Formalization and Correctness of the PALS Architectural Pattern for Distributed Real-Time Systems

Abstract

Abstract. Many Distributed Real-Time Systems (DRTS), such as integrated modular avionics systems and distributed control systems in motor vehicles, are made up of a collection of components communicating asynchronously among themselves and with their environment that must change their state and respond to environment inputs within hard real-time bounds. Such systems are often safety-critical and need to be certified; but their certification is currently very hard due to their distributed nature. The Physically Asynchronous Logically Synchronous (PALS) architectural pattern can greatly reduce the design and verification complexities of achieving virtual synchrony in a DTRS. This work presents a formal specification of PALS as a formal model transformation that maps a synchronous design, together with a set of performance bounds of the underlying infrastructure, to a formal DRTS specification that is semantically equivalent to the synchronous design. This semantic equivalence is proved, showing that the formal verification of temporal logic properties of the DRTS can be reduced to their verification on the much simpler synchronous design. An avionics system case study is used to illustrate the usefulness of PALS for formal verification purposes.

PALS-Based Analysis of an Airplane Multirate Control System in Real-Time Maude

“…that generalizes to multirate systems the original single-rate PALS transformation defined in [9,10]. As before, we have proved in [4] that MA (E , T, Γ) is a correct-by-construction implementation of E , and that E and MA (E , T, Γ) are bisimilar, making it possible to verify temporal logic properties about MA (E , T, Γ) on the much simpler system E .…”

“…Both design and verification of such virtually synchronous distributed real-time systems is very hard because of asynchronous communication, network delays, clock skews, and because the state space explosion caused by the system's concurrency can make it unfeasible to apply model checking to verify required properties. The (single-rate) PALS ("physically asynchronous, logically synchronous") formal design pattern [9,11] reduces the design and verification of a virtually synchronous distributed real-time system to the much simpler task of designing and verifying its synchronous version, provided that the network infrastructure can guarantee bounds on the messaging delays and the skews of the local clocks.…”

“…For these reasons, we and other colleagues at UIUC and Rockwell-Collins Corporation have been developing the physically asynchronous but logically synchronous PALS methodology [9,11], which can drastically reduce the system complexity of a DCPS so as to make it amenable to model checking verification (for a comparison of PALS with related methodologies see [13]). The PALS methodology applies to the frequently occurring case of a DCPS whose implementation must be asynchronous due to physical constraints and for fault-tolerance reasons, but whose logical design requires that the system components should act together in a virtually synchronous way.…”

“…The original PALS methodology presented in [9,11] assumes a single logical period, during which all components of the DCPS must communicate with each other and transition to their next states. However, a DCPS such as a distributed control system may have components that, for physical reasons, must operate with different periods, even though those periods may all divide an overall longer period.…”

Formal Model Engineering for Embedded Systems Using Real-Time Maude

“…In a number of systems targeted by AADL, such as integrated modular avionics systems and distributed control systems in motor vehicles, the system design is essentially a synchronous design that must realized in an asynchronous distributed setting. The key idea of the PALS architectural pattern [16,17] is to reduce the design, verification, and implementation of a distributed real-time system to that of its much simpler synchronous version, provided that the network infrastructure guarantees bounds on the messaging delays and the skews of the local clocks. For a synchronous design SD and network bounds Γ, we then have a semantically equivalent asynchronous distributed design PALS(SD, Γ).…”