Jean-Luc Béchennec

A Data Flow Monitoring Service Based on Runtime Verification for AUTOSAR

This paper presents the design and implementation of an error detection service for multicore real-time in-vehicle embedded systems. The service aims at monitoring the data flows in a graph of communicating real-time tasks and detecting violation of the expected communication patterns. The service is not based on any specific system model. The monitors are automatically generated from formal models of the monitored system and the expected communication patterns. To minimize the time overhead of the service, the monitors are embedded in the RTOS kernel. The implementation targets an AUTOSAR-like platform based on the open-source RTOS Trampoline. Measures made on an ARM7 MCU show that the time and memory overheads are compatible with the stringent constraints of the application domain.

Hardware runtime verification of embedded software in SoPC

This paper discusses an implementation of runtime verification for embedded software running on a System-on-Programmable-Chip (SoPC) composed of a micro-controller and a FPGA. The goal is to verify at runtime that the execution of the software on the micro-controller conforms to a set of properties. To do so, a minimal instrumentation of the software is used to send events to a set of monitors implemented in the FPGA. These monitors are synthesised from a formal specification of the expected behavior of the system expressed as a set of past-time linear temporal logic (ptLTL) formulas.

WCET Analysis by Model Checking for a Processor with Dynamic Branch Prediction

In this paper, we investigate the case for model checking in the WCET analysis of pipelined processors with dynamic branch and target prediction. We consider a microarchitecture inspired by the e200z4 Power 32-bit architecture, with an instruction cache, a dynamic branch prediction mechanism, a branch target buffer (BTB) and an instruction prefetch buffer. The conjoint operation of all these components produce a very complex behaviour that is difficult to analyse with tight and sound static analysis techniques. We show that model checking techniques can actually be used to compute WCET bounds for this kind of architectures.

Testing real-time embedded software using runtime enforcement

Real-time embedded systems are complex, and as such need to be tested with regards to real-time constraints. However, because of this complexity, some states of the systems can be hard to reach through acting on the input sequence alone, because of seemingly non-deterministic behaviors. In this paper, we introduce a solution based on runtime enforcement which forces a real-time system to reach a chosen state. This can allow for testing of the consequences of reaching this state for the system. Let us consider for example a fault tolerance mechanism that activates when a state of the system is reached. Our solution makes it possible to force the system to consistently reach the state in which the fault tolerance mechanism is started. The solution is based on both an offline analysis and a runtime enforcement step which uses the result of the offline analysis. The runtime enforcement is achieved through the introduction of delays during the execution of the system.

Reactive embedded device driver synthesis using logical timed models

The critical nature of hard real-time embedded systems leads to an increased usage of Model Based Design to generate a correct-by-construction code from a formal specification. If Model Based Design is widely used at application level, most of the low level code, like the device drivers, remains written by hand. Timed Automata are an appropriate formalism to model real time embedded systems but are not easy to use in practice for two reasons i) both hardware and software timings are difficult to obtain, ii) a complex infrastructure is needed for their implementation. This paper introduces an extension of untimed automata with logical time. The new semantics introduces two new types of actions: delayed action which are possibly avoidable, and ineluctable action which will happen eventually. The controller synthesis problem is adapted to this new semantics. This paper focuses specifically on the reachability problem and gives an algorithm to generate a controller.

Device driver synthesis for embedded systems

Currently the development of embedded software managing hardware devices that fulfills industrial constraints (safety, real time constraints) is a very complex task. To allow an increased reusability between projects, generic device drivers have been developed in order to be used in a wide range of applications. Usually the level of gener-icity of such drivers require a lot of configuration code, which is often generated. However, a generic driver requires a lot of configuration and need more computing power and more memory needs than a specific driver. This paper presents a more efficient methodology to solve this issue based on a formal modeling of the device and the application. Starting from this modeling, we use well-known game theory techniques to solve the driver model synthesis problem. The resulting model is then translated into the actual driver embedded code with respect to an implementation model. By isolating the model of the device, we allow more reusability and interoperability between devices for a given application, while generating an application-specific driver.

ReTiS: a real-time simulation platform. Analysis of real-time applications

This paper presents ReTiS, a simulation tool for distributed real-time application analysis. Simulation concerns the operational architecture and takes into account the software (executable code of real-time tasks and real-time operating system) and the hardware (set of processors and networks). In this paper we present two mechanisms. The first enables the tracking of data dependencies across a distributed system. The second permits the detection of task switching and the analysis of a tasks stack (usage and corruption). These mechanisms do not rely on a particular hardware or operating system nor do they require any application or operating system code modification. We show their interest for the analysis of the temporal behaviour of real-time applications in a distributed system.