Timing Analysis of SafetyCritical Automotive Software The AUTOSAFE

  • Slides: 22
Download presentation
Timing Analysis of Safety-Critical Automotive Software: The AUTOSAFE Tool Flow M. Becker 1, S.

Timing Analysis of Safety-Critical Automotive Software: The AUTOSAFE Tool Flow M. Becker 1, S. Mohamed 2, K. Albers 3, P. P. Chakrabarti 2, S. Chakraborty 1, P. Dasgupta 2, S. Dey 2, R. 2 Indian Institute of Technology 1 Technische Universität München, Real-Time Computer Systems (RCS) (IIT) Kharagpur, Computer Science and Engineering (CSE) 4 Tata Research 3 INCHRON Gmb. H 12 -03 -2021 Development and Design Centre (TRDDC) Formal Verification Research Group, IIT Kharagpur 1

Outline q Introduction q Motivation and Goals q AUTOSAFE flow ■ ■ A. From

Outline q Introduction q Motivation and Goals q AUTOSAFE flow ■ ■ A. From High-Level Specification to Task Mapping B. Timing Analysis C. Automata Generation and Formal Verification D. Closing the loop q Example q Conclusion 12 -03 -2021 Formal Verification Research Group, IIT Kharagpur 2

Introduction q Currently: automotive architectures getting complex: ■ Hardware: 50 -100 ECUs, numerous sensors

Introduction q Currently: automotive architectures getting complex: ■ Hardware: 50 -100 ECUs, numerous sensors and actuators, kilometers of cabling, . . . ■ Software: ≈100 M lines of code, many safety-critical functions ■ More functionality, more interfaces, much more software ■ Testing becomes infeasible! ■ How to guarantee that the software is „correct“? 12 -03 -2021 Formal Verification Research Group, IIT Kharagpur 3

Motivation and Goals q Co-design of real-time control – typical design flow ■ Requires

Motivation and Goals q Co-design of real-time control – typical design flow ■ Requires analysis and optimisation skills from multiple disciplines ● Control design ● Real-time analysis ● Formal verification ■ Tool flows in each realm lacks interface points between each other q Goal: To create an interface between multiple disciplines 12 -03 -2021 Formal Verification Research Group, IIT Kharagpur 4

Motivation and Goals q Control design Typical Design Flow ■ Numerous Assumptions High-level Model

Motivation and Goals q Control design Typical Design Flow ■ Numerous Assumptions High-level Model ● Negligible delays ● Computation – Instantaneous, Periodic Control Performance satisfied Code Generation q Formal Verification Execution Time satisfied Low-level Platform Model q Several design iterations needed ■ Design without any analytic backup ■ Hinders Certification Response Time satisfied Implementation Performance not met 12 -03 -2021 q Real-time analysis q A semantic gap exists between highlevel models and their implementation q Goal: To bridge this semantic gap Formal Verification Research Group, IIT Kharagpur 5

AUTOSAFE Flow - Overview High-level Model Performance criteria not satisfied Control Performance satisfied High-level

AUTOSAFE Flow - Overview High-level Model Performance criteria not satisfied Control Performance satisfied High-level Model Code Generation Execution Time satisfied Low-level Platform Model 12 -03 -2021 Performance criteria satisfied Implementation Timing Information Response Time satisfied Formal Verification Research Group, IIT Kharagpur 6

AUTOSAFE Flow 12 -03 -2021 Formal Verification Research Group, IIT Kharagpur 7

AUTOSAFE Flow 12 -03 -2021 Formal Verification Research Group, IIT Kharagpur 7

A. From High-Level Specification to Task Mapping i. High-level specification i. Functional behaviour of

A. From High-Level Specification to Task Mapping i. High-level specification i. Functional behaviour of the system ii. Timing constraints ii. Functional modeling of the system • Tools like MATLAB Simulink iii. Control theoretic analysis i. Generate formal properties (control performance specification) iv. Generate C code v. Modeling system architecture vi. Mapping • Binding of functional parts to the architecture blocks 12 -03 -2021 Formal Verification Research Group, IIT Kharagpur 8

