Jiaguang Sun

Design and Optimization of Multiclocked Embedded Systems Using Formal Techniques

Todays system-on-chip and distributed systems are commonly equipped with multiple clocks. The key challenge in designing such systems is that two situations have to be captured and evaluated in a single framework. The first is the heterogeneous control-oriented and data-oriented behaviors within one clock domain, and the second is the asynchronous communications between two clock domains. In this paper, we propose to use timed automata and synchronous dataflow to model the dynamic behaviors of the multiclock train-control system, and a multiprocessor architecture for the implementation from our model to the real system. Data-oriented behaviors are captured by synchronous dataflow, control-oriented behaviors are captured by timed automata, and asynchronous communications of the interclock domain can be modeled as an interface timed automaton or a synchronous dataflow module. The behaviors of synchronous dataflow are interpreted by some equivalent timed automata to maintain the semantic consistency of the mixed model. Then, various functional properties that are important to guarantee the correctness of the system can be simulated and verified within the framework. We apply the framework to the design of a control system described in the standard IEC 61 375 and several bugs are detected. The bugs in the standard have been fixed, and the new version has been implemented and used in the real-world subway communication control system.

Data-Centered Runtime Verification of Wireless Medical Cyber-Physical System

Wireless medical cyber-physical systems are widely adopted in the daily practices of medicine, where huge amounts of data are sampled by the wireless medical devices and sensors, and is passed to the decision support systems (DSSs). Many text-based guidelines have been encoded for work-flow simulation of DSS to automate health care based on those collected data. But for some complex and life-critical diseases, it is highly desirable to automatically rigorously verify some complex temporal properties encoded in those data, which brings new challenges to current simulation-based DSS with limited support of automatical formal verification and real-time data analysis. In this paper, we conduct the first study on applying runtime verification to cooperate with current DSS based on real-time data. Within the proposed technique, a user-friendly domain specific language, named DRTV, is designed to specify vital real-time data sampled by medical devices and temporal properties originated from clinical guidelines. Some interfaces are developed for data acquisition and communication. Then, for medical practice scenarios described in DRTV model, we will automatically generate event sequences and runtime property verifier automata. If a temporal property violates, real-time warnings will be produced by the formal verifier and passed to medical DSS. We have used DRTV to specify different kinds of medical care scenarios and have applied the proposed technique to assist existing wireless medical cyber-physical system. As presented in experiment results, in terms of warning detection, it outperforms the only use of DSS or human inspection, and improves the quality of clinical health care of hospital.

Design of Mixed Synchronous/Asynchronous Systems with Multiple Clocks

Todays distributed systems are commonly equipped with both synchronous and asynchronous components controlled with multiple clocks. The key challenges in designing such systems are (1) how to model multi-clocked local synchronous component, local asynchronous component, and asynchronous communication among components in a single framework. (2) how to ensure the correctness of model, and keep consistency between the model and the implementation of real system. In this paper, we propose a novel computation model named GalsBlock for the design of multi-clocked embedded system with both synchronous and asynchronous components. The computation model consists of several hierarchical compound and atom blocks communicating with data port connections. Each atom block can be refined as parallel mealy automata. The synchronous component can be captured in an atom block with the corresponding local control clock while the asynchronous component in an atom block without clock, and the asynchronous communications can be captured in the data port connections among blocks. The unified operational semantics and formal semantics are defined, which can be used for simulation and verification, respectively. Then, we can generate efficient VHDL code from the validated model, which can be synthesized into the FPGA processor for execution directly. We have developed the graphical modeling, simulation, verification, and code generation toolkit to support the computation model, and applied it in the design of a sub-system used in the real train communication control.

Bayesian-Network-Based Reliability Analysis of PLC Systems

Reliability analysis is an important part of safety critical programmable logic controller (PLC) systems. The complexity of PLC system reliability analysis arises in handling the complex relations among the hardware components and the embedded software. Different embedded software types will lead to different arrangements of hardware executions and different system reliability quantities. In this paper, we propose a novel probabilistic model, called the hybrid relation model (HRM), for the reliability analysis of PLC systems. Its construction is based upon the execution logic of the embedded software and the distribution of the hardware components. We prove the constructed HRM to be a Bayesian network (BN) that captures the execution logic of the embedded software. Then, we map the hardware components to the corresponding HRM nodes and embed the failure probabilities of the hardware components into the well-defined conditional probability distribution tables of the HRM nodes. With the computational mechanism of the BN, the HRM handles the failure probabilities of the hardware components as well as the complex relations caused by the execution logic of the embedded software. Experiment results demonstrate the accuracy of our model.

Use runtime verification to improve the quality of medical care practice

Clinical guidelines and decision support systems (DSS) play an important role in daily practices of medicine. Many textbased guidelines have been encoded for work- ow simulation of DSS to automate health care. During the collaboration with Carle hospital to develop a DSS, we identify that, for some complex and life-critical diseases, it is highly desirable to automatically rigorously verify some complex temporal properties in guidelines, which brings new challenges to current simulation based DSS with limited support of automatical formal verification and real-time data analysis. In this paper, we conduct the first study on applying runtime verification to cooperate with current DSS based on real-time data. Within the proposed technique, a userfriendly domain specific language, named DRTV, is designed to specify vital real-time data sampled by medical devices and temporal properties originated from clinical guidelines. Some interfaces are developed for data acquisition and communication. Then, for medical practice scenarios described in DRTV model, we will automatically generate event sequences and runtime property verifier automata. If a temporal property violates, real-time warnings will be produced by the formal verifier and passed to medical DSS. We have used DRTV to specify different kinds of medical care scenarios, and applied the proposed technique to assist existing DSS. As presented in experiment results, in terms of warning detection, it outperforms the only use of DSS or human inspection, and improves the quality of clinical health care of hospital.

