Real-time embedded systems are increasingly applied in safety-critical areas, so guaranteeing the correctness of such systems by means of formal methods becomes particularly important. In this paper, we propose an optimized bounded model checking (BMC)-based formal verification approach for the verification of safety for synchronous-reactive (SR) models, which are often used to design systems with complicated control logic, especially the real-time embedded control systems. This method is based on the tackling of a series of challenging problems including the management of the logical clock, encoding of the contained ports, representation of the data types of ports, descriptions of behaviors of various components in a considered model, and formal consideration of the fixed-point semantics. We have implemented this proposed method in the prototype Ptolemy-Z3, and integrated this tool into the Ptolemy II environment. In addition, the experimental evaluation on 22 SR models has shown that our method performs better than the existing automatic verification method in Ptolemy II.

Ptolemy II is an open-source modeling and simulation tool supporting the design of the concurrent, real-time and embedded systems, particularly those involving heterogeneous mixtures of models of computation. In this paper, we present a bounded model checking (BMC) and k-induction based formal verification approach to Ptolemy II, especially its synchronous reactive (SR) models which are commonly used to design systems with complicated control logic. Compared to the verification of common finite-state based systems, the challenges include the relationship between the “tick in SR models and the step in BMC method, simultaneous actor reaction to an input signal and instantaneous communication between actors through sending messages via ports, and fixed-point semantics associated with tick execution, etc. In addition to tackle these challenges, we also present a BMC encoding approach to most common NonFSMActors in SR, which can be used as a library for similar work such as Lingua Franca. We have implemented a prototype (named as Ptolemy-Z3) and integrated it into the Ptolemy II tool. Experimental results show that Ptolemy-Z3 outperforms the existing tool Ptolemy-NuSMV significantly in formal conversion and verification capability of different types of SR models.

Ptolemy II is an open-source modeling and simulation tool for concurrent, real-time and embedded systems, particularly those involving hierarchical heterogeneity. Synchronous- reactive (SR) model of computation which has been implemented in Ptolemy II is commonly used to design safety-critical systems with complicated control logic. Formally verifying the correctness of hierarchical SR models is of great importance and also challenging due to the formalization of a series of specific features including, e.g., instantaneous communication between actors across the level of hierarchy, the combination of SR’s fixed-point semantic with hierarchical structure, and multiple clocks proceeding at different rates in multiclock SR models. In this paper, we tackle such challenges and propose a bounded model checking (BMC) approach to typical actors commonly used in hierarchical SR models. In addition, we implement the proposed BMC approach to hierarchical SR models in a prototype tool called Ptolemy-Z3, which has been integrated into the Ptolemy II environment. Experimental results show that Ptolemy-Z3 outperforms significantly Ptolemy-NuSMV (a verification tool provided by the Ptolemy II environment) in the verification capability of hierarchical SR models.

We address the problem of analyzing the reachable set of a polynomial nonlinear continuous system by over-approximating the flowpipe of its dynamics. The common approach to tackle this problem is to perform a numerical integration over a given time horizon based on Taylor expansion and interval arithmetic. However, this method results to be very conservative when there is a large difference in speed between trajectories as time progresses. In this paper, we propose to use combinations of barrier functions, which we call piecewise barrier tube (PBT), to over-approximate flowpipe. The basic idea of PBT is that for each segment of a flowpipe, a coarse box which is big enough to contain the segment is constructed using sampled simulation and then in the box we compute by linear programming a set of barrier functions (called barrier tube or BT for short) which work together to form a tube surrounding the flowpipe. The benefit of using PBT is that (1) BT is independent of time and hence can avoid being stretched and deformed by time; and (2) a small number of BTs can form a tight over-approximation for the flowpipe, which means that the computation required to decide whether the BTs intersect the unsafe set can be reduced significantly. We implemented a prototype called PBTS in C++. Experiments on some benchmark systems show that our approach is effective.

