Verification of quasi-synchronous systems with Uppaal

Abstract

Modern defense systems are complex distributed software systems implemented over heterogeneous and constantly evolving hardware and software platforms. Distributed agreement protocols are often developed exploiting the fact that their systems are quasi-synchronous, where even though the clocks of the different nodes are not synchronized, they all run at the same rate, or multiples of the same rate, modulo their drift and jitter.This paper describes an effort to provide systems designers and engineers with an intuitive modeling environment that allows them to specify the highlevel architecture and synchronization logic of quasisynchronous systems using widely available systemsengineering notations and tools. To this end, a translator was developed that translates system architectural models specified in a subset of SysML into the Architectural Analysis and Description Language (AADL). Translators were also developed that translate the AADL models into the input language of the Uppaal and Kind model checkers.The Uppaal model checker. supports the modeling, verification, and validation of real-time systems modeled as a network of timed automata. This paper focuses on the challenges encountered in translating from AADL to Uppaal, and illustrates the overall approach with a common avionics example: the Pilot Flying System.

A timeless model for the verification of quasi-periodic distributed systems

“…Bhattacharyya et al [8] and Miller et al [30] present a translator from a subset of SysML, which is a common system architecture modeling language, into the Architectural Analysis and Description Language (AADL). They also provide translators from AADL models into the input language of the UPPAAL [5] and Kind [27] model checkers.…”

Soundness of the quasi-synchronous abstraction

“…These mechanisms do not resolve the problem posed in this paper, since the modeling of transmissions as unit delays and the activations of processes on boolean streams require the total ordering given by a global scalar clock: a synchronous modeling of an asynchronous system. c) Quasi-synchrony: Most existing work on the quasisynchronous abstraction either assumes instantaneous communication [5], [28]-which may be valid in a shared memory model but not a message-passing one-or takes the discrete model as given and applies it directly to model and analyze systems [19], [20], [32]. We seek to clarify the original definitions [6] and to precisely define the relation between the real-time and discrete-time models.…”

“…A finite state scheduler that produces valid sequences is readily constructed from the given regular expression (using, for instance, the reglo tool [29]). The processes and unit delays can be modeled directly in Lustre [17], for instance, and verified by modelchecking [5], [19], [20], [28].…”

Satisfiability modulo relations

“…They have been used in many different areas, such as symbolic execution [43], hardware and software verification [11,16], test data generation [70] and so on. In general, these problems can be encoded as constraint satisfiability problems and query SMT solvers for their satisfiability, and transform back the answers to the original problems.…”

“…The satisfiability relation between I and ϕ is defined inductively as follows: [22], CVC4 [6], Yices2 [25], Boolector [49], and MathSAT [15]. Due to the impressive growth in the performance and scope, SMT solvers have been applied in a wide range of applications including model checking [11,17], test data generation [53], security analysis [29], symbolic execution [52] and so on.…”