From Stateflow Simulation to Verified Implementation: A Verification Approach and A Real-Time Train Controller Design

Simulink is widely used for model driven development (MDD) of industrial software systems. Typically, the Simulink based development is initiated from Stateflow modeling, followed by simulation, validation and code generation mapped to physical execution platforms. However, recent industrial trends have raised the demands of rigorous verification on safety-critical applications, which is unfortunately challenging for Simulink. In this paper, we present an approach to bridge the Stateflow based model driven development and a well- defined rigorous verification. First, we develop a self- contained toolkit to translate Stateflow model into timed automata, where major advanced modeling features in Stateflow are supported. Taking advantage of the strong verification capability of Uppaal, we can not only find bugs in Stateflow models which are missed by Simulink Design Verifier, but also check more important temporal properties. Next, we customize a runtime verifier for the generated nonintrusive VHDL and C code of Stateflow model for monitoring. The major strength of the customization is the flexibility to collect and analyze runtime properties with a pure software monitor, which opens more opportunities for engineers to achieve high reliability of the target system compared with the traditional act that only relies on Simulink Polyspace. We incorporate these two parts into original Stateflow based MDD seamlessly. In this way, safety-critical properties are both verified at the model level, and at the consistent system implementation level with physical execution environment in consideration. We apply our approach on a train controller design, and the verified implementation is tested and deployed on a real hardware platform.

Uncertain Model and Algorithm for Hardware/Software Partitioning

Embedded systems are becoming increasingly popular due to their widespread applications. Hardware/software partitioning is becoming one of the most crucial steps in the design of embedded systems. The costs and delays of the final results of a design will strongly depend on partitioning. In this paper, we propose an uncertain programming model for partitioning problems. The delay related constraints and the cost related objective are modeled by uncertain variables with uncertainty distributions. We convert the uncertain programming model to a deterministic model and solve the converted model by an efficient heuristic method. We propose a heuristic based on genetic algorithm and simulated annealing to solve the problem near-optimally, even for quite large systems. Experiment results show that the proposed model and algorithm produce quality partitions.

Integrating Evolutionary Computation with Abstraction Refinement for Model Checking

Model checking for large-scale systems is extremely difficult due to the state explosion problem. Creating useful abstractions for model checking task is a challenging problem, often involving many iterations of refinement. In this paper we consider techniques for model checking in the counter example-guided abstraction refinement. The state separation problem is one popular approach in counterexample-guided abstraction refinement, and it poses the main hurdle during the refinement process. To achieve effective minimization of the separation set, we present a novel probabilistic learning approach based on the sample learning technique, evolutionary algorithm, and effective heuristics. We integrate it with the abstraction refinement framework in the VIS model checker. We include experimental results on model checking to compare our new approach to recently published techniques. The benchmark results show that our approach has overall speedup of more than 56 percent against previous techniques. Our work is the first successful integration of evolutionary algorithm and abstraction refinement for model checking.

A New Barrier Certificate for Safety Verification of Hybrid Systems

A barrier certificate is an inductive invariant of functions which can be used to prove the safety property of a hybrid system. Utilizing a barrier certificate has the benefit of avoiding explicit computation of the exact reachable set which is usually not tractable for non-linear hybrid systems. In this paper, we propose a new barrier certificate condition, called Exponential Condition, for the safety verification of semialgebraic hybrid systems. The main important benefit of Exponential Condition is that it has a lower conservativeness than the existing convex conditions and meanwhile it possesses the convexity. On the one hand, a less conservative barrier certificate forms a tighter over-approximation for the reachable set and hence is able to verify critical safety properties. On the other hand, the convexity guarantees its solvability by a semidefinite programming method. Some examples are presented to illustrate the effectiveness and practicality of our method.

Mechanism Design for Finding Experts Using Locally Constructed Social Referral Web

In this work, we address the problem of distributed expert finding using chains of social referrals and profile matching with only local information in online social networks. By assuming that users are selfish, rational, and have privately known cost of participating in the referrals, we design a novel truthful efficient mechanism in which an expert-finding query will be relayed by intermediate users. When receiving a referral request, a participant will locally choose among her neighbors some user to relay the request. In our mechanism, several closely coupled methods are carefully designed to improve the performance of distributed search, including, profile matching, social acquaintance prediction, score function for locally choosing relay neighbors, and budget estimation. We conduct extensive experiments on several data sets of online social networks. The extensive study of our mechanism shows that the success rate of our mechanism is about 90 percent in finding closely matched experts using only local search and limited budget, which significantly improves the previously best rate 20 percent. The overall cost of finding an expert by our truthful mechanism is about 20 percent of the untruthful methods, e.g., the method that always selects high-degree neighbors. The median length of social referral chains is 6 using our localized search decision, which surprisingly matches the well-known small-world phenomenon of global social structures.