Motivations. TCAS Software Verification using Constraint Programming. Agenda. Traffic alert and Collision Avoidance System

Transcription

1 TCS Software Verfcaton usng Constrant Programmng rnaud Gotleb INRI Rennes retagne tlantque CT for TM/TC workshop Dec. th, 008 Motvatons The CVERN project (NR, , part: ILOG, INRI, CE, U. of Nce): To explore the capabltes of Constrant Programmng for utomated Program Testng and Verfcaton We buld a unfed framework (called Euclde) to perform: - test case generaton for structural coverage - counter-example generaton to safety propertes - (partal) program provng for safety-crtcal C programs TCS (Traffc nt-collson vodance System) software s a real-lfe example of safety-crtcal embedded system. Strong requrements n terms of verfcaton. genda Traffc alert and Collson vodance System Motvatons TCS software verfcaton Constrant Programmng approach Expermental results Further work Embedded system on commercal arcrafts Publcly avalable mplementaton for Test and Evaluaton (from the Semens sute) DO-78 Level Statement and decson coverage s mandatory

2 Tcas.c : component that ssues Traffc dvsory and Resoluton dvsory (70 LOC) -4 global varables Own_Track_lt Other_Track_lt Up_Separaton Down_Separaton Postve_R_lt_Tresh - Calls 9 dstnct functons - Nested condtonals, logcal operators, refcatons,.. ut, no loops, no fp, no ponters The alt_sep_test functon nt alt_sep_test() { bool enabled, tcas_equpped, ntent_not_known; bool need_upward_r, need_downward_r; nt alt_sep; enabled = Hgh_Confdence && (Own_Tracked_lt_Rate <= 600) && (Cur_Vertcal_Sep > 600); tcas_equpped = Other_Capablty == ; ntent_not_known = Two_of_Three_Reports_Vald && Other_RC == 0; alt_sep = 0; f (enabled && ((tcas_equpped && ntent_not_known)!tcas_equpped)) { need_upward_r = Non_Crossng_ased_Clmb() && Own_elow_Threat(); need_downward_r = Non_Crossng_ased_Descend() && Own_bove_Threat(); f (need_upward_r && need_downward_r) alt_sep = 0; else f (need_upward_r) alt_sep = ; else f (need_downward_r) alt_sep = ; else alt_sep = 0; return alt_sep; Safety propertes: bt of ant-collson Theory P: Safe advsory selecton P: est advsory selecton P3: vod unnecessary crossng P4: No crossng advsory selecton P5: Optmal advsory selecton (subsumes P and P) : Up_Separaton : Down_Separaton Pa Pb Pa Pb P3a Safety propertes n CSL /*@ behavor Pa : assumes Up_Separaton Postve_R_lt_Tresh && Down_Separaton < Postve_R_lt_Tresh; ensures \result!= need_downward_r; /*@ behavor Pb : assumes Up_Separaton < Postve_R_lt_Tresh && Down_Separaton Postve_R_lt_Tresh; ensures \result!= need_upward_r; /*@ behavor Pa : assumes Up_Separaton < Postve_R_lt_Tresh && Down_Separaton < Postve_R_lt_Tresh ; ensures \result!= need_downward_r; /*@ behavor Pb : assumes Up_Separaton < Postve_R_lt_Tresh && Down_Separaton < Postve_R_lt_Tresh && Up_Separaton < Down_Separaton; ensures \result!= need_upward_r; /*@ behavor P3a : assumes Up_Separaton >= Postve_R_lt_Thresh && Down_Separaton >= Postve_R_lt_Thresh && Own_Tracked_lt > Other_Tracked_lt; ensures \result!=

3 How prove these propertes? genda In practce, manual code revew and testng In Theory: - Hoare Logc (weakest precondton computatons) - Model checkng - bstract Interpretaton-based statc analyss - Constrant-based verfcaton and testng Motvatons TCS software verfcaton Constrant Programmng approach Expermental results Further work Our CP approach constrant model of C functons Constrant generaton Vewng an assgnment statement as a relaton requres to rename the varables Translate the each C functon nto a constrant program P Translate the property nto a constrant S ++; = + Constrant solvng Try to prove that sol( P S) = Statc Sngle ssgnment (SS) form (Cytron et al. TOPLS 99) or sngle assgnment language 3

4 SS form SS form Constrant Program Each use of a varable refers to a sngle defnton Varable declaraton Doman constrant unsgned short ; I x = x + y; y = x y; x = x y; f( ) else = + = ; = ; x = x 0 + y 0 ; y = x y 0 ; x = x y ; f( ) else = ; = ; 3 = Φ(,) ; = 3 + ssgnment, decson rthmetcal constrants {=, <,.. j = j * J = J * I 0 < j I < J Condtonnal (SS) If d then c ; else c ; v 3 =φ(v,v ) ITE(D, C /\ v 3 =v, C /\ v 3 =v ) Functon call (SS) r = f(a) ; SP_CLL(f,, G,, Gn, R) Implemented as global constrants /*@ behavor Pb : Translatng a property nto constrants assumes Up_Separaton < Postve_R_lt_Tresh && Down_Separaton Postve_R_lt_Tresh; ensures \result!= need_upward_r; S = Precondtons Post-relatons Then, S = Precondtons Post-relatons Up_Separaton < Postve_R_lt_Tresh Down_Separaton Postve_R_lt_Tresh R = need_upward_r Constrant solvng sol( P S)? P S s a non-lnear FD constrant problem wth global constrants We develop our own constrant solver based on: - Constrant propagaton + bound-consstency flterng - Lnear Programmng technques over Q Why LP? : capturng lnear global behavour Why Q? : preservng correctness s essental for program verfcaton! Property: If the LP relaxed problem does not contan nteger ponts then the orgnal problem s unsatsfable (but, the converse s false!) synchronous cooperaton of constrant propagaton and smplex over Q through the usage of Dynamc Lnear Relaxatons 4