In this paper, we present a formal model-driven design approach to establish a safety-assured implementation of multifunction vehicle bus controller (MVBC), which controls the data transmission among the devices of the vehicle. First, the generic models and safety requirements described in International Electrotechnical Commission Standard 61375 are formalized as time automata and timed computation tree logic formulas, respectively. With model checking tool Uppaal, we verify whether or not the constructed timed automata satisfy the formulas and several logic inconsistencies in the original standard are detected and corrected. Then, we apply the code generation tool Times to generate C code from the verified model, which is later synthesized into a real MVBC chip, with some handwriting glue code. Furthermore, the runtime verification tool RMOR is applied on the integrated code, to verify some safety requirements that cannot be formalized on the timed automata. For evaluation, we compare the proposed approach with existing MVBC design methods, such as BeagleBone, Galsblock, and Simulink. Experiments show that more ambiguousness or bugs in the standard are detected during Uppaal verification, and the generated code of Times outperforms the C code generated by others in terms of the synthesized binary code size. The errors in the standard have been confirmed and the resulting MVBC has been deployed in the real train communication network.

In this paper, we propose an approach to automatically compute invariant clusters for nonlinear semialgebraic hybrid systems. An invariant cluster for an ordinary differential equation (ODE) is a multivariate polynomial invariant g(u, x)=0, parametric in u, which can yield an infinite number of concrete invariants by assigning different values to u so that every trajectory of the system can be overapproximated precisely by the intersection of a group of concrete invariants. For semialgebraic systems, which involve ODEs with multivariate polynomial right-hand sides, given a template multivariate polynomial g(u, x), an invariant cluster can be obtained by first computing the remainder of the Lie derivative of g(u,x) divided by g(u, x) and then solving the system of polynomial equations obtained from the coefficients of the remainder. Based on invariant clusters and sum-of-squares (SOS) programming, we present a new method for the safety verification of hybrid systems. Experiments on nonlinear benchmark systems from biology and control theory show that our approach is efficient.

Simulink is widely used for model driven development (MDD) of industrial software systems. Typically, the Simulink based development is initiated from Stateflow modeling, followed by simulation, validation and code generation mapped to physical execution platforms. However, recent industrial trends have raised the demands of rigorous verification on safety-critical applications, which is unfortunately challenging for Simulink. In this paper, we present an approach to bridge the Stateflow based model driven development and a well- defined rigorous verification. First, we develop a self- contained toolkit to translate Stateflow model into timed automata, where major advanced modeling features in Stateflow are supported. Taking advantage of the strong verification capability of Uppaal, we can not only find bugs in Stateflow models which are missed by Simulink Design Verifier, but also check more important temporal properties. Next, we customize a runtime verifier for the generated nonintrusive VHDL and C code of Stateflow model for monitoring. The major strength of the customization is the flexibility to collect and analyze runtime properties with a pure software monitor, which opens more opportunities for engineers to achieve high reliability of the target system compared with the traditional act that only relies on Simulink Polyspace. We incorporate these two parts into original Stateflow based MDD seamlessly. In this way, safety-critical properties are both verified at the model level, and at the consistent system implementation level with physical execution environment in consideration. We apply our approach on a train controller design, and the verified implementation is tested and deployed on a real hardware platform.

A barrier certificate is an inductive invariant of functions which can be used to prove the safety property of a hybrid system. Utilizing a barrier certificate has the benefit of avoiding explicit computation of the exact reachable set which is usually not tractable for non-linear hybrid systems. In this paper, we propose a new barrier certificate condition, called Exponential Condition, for the safety verification of semialgebraic hybrid systems. The main important benefit of Exponential Condition is that it has a lower conservativeness than the existing convex conditions and meanwhile it possesses the convexity. On the one hand, a less conservative barrier certificate forms a tighter over-approximation for the reachable set and hence is able to verify critical safety properties. On the other hand, the convexity guarantees its solvability by a semidefinite programming method. Some examples are presented to illustrate the effectiveness and practicality of our method.

Geometric algorithms are widely used in many scientific fields like computer vision, computer graphics. To guarantee the correctness of these algorithms, it's important to apply formal method to them. In this paper, we propose an approach to proving the correctness of geometric algorithms. The main contribution of the paper is that a set of proof decomposition rules is proposed which can help improve the automation of the proof of geometric algorithms. We choose TLA+2, a structural specification and proof language, as our experiment environment. The case study on a classical convex hull algorithm shows the usability of the method.