the behaviour)? => time-aware instrumentation Applied to three case studies (OLPC, FS, SNU) Software solution, hardware solution, code dup Useful for tracing, testing, information extraction 11 Instrumented Frequency Execution time Original Deadline X XX

12. Monitoring Complex Programs Problem: Can we engineer run-time monitoring and checking of programs? => TTRV 12 Application Program Observer Monitor Steering Report Observe Eval. properties Time-triggered monitoring & property evaluation Useful for system safety, security, steering, tuning, …

13. Trying to Understand Complex Programs Problem: How do people try to understand software systems? => debugging study 13 Useful to guide future tools Useful to understand developers’ minds Successful debuggers Failing debuggers

14. Conclusions Software systems are hard to understand Software is growing in size and complexity => Developers need support to understand what is going on at run time! We research methods that help developers understand what the software is doing, especially tailored to (real-time) embedded systems. (We also work on benchmarking & real-time networking) (We also host the CFI Real-time Embedded Software Lab) 14

15. Acknowledgements This research was supported in part by industrial partners and the Canadian tax payer! In collaboration with Akramul Azim, Pansy Arafa, Akramul Azim, Shay Berkovich, Borzoo Bonakdarpour, Sina Gholamian, Hany Kashif, Patrick Lam, Samaneh Navabpour, Hiren Patel, Yassir Rizwan, Ahmad Rehman, Johnson Thomas, Mahesh Tripunithara, Augusto Oliveira, Wallace Wu. 15

16. Thanks. Questions? (PS: Postdoc positions available, email me at sfischme@uwaterloo.ca) sfischme@uwaterloo.ca