(Nom du fichier) - D1 - 01/03/2000 FTR&D/VERIMAG TAXYS : a tool for the Development and Verification of RT Systems a joint project between France Telecom R&D and VERIMAG E. Closse, M. Poize, J. Pulou, P. Venier, D. Weil (FTR&D) J. Sifakis and S. Yovine (VERIMAG)

La communication de ce document est soumise à autorisation de France Télécom R&D (CAV01 TAXYS) - Daniel Weil – 21/7/2001 FTR&D/VERIMAG TAXYS Goals è Verify Timing Constraints on RT Embedded Software è RT Embedded Software applications with tight energy&memory constraints GSM terminal, Airplanes, Automobiles... Critical Timing constraints : missing inputs or emitting data too late leads to failure Testing system in its real environment is long and difficult è Reduce development time by a priori static analysis model the temporal behavior of the executing code, not of the specification expressing quantitative timing constraints on this code

La communication de ce document est soumise à autorisation de France Télécom R&D (CAV01 TAXYS) - Daniel Weil – 21/7/2001 FTR&D/VERIMAG TAXYS Approach è Synchronous languages + Timed Automata : SAXO-RT ESTEREL Compiler (FTR&D) Finite State Timed Automata OPEN-KRONOS Model Checker (VERIMAG) è TAXYS application = ESTEREL + C self-sequenced code control path : ESTEREL SAXORT ESTEREL compiler efficient code time spent in control path is negligible data path : C C-functions are called by the control path Min & Max Execution Time of each C-function is known (e.g. by profiling,…)

La communication de ce document est soumise à autorisation de France Télécom R&D (CAV01 TAXYS) - Daniel Weil – 21/7/2001 FTR&D/VERIMAG Global Model Environment Application Embedded System Event Handler Throughput constraint : no buffer overflow Deadline constraint : t out – t in < d t in t out

La communication de ce document est soumise à autorisation de France Télécom R&D (CAV01 TAXYS) - Daniel Weil – 21/7/2001 FTR&D/VERIMAG TAXYS Specification è Application Model = ESTEREL + timing pragmas the Embedded Code and its timed model are generated from the same ESTEREL code timing pragmas contains profiling information and deadline constraints è Event Handler Model : C-code a simple FIFO model è Environment Model : ESTEREL + timing pragmas + « npause » non-deterministic timed automata represent all the possible scenarios

La communication de ce document est soumise à autorisation de France Télécom R&D (CAV01 TAXYS) - Daniel Weil – 21/7/2001 FTR&D/VERIMAG A Small Example E A H TATA TBTB Filter F Shared Memory Compute G Actuator Throughput constraint : no buffer overflow Sensor A B tAtA Deadline constraint : t g – t a < d tgtg

La communication de ce document est soumise à autorisation de France Télécom R&D (CAV01 TAXYS) - Daniel Weil – 21/7/2001 FTR&D/VERIMAG ESTEREL Model E A H [ loop npause; emit A; %{# T A c A T A ; c A :=0} end loop || loop npause; emit B; %{# T B c B T B ; c B :=0} end loop ] [ loop await A; call F(); %{cpu(Fmin, Fmax)}% end loop || loop await B ; call G(); %{cpu(Gmin, Gmax)}% end loop ]

La communication de ce document est soumise à autorisation de France Télécom R&D (CAV01 TAXYS) - Daniel Weil – 21/7/2001 FTR&D/VERIMAG Application model E H TATA TBTB [ loop await A; call F(); end loop || loop await B ; call G(); end loop ] F G F G Wait AB A&B tf<cpu<tf cpu:=0 tf<cpu<tf tg<cpu<tg cpu:=0 tg<cpu<tg cpu:=0 %{length tg}% %{length tf}% A

La communication de ce document est soumise à autorisation de France Télécom R&D (CAV01 TAXYS) - Daniel Weil – 21/7/2001 FTR&D/VERIMAG Non-deterministic Environment Model H A Filter F Shared Memory Compute G Actuator [ loop npause; emit A; end loop || loop npause; emit B; end loop ] Wait A! B! T A c A T A ;c A :=0 T B c B T B ;c B :=0 %{# T A c A T A ; c A :=0} %{# T B c B T B ; c B :=0} E

La communication de ce document est soumise à autorisation de France Télécom R&D (CAV01 TAXYS) - Daniel Weil – 21/7/2001 FTR&D/VERIMAG Specifying Deadline Constraints E A H TATA TBTB Filter F Shared Memory Compute G Actuator tAtA Deadline constraint : t G – t A < d tGtG Sensor A B

La communication de ce document est soumise à autorisation de France Télécom R&D (CAV01 TAXYS) - Daniel Weil – 21/7/2001 FTR&D/VERIMAG y 1 :=0 [ loop await A; call F(); end loop || loop await B ; call G(); end loop ] Specifying Deadline Constraints E A! SASA B! S A & S B G(x) H A x 1 :=0 tSAtSA tSBtSB x 2 :=0 F(x) freshness constraint : %{# Y = clock(A) %} %{# Y <d %} x 1 < d x 3 :=0 A!

La communication de ce document est soumise à autorisation de France Télécom R&D (CAV01 TAXYS) - Daniel Weil – 21/7/2001 FTR&D/VERIMAG TAXYS Design Flow counter- example OK constraint violated Application Environment Handler A SAXO-RT ESTEREL Compiler E H Taxys verification module C compiler OPEN- KRONOS Implicit timed automata on-the-fly composition Embedded Code SAXO-RT graphical debugger

La communication de ce document est soumise à autorisation de France Télécom R&D (CAV01 TAXYS) - Daniel Weil – 21/7/2001 FTR&D/VERIMAG Experimental Results è ISDN telephone prototype implemented on a experimental DSP at FTR&D periodic audio data + aperiodic data produced by a graphic tablet è Proof : a buffer of size > 6 is required è No need to simplify application model è more 10 million symbolic states explored è find appropriate environment model approximations preserving verified properties

La communication de ce document est soumise à autorisation de France Télécom R&D (CAV01 TAXYS) - Daniel Weil – 21/7/2001 FTR&D/VERIMAG Conclusion è Seamless Design Flow from specification to embedded code and verification a unified language for specifying application model, environment model and timing constraints : timed ESTEREL no specific knowledge required for the user counter-example replayed at specification level è Verification is trustworthy : embedded code is executed during verification è Scalable tool: on-the-fly techniques : no intermediate state explosion validated industrial-size examples Alcatel GSM application, France Telecom phone prototype On Monday at RV01 : «Timing Analysis and Code Generation of Automated Vehicle Control Software with TAXYS » more than 10 7 symbolic states complexity can reduced by simplifying environment model