Verification of Automotive Control Units

2010

Software implementations of controllers for physical subsystems form the core of many modern safety-critical systems such as aircraft flight control and automotive engine control. A fundamental property of such implementations is stability, the guarantee that the physical plant converges to a desired behavior under the actions of the controller. We present a methodology and a tool to perform automated static analysis of embedded controller code for stability of the controlled physical system.

The use of a plant model for formal verification of industrial controllers makes the formal verification tasks more realistic, because any industrial system is always composed by a controller and a plant. Therefore, if the plant model is not used, there is a part of the system that is not considered. However, if there are some cases where the use of a plant model becomes the formal verification results more realistic and robust there are other cases where it nor always happens. In this paper there are indicated which are the circumstances where it is useful to use, or not, a plant model on formal verification tasks, using model-checking techniques.

2005

The acceptance of formal methods in industry is a challenging task mainly due to difficult learning process and the lack of the tools and methods helping control engineer to interpret the results of formal verification procedure. We model existing source code ofthe controller and controller related information (controller model) along with controlled object (plant model) and verify modeled system by means ofmodel-checking.

Proceedings of the ninth ACM international conference on Embedded software - EMSOFT '11, 2011

Automotive architectures today consist of up to 100 electronic control units (ECUs) that communicate via one or more FlexRay and CAN buses. Multiple control applications-like cruise control, brake control, etc.-are specified as Simulink/Stateflow models, from which code is generated and mapped onto the different ECUs. In addition, scheduling policies and parameters, both for the ECUs and the buses, need to be specified. Code generation/optimization from the Simulink/Stateflow models, task partitioning and mapping decisions, as well as the parameters chosen for the schedulers-all of these impact the execution times and timing behaviour of the control tasks and control messages. These in turn affect control performance, such as stability and steady-/transient-state behaviour. This paper discusses different aspects of this multi-layered design flow and the associated research challenges. The emphasis is on modelbased code generation, analysis, testing and verification of control software for automotive architectures, as well as on architecture or platform configuration to ensure that the required control performance requirements are satisfied.

Proceedings of 5th International Workshop on Parallel and Distributed Real-Time Systems and 3rd Workshop on Object-Oriented Real-Time Systems, 1997

We report on the project "Specification and Verification of Discrete Controllers for Continuous Systems Based on Modular Models and Compositional Analysis". Within this project we aim at developing an automatic verification tool for discrete controllers of technical systems which can be applied to systems of industrial size. To reach this objective we combine two different approaches being used in control theory and computer science. These are the "Timed Condition/Event Systems" (TCESs) and the "Timed Automata" (TAs) formalisms. The state of the project is such that, because of the equivalence of TCESs and TAs we have shown in , it is possible to automatically analyze real-time systems modeled by TCESs with analysis tools developed for TAs. In this paper we describe in detail motivation, goal and state of our project, and illustrate the equivalence of TCESs and TAs.

Lecture Notes in Computer Science, 2019

In the model-based development of controller software, the use of an unverified code generator/transformer may result in introducing unintended bugs in the controller implementation. To assure the correctness of the controller software in the absence of verified code generator/transformer, we develop Linear Controller Verifier (LCV), a tool to verify a linear controller implementation against its original linear controller model. LCV takes as input a Simulink block diagram model and a C code implementation, represents them as linear time-invariant system models respectively, and verifies an input-output equivalence between them. We demonstrate that LCV successfully detects a known bug of a widely used code generator and an unknown bug of a code transformer. We also demonstrate the scalability of LCV and a real-world case study with the controller of a quadrotor system.

Software: Practice and Experience, 2013

This paper documents an application of model checking to formally verify an interrupt-driven Slats and Flaps Control Unit software programmed in C, one component of a certain type of Chinese aircraft. Our objective was to identify errors rather than to prove correctness. We focused on the correctness of the algorithms used in the buffer operations, which are very common and important in aircraft software. In the verification, a total of four flawed code fragments was identified, including a minor efficiency issue. According to the programming team, this is regarded as a very successful result, and this project is the first successful attempt to apply model checking to the practice of verifying onboard aircraft software in China. Thanks to its completeness and reality, this case study can also serve as a complete and valuable real-world example for teaching and learning model checking.

This paper presents a method for the application of model checking, i.e. verifying a finite state system against a given temporal specification, to the problem of generating test inputs. The generated test inputs allow state characterization, i.e. the identification and verification of internal states of the software under test by observation of the input/output behavior only. A test model is derived semiautomatically from a given state based specification and the testing goal is specified in terms of temporal logic. On the basis of these inputs, a model checking tool performs the testing input generation automatically. In consequence, the complexity of our approach is depending on the input model, the testing goal, and the applied model checking algorithm. The presented approach can be adapted with small changes to other model checking tools. It is a capable test generation method, whenever a state based behavioral specification of the software under test exists. Furthermore, it provides a descriptive view on state based testing, which may be beneficial in other contexts, e.g. education and program comprehension.

The modelling process is dedicated to analysing requirements and designing systems in order to formalize text or other representations of requirement specifications. Verification is the qualification process that allows detection or prevention of defects in system design. A great variety of approaches of modelling and verification have been proposed in requirements engineering. Many of them have been widely used in the industry in recent years to. The diversity of techniques is the source of interoperability and portability weaknesses between projects and experts. This can lead to a large number of complex notations and methods that have to be understood. The expertise of many domains while necessary, is not always achievable. The present work focuses on improving the performances of the modelling and the verification processes through the reuse of specific domain knowledge distributed among different similar projects. The methodology is for developing complex real-time control systems.

Tools and Algorithms for the Construction and Analysis of Systems, 2015

Mathworks' Stateflow is a predominant environment for modeling embedded and cyber-physical systems where control software interacts with physical processes. We present Compare-Execute-Check-Engine (C2E2)-a verification tool for continuous and hybrid Stateflow models. It checks bounded time invariant properties of models with nonlinear dynamics, and discrete transitions with guards and resets. C2E2 transforms the model, generates simulations using a validated numerical solver, and then computes reachtube over-approximations with increasing precision. For this last step it uses annotations that have to be added to the model. These annotations are extensions of proof certificates studied in Control Theory and can be automatically obtained for linear dynamics. The C2E2 algorithm is sound and it is guaranteed to terminate if the system is robustly safe (or unsafe) with respect to perturbations of guards and invariants of the model. We present the architecture of C2E2, its workflow, and examples illustrating its potential role in model-based design, verification, and validation. 1 Introduction Cyber-physical systems (CPS) are systems that involve the close interaction between a software controller and a physical plant. The state of the physical plant evolves continuously with time and is often modeled using ordinary differential equations (ODE). The software controller, on the other hand, evolves through discrete steps and these steps influence the evolution of the physical process. This results in a "hybrid" behavior of discrete and continuous steps that makes the formal analysis of these models particularly challenging, so much so, that even models that are mathematically extremely simple are computationally intractable. In addition, many physical plants have complicated continuous dynamics that are described by nonlinear differential equations. Such plants, even without any interaction with a controlling software, are often unamenable to automated analysis. On the other hand, the widespread deployment of CPS in safety critical scenarios like automotives, avionics, and medical devices, have made formal, automated analysis of such systems necessary. This is evident from the extensive activity in the research community [20,19,7]. Given the challenges of formally verifying CPS, the sole analysis technique that is commonly used to analyze nonlinear systems is numerical simulation. However, given the large, uncountable space of behaviors, using numerical simulations