From High-Level Specification to Task Mapping q Example: ABS ■ Performance specification ● Car

From High-Level Specification to Task Mapping q Example: ABS ■ Performance specification ● Car shall stop within a certain distance when the brakes are applied ■ Functional specification ● Regulate brake pressure to keep slip at an optimal value (20%) ■ Timing constraint ● Threshold for fresh or stale sensor data ■ Control theoretic analysis Fig: Anti-lock braking system with distributed sensors and ● Quantify freshness in terms of (m, k)-firm deadline [1] Hamdaoui, Moncef, and Parameswaran Ramanathan. "A dynamic priority assignment technique for streams with ( § m Transactions out of k successive runs meet Computers, IEEE on 44. 12 (1995): 1443 -1451. deadline 12 -03 -2021 Formal Verification Research Group, IIT Kharagpur 9

B. Timing Analysis q. Goal: predict safe upper bound for end-to-end timing of implementation

B. Timing Analysis q. Goal: predict safe upper bound for end-to-end timing of implementation (incl. scheduling, bus arbitration, etc. ) A) task-level timing analysis worst-case execution time per task B) system-level timing analysis compose tasks via shared resources 12 -03 -2021 Formal Verification Research Group, IIT Kharagpur 10

Timing Analysis: Task Level q Scheduling diagrams for each ecu Sensor 1 task t

Timing Analysis: Task Level q Scheduling diagrams for each ecu Sensor 1 task t Sensor 2 task ECU 1 t ECU 2 Bus t Controller ECU 12 -03 -2021 Formal Verification Research Group, IIT Kharagpur 11

Timing Analysis: Task Level (Auto. Gen [5]) • Based on explicit-state model checking •

Timing Analysis: Task Level (Auto. Gen [5]) • Based on explicit-state model checking • Idea: work at source level, allows better abstractions • Problem: differences in control flow between source and binary • „backtranslate“ differences & timing • Slicing and abstraction • Ask MC for timing 7. Timer <= X 8 paths? abstract source w/ timing Model checker no Yes WCET <= X 3. Extract timing 6. Slicing & abstraction w. r. t. timing 3. Extract Control flow source w/ timing 4. compare binary 2. Cross. Compile flow 5. 1. Extract difference Translate source Control flow s Binary flow to WCET estimate source [5] Bokil, Prasad, et al. "Automatic test data generation for c programs. " Third 12 -03 -2021 IEEE International Conference on. Formal Verification Research Group, IIT Kharagpur Secure Software Integration and Reliability Improvement, SSIRI 2009. 12

Timing Analysis: System Level (chron. VAL [6]) • Real-Time Calculus (RTC) [2] • Architectural

Timing Analysis: System Level (chron. VAL [6]) • Real-Time Calculus (RTC) [2] • Architectural nodes: buses, ECUs, etc. • Each node manipulates a stream of incoming tasks • Nodes have capacities according to their policy • Needs WCET service ( l, u) curve ( l, u) ( l’, u’) RTC arrival curve ( l’, u’) bounds for end-to -end delays [2] Samarjit Chakraborty, et al. "A General Framework for Analysing System Properties in Platform-Based Embedded System Designs. " DATE. Vol. 3. 2003. [6] Anssi, Saoussen, et al. "chron. VAL/chron. SIM: A Tool Suite for Timing Verification of Automotive Applications. " Proc. 12 -03 -2021 Formal Verification Research Group, IIT Kharagpur 13

q Abs on architetcure : : RTCs generated αl={(0, 0), (10, 1), (20, 2),

q Abs on architetcure : : RTCs generated αl={(0, 0), (10, 1), (20, 2), . . } αu={(0, 1), (10, 2), (20, 3), . . } Sensor 1 task Sensor 2 αl = {(0, 0), (20, 1), (40, 2), . . } task αu = {(0, 1), (20, 2), (40, 3), . . } ECU 1 ECU 2 Bus αl={(15. 34, 1), (25. 34, 2), (35. 34, 3), . . } αu={(0, 1), (4. 66, 2), (14. 66, 3), . . } αl = {(26. 29, 1, 0), (30. 29, 2, 0), (46. 29, 3, 0), …} αu = {(0, 1), (1. 11, 2), (11. 11, 3), . . } Controller ECU 12 -03 -2021 Formal Verification Research Group, IIT Kharagpur WCRT = 5. 4 BCRT = 1. 11 14

