A Framework for Run-Time Correctness Assurance of Real- Time Systems
Total Page:16
File Type:pdf, Size:1020Kb
University of Pennsylvania ScholarlyCommons Technical Reports (CIS) Department of Computer & Information Science January 1998 MaC: A Framework for Run-Time Correctness Assurance of Real- Time Systems Moonjoo Kim University of Pennsylvania Mahesh Viswanathan University of Pennsylvania Hanene Ben-Abdallah University of Pennsylvania Sampath Kannan University of Pennsylvania, [email protected] Insup Lee University of Pennsylvania, [email protected] See next page for additional authors Follow this and additional works at: https://repository.upenn.edu/cis_reports Recommended Citation Moonjoo Kim, Mahesh Viswanathan, Hanene Ben-Abdallah, Sampath Kannan, Insup Lee, and Oleg Sokolsky, "MaC: A Framework for Run-Time Correctness Assurance of Real-Time Systems", . January 1998. University of Pennsylvania Department of Computer and Information Science Technical Report No. MS-CIS-98-37. This paper is posted at ScholarlyCommons. https://repository.upenn.edu/cis_reports/77 For more information, please contact [email protected]. MaC: A Framework for Run-Time Correctness Assurance of Real-Time Systems Abstract We describe the Monitoring and Checking (MaC) framework which provides assurance on the correctness of program execution at run-time. Our approach complements the two traditional approaches for ensuring that a system is correct, namely static analysis and testing. Unlike these approaches, which try to ensure that all possible executions of the system are correct, our approach concentrates on the correctness of the current execution of the system. The MaC architecture consists of three components: a filter, an event recognizer, and a run-time checker. The filter extracts low-level information, e.g,, values of program variables and function calls, from the system code, and sends it to the event recognizer. From this low-level information, the event recognizer detects the occurrence of "abstract" requirements–level events, and informs the run-time checker about them. The run-time checker uses these events to check that the current system execution conforms to the formal requirements specification of the system. This paper overviews our current prototype implementation, which uses JAVA as the implementation language and our Monitoring Script language as the requirements language. Comments University of Pennsylvania Department of Computer and Information Science Technical Report No. MS- CIS-98-37. Author(s) Moonjoo Kim, Mahesh Viswanathan, Hanene Ben-Abdallah, Sampath Kannan, Insup Lee, and Oleg Sokolsky This technical report is available at ScholarlyCommons: https://repository.upenn.edu/cis_reports/77 MaC A Framework for Runtime Correctness Assurance of Systems RealTime Mo onjo o Kim Mahesh Viswanathan y Hanene BenAb dallah Sampath Kannan Insup Lee and Oleg Sokolsky Department of Computer and Information Science University of Pennsylvania Philadelphia PA Jan uary This research was supp orted in part by NSF CCR AFOSR F ARO DAAG ARO DAAG and ONR N MURI y Visiting from Departement dInformatique FSEG Universite de Sfax Tunisia Abstract We describ e the Monitoring and Checking MaC framework which provides assur ance on the correctness of program execution at runtime Our approach complements is correct namely static analy the two traditional approaches for ensuring that a system sis and testing Unlike these approaches which try to ensure that all p ossible executions of the system are correct our approach concentrates on the correctness of the current execution of the system The MaC architecture consists of three comp onents a lter an event recognizer and a runtime checker The lter extracts lowlevel information eg values of program variables and function calls from the system co de and sends it to the event recognizer From this lowlevel information the event recognizer detects the o ccurrence of ab stract requirementslevel events and informs the runtime checker ab out them The runtime checker uses these events to check that the current system execution conforms to the formal requirements sp ecication of the system This pap er overviews our current prototyp e implementation which uses JA VA as the implementation language and our Monitoring Script language as the requirements language Contents Intro duction Related Research The Monitoring and Checking MaC Paradigm Filter Event Recognizer Runtime Checker The Current MaC Prototyp e System Event Denition Languages Logic for Events Conditions Primitive Event Denition Language PEDL Event Denition Language Meta Target System Issues in MaC prototyp e Naming of Monitored Variables and Execution Points Ob ject Oriented Monitoring Atomicity of Variable Up date Detection Filter and Co de Instrumentation Event recognizer Runtime Checker Examples A RailRoad Crossing System A Database Client Example An avionics example Conclusions and Future work A Java implementation of Database Client Intro duction We develop a framework for runtime monitoring of correctness of realtime systems based ts Computer systems are often monitored on a formal sp ecication of system requiremen for p erformance evaluation and enhancement debugging and testing control or check of h Recently the problem of designing monitors to check for the system correctness Sc correctness of system implementation has received increased attention from the research community CG SM ML Sch Such monitors can b e used to detect violations of timing ML a logical prop erty of a program CG a constraint on a language construct SM and so on The reason for increased interest in correctness monitors is that it is b ecoming more dicult to test or verify software b ecause software size is increasing and its functionality is b ecoming more complicated The most common way to validate a software system is testing However testing cannot b e used to guarantee that the system is errorfree since it is infeasible to completely test the entire system due to the large numb er of p ossible b ehaviors Also as the functionality and structure of software b ecomes complex in order to satisfy a broad range of needs testing itself needs to b e sophisticated enough to check the program according to diverse criteria For example for testing a numerical computation it is enough to check output with given input However when we test a realtime application like trac control system we also have to check the timing b ehavior Formal vercation has b een used to increase the condence that a system will b e correct by making sure that a design sp ecication is correct However even if a design has b een formally veried it still do es not ensure the correctness of an implementation of the design This is b ecause the implementation often is much more detailed and may not strictly follow the formal design So there are p ossibilities for intro duction of errors into an implementa tion of a design that has b een veried One way to overcome this gap b etween the design and the implementation is to resort to testing the implementations b ehavior on a set of input sequences derived from the sp ecication This approach however suers from the same drawback as testing in general and do es not provide guarantees ab out the correctness of the implementation on al l p ossible input sequences Consequently we cannot guarantee using the two traditional metho ds prior to the execution of the system that its runtime b ehavior will b e correct Therefore the approach of continuously monitoring a running system has received much attention In this pap er we describ e a framework of monitoring and checking a running system with the aim of ensuring that it is running correctly The salient asp ect of our approach is the use of formal requirements sp ecication to decide what prop erties to assure Since our goal is to check an implementation against requirements sp ecication at runtime we assume that we are given b oth requirement sp ecications and an implementation To b e able to monitor satisfaction of requirements we have to correlate lowlevel observations with highlevel notions used in the requirements sp ecication Therefore the primary concern of our presentation are the following two issues how to map highlevel abstract events that are used in a requirement sp ecication to lowlevel activities of a running system how to instrument co de to extract necessary lowlevel activities The framework consists of the three phases the design phase the implementation and instrumentation phase and the runtime phase During the design phase the requirements on the system are sp ecied Optionally a formal system sp ecication may also b e writ ten down and in this case we assume that verication is done to ensure that the system sp ecication satises the requirements During the implementation phase the system is on the requirements sp ecication and the implementation the user implemented Based script that contains instructions for instrumenting the co de so that provides a monitoring lowlevel information ab out program state can b e passed on to the monitor In addition it also contains