Formal Methods for the Analysis of Critical Control Systems Models: Combining Non-Linear and Linear Analyses

Abstract

Abstract. Critical control systems are often built as a combination of a control core with safety mechanisms allowing to recover from failures. For example a PID controller used with triplicated inputs and voting. Typically these systems would be designed at the model level in a synchronous language like Lustre or Simulink, and their code automatically generated from these models. We present a new analysis framework combining the analysis of open-loop stable controllers with safety constructs (redundancy, voters, ...). We introduce the basic analysis approaches: abstract interpretation synthesizing quadratic invariants and backward analysis based on quantifier elimination and convex hull computation synthesizing linear invariants. Then we apply it on a simple but representative example that no other available state-of-the-art technique is able to analyze. This contribution is another step towards early use of formal methods for critical embedded software such as the ones of the aerospace industry. Control-Command Software Focused Analyses to Address V&V and Certification NeedsThe aerospace industry is notoriously faced with highly critical issues. The safety of systems should be guaranteed even if the cost of ensuring safety is important. In development costs of the Boeing 777 [8], software accounts for a third of all costs. In this third, 70% consists in verification costs while only 30% are devoted to software development. Other aircraft manufacturers have similar figures. The software specific certification regulatory document, ie. the recently updated DO 178-C, characterizes different levels of criticality from level A -the most critical -to level E -the less critical. Depending on the identified level, verification and validation activities are more or less intensive and therefore costly. This certification document has recently been updated and it also provides a formal methods supplement, identified as RTCA DO 333. This supplement explicitly enables the use of formal methods for critical embedded software.Among the various systems of an aircraft, and their associated software, one of the most critical is the flight control system of the aircraft. Addressing the issue of verifying such specific software seems to be a pertinent goal: proposing 2 A. Champion, R. Delmas, M. Dierkes, P.L. Garoche, P. Roux new ways to validate it could both increase the trust we have in the released software and reduce the cost of V & V by providing more automatic (and exhaustive) analysis means.These reactive system can be seen as the composition of two parts. The first is the computation core itself, achieving the main objective of the software: controlling the aircraft by receiving inputs from sensors and commanding the aircraft actuators. The second part tries to handle any possible failure of sensors or of the core system. This safety architecture is mainly based on information redundancy and fusion. These two parts are usually designed using a model based approach.The approach of control system modeling as proposed by The...

Practical policy iterations

“…5 and relies on numerical optimization to identify appropriate templates. This mostly consists in a more comprehensive exposition of material already presented in previous papers [7,[35][36][37]. The second step, detailed in Sect.…”

Compilation of synchronous observers as code contracts

“…We have applied the toolchain to the verification and compilation of (i) a generic typical sensor voter [11] algorithm used in avionic controllers and (ii) the longitudinal controller of the Transport Class Model (TCM).…”