Transformation based communication and clock domain refinement for system design

Various well-established techniques exist for functional safety analysis of safety-critical avionics systems. Most of these techniques are based on informal models and due to this, analysis is often subjective and success is dependent on the skill of the practitioner. Various standards like DO-178B, IEC 61508 etc. that provide guidelines to perform safety analysis also propose formal verification methods as one of the techniques for functional safety analysis. This technique is based on formal models of the system under development and can be applied on requirements, design and code to get assurance of the respective artifact satisfying a wide variety of functional requirements. In this paper, we present a case study of applying formal verification methods for doing safety analysis of requirements of a generic aircraft flight control system. Flight control system is broadly specified in two parts: mode transition logic part specifies which mode the system is in and represents the function performed by the flight control system. In each mode, certain control laws are executed to implement the various flight control functions. We used a particular technique in formal verification namely that of model checking for analysis. The mode transition logic of a generic auto pilot was modeled and verified using three different open source model checking tools-SPIN, NuSMV and SAL.

Objective of this contribution is to present the use of Model-based Systems Engineering within the engineering design community. Based on a differentiation between SE and MBSE, the definition of three core MBSE elements, namely modelling method, modelling language, and modelling tool as well as the three major aspects of a consistent system model (requirements, behaviour, and structure) a structured review is conducted, focussing on the understanding and motivation as well as the modelling of systems. The review includes 93 publications from Design Society library and proceedings of the CIRP Design conferences during the period from 2011 to 2022. The review points out, that there is an increasing application of MBSE within the engineering design community, mainly focussing on architecture definition or combined engineering activities. Only a small portion of works (16 publications) are providing a consistent approach as these publications link all aspects of the system model and consider all three MBSE elements. It can be concluded, that there is a diffuse understanding of MBSE and different motivations are given to apply more formal system models as well as modelling tools.

We present a novel notion of deadlock for synchronization on arbitrary boolean conditions and a sound, fully automatic deadlock analysis. Contrary to other approaches, our analysis aims to detect deadlocks caused by faulty system design, rather than implementation bugs. We analyze synchronization on boolean conditions on the fields of an object instead of targeting specific synchronization primitives. As usual, a deadlock is a circular dependency between multiple tasks. A task depends on a second task if the execution of this second task has a side-effect that makes the blocking guard-condition of the first one evaluate to true. This requires an analysis of the computations in a method beyond syntactic properties and we integrate a logical validity calculus to do so.

Aerospace systems have strict dependability and real-time requirements, as well as a need for flexible resource reallocation and reduced size, weight and power consumption. To cope with these issues, while still maintaining safety and fault containment properties, temporal and spatial partitioning (TSP) principles are employed. In a TSP system, the various onboard functions (avionics, payload) are integrated in a shared computing platform, however being logically separated into partitions. Robust temporal and spatial partitioning means that partitions do not mutually interfere in terms of fulfilment of real-time and addressing space encapsulation requirements. This chapter describes in detail the foundations of an architecture for robust TSP aiming a new generation of spaceborne systems, including advanced dependability and timeliness adaptation control mechanisms. A formal system model which allows verification of integrator-defined system parameters is defined, and a prototype implementation demonstrating the current state of the art is presented.

This paper uses systems thinking techniques and visualizations to describe the purpose and key components of effective safety management systems. The paper identifies the elements, actors, and relationships that compose safety management systems and discusses the importance of the social, organizational, and behavioral dynamics from which safety culture emerges. A formal system model, a systemigram, will illustrate the purpose and multi-dimensionality of a safety management system and a non-linear multi-loop diagram captures the interrelations among its agents and the reinforcing and balancing forces that contribute to system dynamics. Concurrent and paradoxical attributes of safety management systems and safety culture are revealed. The paper concludes by advocating for the application of systems thinking, multidisciplinary technical rigor, strong organizational culture, and finally and perhaps most importantly, a participative approach when optimizing complex systems and system-of-systems for safety.

A Lift Dispatching System (LDS) is a typical real-time system that is highly complicated in design and implementation. This article presents the formal design, specification, and modeling of the LDS system using a denotational mathematics known as Real-Time Process Algebra (RTPA). The conceptual model of the LDS system is introduced as the initial requirements for the system. The architectural model of the LDS system is created using RTPA architectural modeling methodologies and refined by a set of Unified Data Models (UDMs). The static behaviors of the LDS system are specified and refined by a set of Unified Process Models (UPMs) for the lift dispatching and serving processes. The dynamic behaviors of the LDS system are specified and refined by process priority allocation and process deployment models. Based on the formal design models of the LDS system, code can be automatically generated using the RTPA Code Generator (RTPA-CG), or be seamlessly transferred into programs by programmers. The formal models of LDS may not only serve as a formal design paradigm of real-time software systems, but also a test bench of the expressive power and modeling capability of exiting formal methods in software engineering.

This study deals with the formal modeling and verification of reconfigurable discrete event control systems (RDECSs). The behavior of an RDECS is represented by that of control components (CCs) and the communication among them. A new formalism, called Reconfigurable Timed Net Condition/Event Systems (TNCES) (R-TNCES), is proposed for the optimal functional and temporal specification of RDECS, which is defined by a behavior module and a control module. The former is a union of various superposed TNCESs, where TNCES-based CC modules are basic units. The latter is a set of reconfiguration functions dealing with the automatic transformations of these TNCESs in response to errors or user requirements by enabling or disabling CC modules, changing condition signals and/or event signals among them, and also treating the state feasibility before and after reconfigurations. To control the verification complexity of R-TNCES, a layer-by-layer verification method is developed, where the similarities of different TNCESs in the behavior module are considered. The contribution of this original paper is applied to a benchmark production system.