Example: ABS 12 -03 -2021 Formal Verification Research Group, IIT Kharagpur 15

Example: ABS 12 -03 -2021 Formal Verification Research Group, IIT Kharagpur 15

C. Automata Generation and Formal Verification q High-level timed automata model of the system

C. Automata Generation and Formal Verification q High-level timed automata model of the system ■ Event or task generating automata ● Uses system level timing analysis results – RTC curves ■ Task automaton ● Uses task level timing analysis results – WCET ● Tracks task generation, execution and completion ■ Scheduler automaton ● To specify tasks’ scheduling policy ■ Resource automaton ● Models and simulates system architecture ■ Observer automaton ● Quantifies the parameters for verification q Formal verification using UPPAAL [3] Behrmann, Glenn, et al. "UPPAAL 4. 0. " IEEE Third 12 -03 -2021 International Conference on Quantitative Evaluation of System Formal Verification Research Group, IIT Kharagpur 16

C. Automata Generation and Formal Verification q ABS properties q RTC TA q For

C. Automata Generation and Formal Verification q ABS properties q RTC TA q For time threshold = 4 s, the maximum (m, k)-firm tolerance for sensor 1 data = fresh and sensor 2 data = stale is (4, 5) q Timed event Generation satisfying RTC is easier q For time threshold = 6 s, the (m, k)firm tolerance for both sensor data = fresh, does not go below (8, 10) q Formal verification tools available 12 -03 -2021 q Abstractions of the system can be easily represented Formal Verification Research Group, IIT Kharagpur 17

Example: ABS Query: If m is reachable? 12 -03 -2021 Formal Verification Research Group,

Example: ABS Query: If m is reachable? 12 -03 -2021 Formal Verification Research Group, IIT Kharagpur 18

D. Closing the loop q Properties are satisfied ■ Formal guarantee provided by the

D. Closing the loop q Properties are satisfied ■ Formal guarantee provided by the tool flow q Property violations ■ Counterexample trace ● If spurious? § Modify respective RTC curves ■ Re-execute tool flow like CEGAR loop [4] Clarke, Edmund, et al. "Abstraction and counterexample-guided refinement in model checking of hybrid systems. " International Journal of Foundations of Computer Science 14. 04 (2003): 583 -604. 12 -03 -2021 Formal Verification Research Group, IIT Kharagpur 19

Conclusion q AUTOSAFE flow – an integrated approach to system design ■ An interface

Conclusion q AUTOSAFE flow – an integrated approach to system design ■ An interface between different realms ● Control designer species the control law ● Embedded systems engineer comes up with implementation mapping ● Verification engineer checks for target property q Co-design of real-time control made easier q Automating model refinement using CEGAR loop is part of future work 12 -03 -2021 Formal Verification Research Group, IIT Kharagpur 20

References 1. Hamdaoui, Moncef, and Parameswaran Ramanathan. "A dynamic priority assignment technique for streams

