Emulink: a modelling graphical environment for PVS

Candidate: Enrico D'Urso

Supervisors: Prof. Cinzia Bernardeschi; Prof. Andrea Domenici

In collaboration with Queen Mary University Of London

Outline● Motivation ● Development of Emulink

– The graphical modelling language (Emucharts)

– Model visualisation and animation

● Case study– Demonstration of a software design error in a

commercial medical device

Motivation (1)

Software: first failure cause of computing systems

– 10-200 faults / KLOC created during development

0.01-10 faults / KLOC residual

✔ Proof✔ Model-checking✔ Testing

Motivation (2)

Safety cannot rely only on testing.Testing shows the presence, not the absence of bugs. ( Edsger Wybe Dijkstra )

International safety standards such as IEC 61508 highly recommend the use of formal methods in the development of safety critical or safety related components

Verification based on formal methods tools can significantly reduce the number of design errors

Motivation (3)

Formal methods tools have a steep learning curve– Specialized mathematically based modelling languages

– Complex analysis techniques– Not yet mature for widespread use in industry

Several manufacturers do not use formal verification tools routinely despite of the potential advantages– As a consequence, design errors are usually identified too late in

the design process, or even after system deployment

The focus of this thesis

● Develop a graphical tool to simplify the use of PVS, a state-of-the-art formal verification tool

● PVS (Prototype Verification System)– Part of the NASA Langley Verification Tools

– Extensive libraries of mathematical theories

PVS languagePurely declarative logical language(system: set of functions)

HA : THEORYBEGIN x,y : VAR bool HA(x,y) : [bool, bool] = ((x AND y) , % carry (x XOR y)) % sum % convert Boolean to natural b2n(x) : nat = IF x THEN 1 ELSE 0 ENDIF HA_corr : THEOREM % correctness LET (carry, sum) = HA(x, y) IN b2n(sum) + 2*b2n(carry) = b2n(x) + b2n(y)END HA

The intuition

Software engineers are familiar with graphical modelling languages such as Statecharts.

PVS specifications would be more accessible if they were presented using a graphical language similar to Statecharts

Statecharts: an example

Emulink: a graphical modelling environment for PVS

Graphical modelling tool for emulating statecharts in PVS:– Emucharts (essential subset of Statechart constructs)

– Automatic generation of PVS models

– Animation of PVS models during simulations (useful when debugging PVS models)

– Visualisation of existing annotated PVS models

Emucharts editor

Constructs currently supported

● StatesStates● Transition● Self transition● Default transition● Transition Condition● Transition Action

Constructs currently supported

● States● TransitionTransition● Self transition● Default transition● Transition Condition● Transition Action

Constructs currently supported

● States● Transition● Self transitionSelf transition● Default transition● Transition Condition● Transition Action

Constructs currently supported

● States● Transition● Self transition● Default transitionDefault transition● Transition Condition● Transition Action

Constructs currently supported

● States● Transition● Self transition● Default transition● Transition ConditionTransition Condition● Transition Action

Constructs currently supported

● States● Transition● Self transition● Default transition● Transition Condition● Transition ActionTransition Action

Interface simulation

PVSio is an extension that enables PVS specifications to be executed

Emulink: Emucharts animation During the simulation the diagram is animated, highlighting states and transitions

Case study

Infusion pumps are devices in use in hospitals to deliver medications or nutrients to patients at controlled rates and precise volumes

Safety requirement: No over- or under-treatment

Modelling and simulation of the device

Device Source Code

Emulink ModelPVS specification

Device interface animation

PVSio

A critical interface failure

User types 102.3 units

Pump inoculates 1023 units without any warning

For doses above 100 units:

Emulink helps pinpoint the design fault

Conclusions

A graphical tool has been developed to semplify the adoption of formal methods in software development.

The utility of the tool has been demonstrated using a case study based on a real medical device.

Emulink is part of PVSio-web, a graphical frontend for the PVS formal verification tool.

Future work:Extension of the statecharts subset notation supported; Use of the tool in different domains.