Verification support for ARINC‐653‐based avionics software

Abstract

Software model checking consists in applying the most powerful results in formal verification research to programming languages such as C. One general technique to implement this approach is producing a reduced model of the software in order to employ existing and efficient tools, such as SPIN. This paper focusses on the application of this approach to the avionics software constructed on top of the Application Executive Software (APEX) Interface, which is widely employed by manufacturers in the avionics industry. It presents a method to automatically extract PROMELA models from the C source code. In order to close the extracted model during verification, we built a reusable APEX‐specific environment. This APEX environment models the execution engine (i.e. an APEX compliant real‐time operating system) that implements APEX services. In particular, it explains how to deal with aspects such as real‐time and APEX scheduling. Time is modelled in such a way that the we save time and memory by avoiding the analysis of irrelevant steps. This model of time and the construction of a deterministic scheduler guarantees the scalability of our approach. The paper also presents a tool that can verify realistic applications, and that has been used as a novel testing method to ensure the correctness of our APEX environment. This testing method uses SPIN to execute official APEX test cases. Copyright © 2010 John Wiley & Sons, Ltd.

Event-based formalization of safety-critical operating system standards: An experience report on ARINC 653 using Event-B

“…In [8], only an ARINC 653 hierarchical scheduler is modelled with AADL. Works in [7], [16] target not only the ARINC specification but also its verification, where ARINC 653 services are modelled in PROMELA and verified used the SPIN model checker to ensure the correctness of avionics software constructed on top of ARINC 653. Here, the ARINC and the application models, which are extracted from the application's C source code, comprise the complete formal model for verification.…”

“…No. Functionality / Invariant description Partition and process management (1) each process is in one partition (2) if a partition is not in N ORM AL mode, its processes should not in the state of Ready, or Running or Suspend (3) if there are processes of a partition in state of Ready, or Running or Suspend, the partition's mode should be N ORM AL (4) if a partition's mode is N ORM AL, it should have processes (5) if a partition's mode is IDLE, it should not have any process (6) there is at most one Running process in a single core system (7) when a partition is in the COLD ST ART or W ARM ST ART mode, the lock level should be larger than zero (8) if the lock level of a partition is larger than zero, there should be a process in this partition disabled the preemption (9) if there is a process that disabled the preemption of this partition, the lock level of the partition should be larger than zero (10) if the lock level of a partition is zero, the partition should be in the N ORM AL mode (11) if the current process and current partition are valid, the process should be in the partition (12) the validation of current partition implies that the partition's mode is not IDLE (13) the validation of current process implies that the process is running and its partition is in N ORM AL (14) if a process was delayed started, it has a delay time (15) the aperiodic process has the special (infinite) value of period (16) the periodic process has a finite value of period…”

Static and Dynamic Verification of Space Systems Using Asynchronous Observer Agents

“…Therefore, most of them are synchronous, or the synchrony is loosened using a kind of inter-process buffer [ 23 ]. A good example is the verification of Avionic systems in Spin [ 24 ]. For communication, Promela channels are used.…”

DSVerifier-Aided Verification Applied to Attitude Control Software in Unmanned Aerial Vehicles

“…In order to investigate overflow effects in closed-loop dynamics, attitude dynamics should be simulated, considering FWL effects and the system output provided by DSVerifier. The plant employed to analyze impacts regarding overflow and LCO effects is described in (12), which represents roll (φ) and pitch (θ) angle dynamics.…”

“…Formal verification has been applied to avionics embedded software, since the 2000s, due to safety and reliability requirements [12]. Different tools (e.g., SPIN [13], SMV [14], and NuSMV [15]) were used for developing and validating flight control software, such as the NASA's missions Mars Science Laboratory [16] and Deep Space 1 [17], the flight control system FCS 5000 [18], and the military aircraft A-7 [19].…”