David Oglesby

Towards Scalable Verification of Commercial Avionics Software

We describe a model-based approach for the automated verification of avionics systems that has been applied in Honeywell for the certification of complex commercial avionics applications, such as flight controls and engine controls. The approach uses a symbolic analysis framework for MATLAB Simulink models, utilizing range arithmetic to represent both test cases and equivalence-class transformations within a model of behavioral requirements. Backwards search from a set of desired test-case values within the model is combined with forward-directed simulation to resolve constraints and compute values in the visited paths, leading to a set of model-level input/output values that produce the test cases. We also describe a common design flaw that was uncovered in an early design phase by utilizing this approach. We argue that finding such designs flaws is extremely difficult by alternative methods such as directed or random simulations and traditional model checkers. Utilizing our approach, Honeywell has achieved better than 20 speedup on average in certification costs compared to traditional analysis and testing methods, while maintaining scalability on complex real-life problems.

Composable Code Generation for Model-Based Development

Many engineering and application domains, including distributed real-time and embedded (DRE) systems, are increasingly employing a graphical model-based development approach. However, the full potential of this approach has not yet been realized due to the complexity of automatically generating non-standard types of code. In this paper, we present a new framework for generating code that is referred to as composable code generation. Under this framework, code generators are not written as monolithic programs that are separate from their corresponding graphical models as has been the practice in the past. Instead, code generators are composed of modular entity-specific generation routines that are attached directly to modeling entities, their meta-data, or to collections of modeling entities. Code is built up by traversing the model, querying each entity that is encountered for a specific type of code generation routine and then executing each accessed routine. We describe this framework in detail and provide experimental results from a DRE application domain.

Quantifying Error Propagation in Data Flow Models

Model-based design is increasingly applied for the design and certification of flight-critical software. Software verification tools, however, have profound weaknesses in handling errors associated with signal values. Such errors can non-deterministically affect the performance and physical behavior of the cyber-physical system controlled by the software. We describe a scalable method that supports the analysis of signal value errors for applications specified as MATLAB Simulink data flow models. The approach explicitly propagates the errors associated with signal type and range bounds through the model and analyzes the possible effects of the errors on the cyber-physical systems behavior. We demonstrate the run time and scalability of the proposed approach on a set of avionics models developed for a commercial aircraft.