To cope with large data sets, distributed data stores partition their data across servers. However, real-world systems usually do not provide useful transactional semantics for operations accessing multiple partitions due to the delays involved in achieving multi-partition consistency. Read Atomic Multi-Partition (RAMP) transactions have recently been proposed as efficient light-weight multi-partition transactions that guarantee read atomicity: either all updates or no updates of a transaction are visible to other transactions. In this paper we formalize RAMP transactions in rewriting logic and perform model checking verification of key properties using the Maude tool. In particular, we develop detailed formal models---and formally analyze---a number of extensions and optimizations of RAMP that are only briefly mentioned by the RAMP developers.

Context awareness is a computing paradigm that makes applications responsive and adaptive with their environment. Formal modeling and verification of context-aware systems are challenging issues in the development as they are complex and uncertain. In this paper, we propose an approach to use a formal method Event-B to model and verify such systems. First, we specify a context aware system’s components such as context data entities, context rules, context relations by Event-B notions. In the next step, we use the Rodin platform to verify the system’s desired properties such as context constraint preservation. It aims to benefit from natural representation of context awareness concepts in Event-B and proof obligations generated by refinement mechanism to ensure the correctness of systems. We illustrate the use of our approach on a scenario of an Adaptive Cruise Control system.

Formal Modeling and Analysis of Timed Systems

The Unified Modeling Language UML is well-suited for the design of real-time systems. In particular the design of dynamic system behaviors is supported by interaction diagrams and statecharts. Real-time aspects of behaviors can be described by time constraints. The semantics of the UML, however, is non-formal. In order to enable formal design verification, we therefore propose to complement the UML based design by additional formal models which refine UML diagrams to precise formal models. We apply the formal specification technique cTLA which is based on L. Lamport's Temporal Logic of Actions, TLA. In particular cTLA supports modular definitions of process types and the composition of systems from coupled process instances. Since process composition has superposition character each process system has all of the relevant properties of its constituting processes. Therefore mostly small subsystems are sufficient for the verification of system properties and it is not necessary to use complete and complex formal system models. We present this approach by means of an example and also exemplify the formal verification of its hard real-time properties.

Current programming languages and programming models make it easy to create software and hardware systems that fulfill an intended function but also leave such systems open to unintended function and vulnerabilities. Software engineering and code hygiene may make systems incrementally safer, but do not produce the wholesale change necessary for secure systems from the outset. Yet there exists an approach with impressive results: We cite recent examples showing that formal methods, coupled with formally informed digital design, have produced objectively more robust code even beyond the properties directly proven. Though discovery of zero-day vulnerabilities is almost always a surprise and powerful tools like semantic fuzzers can cover a larger search space of vulnerabilities than a developer can conceive of, formal models seem to produce robustness of a higher qualitative order than traditionally developed digital systems. Because the claim is necessarily a qualitative one, we illustrate similar results with an idealized programming language in the form of Boolean networks where we have control of parameters related to stability and adaptability. We argue that verifiability with formal methods is an instance of broader design constraints that promote robustness. We draw analogies to real-world programming models and languages that can be mathematically reasoned about in contrast to ones that are essentially undecidable.

Development processes in various engineering disciplines are incorporating formal models to ensure safety properties of critical systems. The use of these formal models requires to reason about their adequacy, i.e., to validate that a model mirrors the structure of the system sufficiently that properties established for the model indeed carry over to the real system. Model validation itself is non-formal, as adequacy is not a formal (i.e., mathematical) property. Instead it must be carried out by the modeler to justify the modeling to the certification agency or other stakeholders. In this paper we argue that model validation can be seen as a special form of requirements engineering, and that interactive visualization and concepts from requirements traceability can help to advance tool support for formal modeling by lowering the cognitive burden needed for validation. We present the VisualisierbaR tool, which supports the formal modeling of railway operations and describe how it uses interactive visualization and requirements traceability concepts to validate a formal model.

Modern web applications use complex data models and access control rules which lead to data integrity and access control errors. One approach to find such errors is to use formal verification techniques. However, as a first step, most formal verification techniques require extraction of a formal model which is a difficult problem in itself due to dynamic features of modern languages, and it is typically done either manually, or using ad hoc techniques. In this paper, we present a technique called symbolic model extraction for extracting formal data models from web applications. The key ideas of symbolic model extraction are 1) to use the source language interpreter for model extraction, which enables us to handle dynamic features of the language, 2) to use code instrumentation so that execution of each instrumented piece of code returns the formal model that corresponds to that piece of code, 3) to instrument the code dynamically so that the models of methods that are created at runtime can also be extracted, and 4) to execute both sides of branches during instrumented execution so that all program behaviors can be covered in a single instrumented execution. We implemented the symbolic model extraction technique for the Rails framework and used it to extract data and access control models from web applications. Our experiments demonstrate that symbolic model extraction is scalable and extracts formal models that are precise enough to find bugs in real-world applications without reporting too many false positives.

Planning is by far the most important aspect of a DirectAccess deployment project. DirectAccess can be deployed in many different configurations to meet a variety of implementation requirements. Many design decisions and deployment options have implications for security, scalability, performance, client support, and general supportability. There are scenarios in which features are mutually exclusive. Some implementation models may limit future deployment flexibility or prevent additional security features from being enabled. A clear understanding of the implementation goals will help the architect design a solution that is reliable, secure, flexible, and supportable.