SAB Meeting, , Bremen

Transcription

1 Lüth, Walter: SAMS 1 SAB Meeting, , Bremen Christoph Lüth, Dennis Walter Deutsches Forschungszentrum für Künstliche Intelligenz, Bremen Sichere Kognitive Systeme SAB Meeting, , Bremen

2 Lüth, Walter: SAMS 2 SAB Meeting, , Bremen Introducing SAMS: Safety Component for Automous Mobile Service Robots Sicherungskomponente für autonome Mobile Serviceroboter Collision avoidance for mobile autonomous robots using safety laser scanner Software formally verified and certified by TÜV Consortium:

3 Lüth, Walter: SAMS 3 SAB Meeting, , Bremen Dynamic Safety Zones State of the Art: Static Safety Zone One size fits all

4 Lüth, Walter: SAMS 3 SAB Meeting, , Bremen Dynamic Safety Zones State of the Art: Static Safety Zone One size fits all Want: Dynamic Safety Zones Indexed by velocity and steering angle

5 Lüth, Walter: SAMS 4 SAB Meeting, , Bremen Novel Aspects Robotics: Certification and Verification Certification: Safety function realised by complex algorithm Comprehensive formal modelling and verification A quite unique combination

6 Eine Kooperation zwischen DFKI-Labor Bremen Leuze lumiex Universität Bremen Documents Dokumentenplan Sicherungskomponente für Autonome Mobile Systeme 15 documents, ca. 200 pages: Planning Requirement Specification Zusammenfassung Der SAMS-Dokumentenplan ist eine Katalogisierung der im Rahmen des Projektes erstellten Dokumente, mit einer Übersicht über Bearbeitungszustand und Version. Concept papers Design specification Projektbezeichnung SAMS Verantwortlich Christoph Lüth Erstellt am Version 1.0 Bearbeitungszustand i. B. Revision 1537 Letzte Änderung Dokumentablage Projektdokumente/Dokumentenplan/dokumentenplan.tex Verification Environment Administrativa Application scenario for FormalSafe Document Plan Lüth, Walter: SAMS 5 SAB Meeting, , Bremen

7 Lüth, Walter: SAMS 6 SAB Meeting, , Bremen New Model for Braking Behaviour s(v,ω) s G (v)

8 Calculation of Safety Zones Lüth, Walter: SAMS 7 SAB Meeting, , Bremen

9 Lüth, Walter: SAMS 8 SAB Meeting, , Bremen Verification framework for C programs Goals: Functional verification of C programs Support for MISRA-C language subset Reduce amount of required testing in certification process Validation by TÜV Süd Simple foundations facilitated validation

10 Lüth, Walter: SAMS 9 SAB Meeting, , Bremen Architecture Annoted source code /*@ \result >= x \result >= y \forall int z >= x && z >= => z >= int max(int x, int y) { if (x > y) return x; else return y; } VCG Parser & static analysis Semantic representation Executable.exe, a.out Generation of verification conditions automatic proofs interactive proofs Domain modelling Isabelle/HOL

11 Lüth, Walter: SAMS 10 SAB Meeting, , Bremen Framework overview Underlying logical framework: Isabelle/HOL Datatypes for language constructs Model of program state Denotational semantics for (supported) C programs Functional specifications as pre-/postconditions Proof rules for automatic verification condition (VC) generation

12 Lüth, Walter: SAMS 11 SAB Meeting, , Bremen The state model BaseLoc 0 Type 0 Val 0,0 Val 0,1 Val 0,2 BaseLoc 1 Type 1 Val 1,0.... BaseLoc n Type n Val n,0 Val n,1 States have type BaseLoc (Type (N Val)) Structures and arrays flattened to sequences of scalars Every global and local object has its own BaseLoc Loc = (BaseLoc N) models addresses.

13 Lüth, Walter: SAMS 12 SAB Meeting, , Bremen Flattened structured values (example) An example structure: lines with cached length struct Pt { int x; int y } struct Line { struct Pt p1; struct Pt p2; double len; } A variable of type struct Line gets represented as Index Types Line Pt int int Pt int int real Values Every location has a unique type Valid pointers for different types cannot be aliased

14 Lüth, Walter: SAMS 13 SAB Meeting, , Bremen Operations on states Functional states read : Loc Σ Val update : Loc Val Σ Σ extend : BaseLoc Σ Σ dealloc : BaseLoc Σ Σ Valid pointers and array access valid ref : Loc Type Σ bool valid idx : Loc int Type Σ bool Structure field access and array indexing rec sel : Loc string Type Loc array acc : Loc int Type Loc

15 Lüth, Walter: SAMS 14 SAB Meeting, , Bremen Semantics Text book denotational semantics Identifies failure and nontermination Partial state transformers sem(cmd) : Γ Σ 1 Σ sem(expr) : Γ Σ Val Σ sem(f (x 1,...,x n )) : Γ Val n Σ Val Σ Array access and pointer validity checks sem( *p )Γ Σ only defined if p points to valid location in Γ,Σ sem( v[i] )Γ Σ only defined if i is valid index for v in Γ,Σ

16 Lüth, Walter: SAMS 15 SAB Meeting, , Bremen Specifications as triples Annotated programs translated to proof triples by front-end Shallow embedding of specifications Total correctness proof triples (+ framing via assignment lists) Verification condition generation with triples Γ stmt [?P vc ] s [Q] P?P vc Γ stmt [P] s [Q] Γ stmt [?P 1 ] s 1 [Q 1 ]... Γ stmt [?P n ] s n [Q n ] Γ stmt [P] s [?Q]

17 Lüth, Walter: SAMS 16 SAB Meeting, , Bremen State update simplification Proof rule for assignments (simplified) Γ expr [P] E [λv S. Q (update (Γ x) v S)] Γ stmt [P] x := E [Q] Leads to VCs containing terms of the form read l 1 (update l 2 v S) (=: t) For l 1 = l 2 we have t = v For l1 l 2 we have t = read l 1 S Two VCs can be generated if aliasing cannot be decided

18 Lüth, Walter: SAMS 17 SAB Meeting, , Bremen Summary Verification tool for use in certification of software Aimed at MISRA-C language subset Facilitated validation of the tool itself Proof calculus for total correctness

19 Thank you for your attention Lüth, Walter: SAMS 18 SAB Meeting, , Bremen