Modelling in an industrial setting Jan Friso Groote

Modelling in an industrial setting. Jan Friso Groote

Silicon wafers for integrated circuits. / Computer science PAGE 1

ASML waferscanners. I am working one day a week at ASML (even more this spring). / Computer science PAGE 2

What is a waferscanner Load path Unload path Measure Vacuum / Computer science PAGE 3 Expose

Some approximate facts about the machines. Number of software components: 2500. Number of lines of code: 50 M. Number of software engineers: 1000. Price per machine: up to 100 Meuro. Failure of the software is highly undesirable. Customers want to have new products as quickly as possible. / Computer science PAGE 4

Model based software engineering. ASD: State based. Data in the form of state and data variables. Code generation. Verification: deadlock freedom, absence of life lock, validity of invariants, initialisation of variables, absence of illegal behaviour, failure trace inclusion of implementation and interfaces. / Computer science PAGE 5

Verum: ASD / computer science Language based version:

Results for ASML Use of formal techniques lead to: - Efficiency up by a factor 2 -3. - Learn in time down by a factor 2 -3. - Quality: the number of problems in the field did go down dramatically. / Computer Science

Results at Philips Healthcare At Philips Healthcare software is developed by staff using formal methods. Is this better? Yes, up to 10 times less bugs, up to 3 times faster. Industry standard 5 -50 bugs/Kloc. Formal techniques 0. 7 bugs/Kloc. Necessary: design for verification. / Computer science PAGE 8

Verification is done by FDR 2/m. CRL 2 Translation ASD FDR 2/m. CRL 2 Result/counterexample Verification of the systems with hundreds of components can be done in minutes. / Computer Science

ASD design philosophy. Interface P Provided interface Design model D Interface R 1 Interface R 2 Proof obligation: D || R 1 || R 2 || R 3 ⊆ P / Computer science PAGE 10 Interface R 3 Required interfaces (weak failure trace inclusion)

Structure of ASD control systems. Upper interface Controlled hardware/software Largest component at ASML: LOPW responsible for wafer/reticle logistics in the machine. Approximately 250 interfaces, 200 design components. 200. 000 rule cases. / Computer Science

Issues: the ‘diamond’ problem. Common component. Verification is only possible if the common component is ‘stateless’. / Computer Science

Issue: end to end properties. On Motor. On If On happens, the action Motor. On will unavoidably occur. [true*·On]μX. [Motor. On]X∧〈true〉true / Computer Science

Issue: model complexity. Typical software complexity reoccur when formal models become big. - Models require documentation. What is the appropriate style? - Which style of modelling leads to maximal verifiability/maintainability? - Model metrics assess the quality of a model. Which metrics are appropriate? / Computer Science

Conclusion. 1. Model based design and verification of behaviour leads to a 10 -fold increase in quality and a 3 -fold increase in development speed. 2. More complex properties on more complex ‘model architectures’ should be verified. 3. The set of models is becoming so large that they spark interest in meta model questions like: - comprehensive documentation of models. - methods to assess the quality of metrics. -. . . / Computer science PAGE 15