References 1. Hamdaoui, Moncef, and Parameswaran Ramanathan. "A dynamic priority assignment technique for streams with (m, k)-firm deadlines. " Computers, IEEE Transactions on 44. 12 (1995): 14431451. 2. Samarjit Chakraborty, Simon Künzli, and Lothar Thiele. "A General Framework for Analysing System Properties in Platform-Based Embedded System Designs. " DATE. Vol. 3. 2003. 3. Behrmann, Glenn, et al. "UPPAAL 4. 0. " IEEE Third International Conference on Quantitative Evaluation of Systems, QEST 2006. 4. Clarke, Edmund, et al. "Abstraction and counterexample-guided refinement in model checking of hybrid systems. " International Journal of Foundations of Computer Science 14. 04 (2003): 583604. 5. Bokil, Prasad, et al. "Automatic test data generation for c programs. " Third IEEE International Conference on Secure Software Integration and Reliability Improvement, SSIRI 2009. 6. Anssi, Saoussen, et al. "chron. VAL/chron. SIM: A Tool Suite for Timing Verification of Automotive 12 -03 -2021 21 Applications. " Proc. Embedded Real-Time Software and Systems, ERTS (2012). Formal Verification Research Group, IIT Kharagpur

THANK YOU !!! Sajid Mohamed sajidm@atdc. iitkgp. ernet. in 12 -03 -2021 Formal Verification

THANK YOU !!! Sajid Mohamed sajidm@atdc. iitkgp. ernet. in 12 -03 -2021 Formal Verification Research Group, IIT Kharagpur 22

FTNC Automotive FTNC Automotive FTNC Automotive FTNC AutomotiveFTNC Automotive FTNC Automotive FTNC Automotive FTNC Automotive
Chapter 6 Computer in SafetyCritical Systems Introduction SafetycriticalChapter 6 Computer in SafetyCritical Systems Introduction Safetycritical
Timing Analysis 11242020 1 Why Timing Analysis timingTiming Analysis 11242020 1 Why Timing Analysis timing
automotive logistics Automotive History 1998 First automotive logisticsautomotive logistics Automotive History 1998 First automotive logistics
automotive logistics Automotive History 1998 First automotive logisticsautomotive logistics Automotive History 1998 First automotive logistics
automotive logistics Automotive History 1998 Erste automotive Logistikaktivittenautomotive logistics Automotive History 1998 Erste automotive Logistikaktivitten
Automotive Batteries Automotive Batteries n WHAT AND AUTOMOTIVEAutomotive Batteries Automotive Batteries n WHAT AND AUTOMOTIVE
Timing Diagram and Communication Diagram TIMING DIAGRAM TimingTiming Diagram and Communication Diagram TIMING DIAGRAM Timing
Timing Diagram and Communication Diagram TIMING DIAGRAM TimingTiming Diagram and Communication Diagram TIMING DIAGRAM Timing
Safety Analysis Lionel Briand 2010 1 Safetycritical SoftwareSafety Analysis Lionel Briand 2010 1 Safetycritical Software
MotoSheets com Sports Timing Scoring Sports Timing SoftwareMotoSheets com Sports Timing Scoring Sports Timing Software
Inspection of SafetyCritical Software Case study Darlington nuclearInspection of SafetyCritical Software Case study Darlington nuclear
Issues on Software Testing for SafetyCritical RealTime AutomationIssues on Software Testing for SafetyCritical RealTime Automation
Requirement Discovery during the Testing of SafetyCritical SoftwareRequirement Discovery during the Testing of SafetyCritical Software
Inspection of SafetyCritical Software Using Program Function TablesInspection of SafetyCritical Software Using Program Function Tables
Timing Analysis and Timing Predictability Reinhard Wilhelm SaarbrckenTiming Analysis and Timing Predictability Reinhard Wilhelm Saarbrcken
Timing Analysis of Keystrokes And Timing Attacks onTiming Analysis of Keystrokes And Timing Attacks on
Introduction to Static Timing Analysis What is timingIntroduction to Static Timing Analysis What is timing
Timing in Networks The delay analysis Timing inTiming in Networks The delay analysis Timing in
Timing Analysis and Timing Predictability Reinhard Wilhelm SaarlandTiming Analysis and Timing Predictability Reinhard Wilhelm Saarland
Timing Analysis timing guarantees for hard realtime systemsTiming Analysis timing guarantees for hard realtime systems