5 Non-lnear expressons n tcas.c DLR of multplcaton [McCormck 76] Z = X * Y, X n a..b, Y n c..d, Z n e..f Multplcaton Logcal operatons ( z > x+y z < x+y 3 ) refcaton ( z = x > y ) Condtonals (f then else) Dynamc Lnear Relaxatons (DLRs) { Z - Ya Xc +ac 0, Xd Z ad + ay 0, by bc Z + Xc 0, bd by Xd + Z 0, a X b, c Y d, e Z f a d b consequence of (X a)(y c) 0 (X a)(d Y) 0 c DLR of refcaton DLR of ITE( Dec, C,C ) - Global constrant s consdered teratvelly n the constrant store Refcaton assocates a boolean var. to an expresson Z = (X Y) where X n a..b, Y n c..d and Z n 0.. { (X Y) ( -a d)*z 0, (X Y) (b c)*(-z) 0 - Varables of the relaton = nput-output varables of the condtonal - waked when a bound of at least one varable has been pruned - Flterng algorthm (perfomed when awaked): f post(dec C ) fals then DLR( Dec C ) and remove ITE Mn(F(X,Y)) F(X,Y) Max(F(X,Y)) else f post( Dec C ) fals Z = (F(X,Y) 0) then DLR(Dec & C ) and remove ITE else jon_dom(dom, Dom) and jon_poly(qpoly,qpoly ) 5

6 How to mplement jon_poly(qpoly,qpoly ) wth a lnear solver? Convex hull computaton [enoy, Kng, Mesnard TPLP 004] g-m relaxaton + projecton Smplex-based weak_jon operator (from the bstract Interpretaton communty) [Sankaranarayanan et al. VMCI 06] N: ll these computatons are exponental n the number of dmensons n the worst case N: swtchng to the so-called polyhedra «generator representaton» s prohbtve n our context The dsjuncton: Weak_jon: α = Mnmze g ( x) subject to { g ( x)... αp α p +... α g ( x) Mn( α, c ),... g p card ( I ) { g ( x) c { g x c I ( ) I x = ( x,.., xn), where x Ζ = Mnmze g = Mnmze g ( x) subject to = Mnmze g ( x) Mn( α p, c card ( I ) card ( I ) ( x) subject to ( x) subject to card ( I ) ) { g( x) { g ( x) { g ( x) I I I I convex hull computaton convex hull computaton Weak jon (Sankaranarayanan et al. VMCI 06) Weak jon (Sankaranarayanan et al. VMCI 06) 6

7 convex hull computaton convex hull computaton Weak jon (Sankaranarayanan et al. VMCI 06) Weak jon (Sankaranarayanan et al. VMCI 06) - Doesn t requre any Fourer s Elmnaton step! Very good runnng tme on tcas.c, acceptable loss of precson - ut, doesn t commute wth Jon_dom genda Motvatons TCS software verfcaton Jon_poly(Q,Q) Jon_dom(Q,Q) Constrant Programmng approach Expermental results Further work - Doesn t «dscover» new lnear relatons among the two dsjuncts 7

8 C program Preprocessed fle Normalzed code Ponts-to analyss SS form Euclde s archtecture Symbol table Euclde Program Negated property Implemented n SICStus Prolog, SS form generated by an sngle-pass algorthm [rands & Mössenbock 94], clpfd and clpq lbrares. -test data - fal -? Use of the clpfd lbrary for Constrant Propagaton over Fnte Domans Use of the clpq lbrary for Lnear Programmng over Q clpq smple collaboraton prncple post( Mn X, X Max) post( relax(c) ) Smplex calls cuttng planes Solved form of the polyhedron Euclde Mantans coherence throughs DLRs Soluton, fal or tmeout post( X n Mn..Max), post( C ) Propagaton/Search + alarms clpfd Fxponts Frst expermental results nd n the Lterature!!! Intel Core Duo.4GHz clocked PC wth Go of RM uthor sad : Fg. Extracted from «Usng Symbolc Executon for Verfyng Safety-Crtcal Systems» ESEC-FSE 00??? «I thnk that your analyss of P3 s rght. Recently we have redone the TCS experment for a workshop paper (attached for your reference) wth a dfefrent symbolc executor and we found an aerror n that property too.i dd not check your output n detal, but I guess that you bumped n the same error. «8

9 genda Motvatons TCS software verfcaton Constrant Programmng approach Expermental results Further work Fg. Extracted from «Modular Verfcaton of Software Components n C»??? Further work Improvng our weak_jon mplementaton - removng spurous equaltes tmp =, = tmp + adds a dmenson to the polyhedron! - Replacng SICStus clpq lbrary by a verfed LP solver (Qsopt_ex for example [pplegate et al. OR Letters 007]) Thanks you! n effcent global constrant for functon calls: bstractng the relatons due to functon calls (replace the constrants of the callee by a polyhedral abstracton) - Deal wth modular nteger computatons 9