CIS 890: Safety-Critical Systems

Transcription

1 CIS 890: Safety-Critical Systems Fall 2007 Lecture 1: Application Areas and SPARK Demo Copyright 2007, John Hatcliff. The syllabus and all lectures for this course are copyrighted materials and may not be used in other course settings outside of Kansas State University in their current form or modified form without the express written permission of one of the copyright holders. During this course, students are prohibited from selling notes to or being paid for taking notes by any person or commercial firm without the express written permission of one of the copyright holders.

2 Course Goals Goals for each student Become competent in the use of SPARK for end to end specification, implementation, and verification of embedded systems Develop end-to-end one medium-sized safety-critical system Learn issues involved in developing certified systems CIS Applications and SPARK Demo 2

3 Application Area Rockwell Collins -- Security Certification (NSA) Rockwell Collins Advanced Technology Center engineers are industry leaders in security certification Multiple successes in certification of real-time operating systems for several leading vendors Multiple contracts from NSA We are funded to supply expertise and tools related to static analysis formalization of compositional information flow specifications We will build public (nonproprietary) versions of the types of systems being developed at Rockwell Collins CIS Applications and SPARK Demo 3

4 Application Area Pace Maker Component Our project will start from the actual specification of a previous generation pacemaker from Boston Scientific Part of a challenge problem within the formal methods community Two aspects Programming / monitoring interface and Embedded code To be programmed in SPARK, following the SPARK INFORMED methodology CIS Applications and SPARK Demo 4

5 Application Area FDA Plug-and-Play Framework Specification and verification of Plugand-Play medical devices using Kiasan (Java, JML) Provided with prototype PnP infrastructure developed by FDA We will help write high level requirements and interface specifications, and check these against the provided implementation Will also specify and checking security properties via our information flow tools Resulting artifacts will be released as an open-source testbed for industry and academic researchers working on PnP medical devices Joint work with engineers at FDA TACTRC Operating Room of The Future (completely reconfigurable PnP environment) Prototype PnP Ultrasound CIS Applications and SPARK Demo 5

6 Implementation Level Specification Implementation level specification & checking plays an important role in developing high-assurance systems Simple pre-condition with existential quantification function FindSought (A: Table; Sought: Integer) return Index; --# pre for some M in Index => ( A(M) = Sought ); --# return Z => (( A(Z) = Sought) and --# (for all M in Index range 1.. (Z - 1) => --# (A(M) /= Sought))); Post-condition constraining return value to inputs using universal quantification SPARK Examiner with Run-time Checker, p. 22 CIS Applications and SPARK Demo 6

7 Implementation Level Specification Implementation level specification & checking plays an important role in developing high-assurance systems procedure Operate; --# global out KeyStore.RotorValue,Encrypted; --# in out KeyStore.SymmetricKey; --# in Clear; --# derives --# KeyStore.SymmetricKey, KeyStore.RotorValue --# from --# KeyStore.SymmetricKey --# & --# Encrypted --# from --# Clear, KeyStore.SymmetricKey --# ; Spark information flow annotations Information flows from Clear, KeyStore.SymmetricKey to Encrypted Enforcing Security and Safety Models with an Information Flow Analysis Tool CIS Applications and SPARK Demo 7

8 Demo CIS Applications and SPARK Demo 8