Model checking aircraft controller software: a case study

Abstract

SummaryThis paper documents an application of model checking to formally verify an interrupt‐driven Slats and Flaps Control Unit software programmed in C, one component of a certain type of Chinese aircraft. Our objective was to identify errors rather than to prove correctness. We focused on the correctness of the algorithms used in the buffer operations, which are very common and important in aircraft software. In the verification, a total of four flawed code fragments was identified, including a minor efficiency issue. According to the programming team, this is regarded as a very successful result, and this project is the first successful attempt to apply model checking to the practice of verifying onboard aircraft software in China. Thanks to its completeness and reality, this case study can also serve as a complete and valuable real‐world example for teaching and learning model checking. Copyright © 2013 John Wiley & Sons, Ltd.

Combining type-checking with model-checking for system verification

“…(tail1 -beg1 -tail2) % DATA_FRAME_LENGTH == 0] void = if inline$process_frame (pf_buf | gv_get (pf_read)) then let val () = gv_set (pf_read | gv_get (pf_read) + 8) val tail = gv_get (pf_len) val tail1 = tail -gv_get (pf_read) in if tail1 >= DATA_FRAME_LENGTH then loop (pf_read, pf_len, pf_buf) else let val () = inline$move_data (pf_buf | gv_get (pf_read), tail) val () = gv_set (pf_len | tail1) in end end else let val () = gv_set (pf_read | gv_get (pf_read) + 8) // val () = gv_set (pf_read | gv_get (pf_read) + 8) // (*) val tail = gv_get (pf_len) val tail1 = tail -gv_get (pf_read) in if tail1 >= DATA_FRAME_LENGTH then loop (pf_read, pf_len, pf_buf) else let val () = inline$move_data (pf_buf | gv_get (pf_read), tail) val () = gv_set (pf_len | tail1) in end end val () = gv_set (pf_read | 0) in loop (pf_read, pf_len, pf_buf) end end While it is easy to find the cause of an error via type checking, it is very difficult to diagnose a bug in model checking. In this example, the same error was also found in the previous research (Chen et al, 2015) via model checking. However, the original problem turns into an integer overflow, and is then captured by the model checker as an array out-of-bound subscription error.…”

“…My work is partly motivated by a previous research on verifying an interrupt-driven Slats and Flaps Control Unit Software programmed in C via model checking (Chen et al, 2015). The authors of the paper took part of the C code of the control unit, which had passed the unit testing stage and rewrote it in PROMELA so that model checking techniques can be applied to find slipped faults.…”

Detecting safety‐related components in statecharts through traceability and model slicing

“…The case study is based on the Slats and Flaps Control Unit (SFCU), which is one of the core units in Flight Control Systems. Our previous work focused on the verification of SFCU on code level. In this paper, we focus on model level safety analysis.…”

Model Checking the Convergence Property of BGP Networks

“…In this section, we will give a brief introduction to Promela and LTL. More details could be found in the literature [4] [3]. 1) Promela: A Promela program usually includes data objects, processes and message channels.…”

“…If the properties are not satisfied, it provides a counter example. SPIN [2] [3] is an important model checker which has been widely applied in industrial [4] [5]. It is easy to use the Promela language and linear temporal logic (LTL) formulas to describe concurrent systems and properties respectively.…”