High Assurance Modeling and Rapid Engineering (HAMR) for Embedded Systems

AADL Tool Expo – October 28, 2019

John Hatcliff Robby Jason Belt,

University Distinguished Professor Professor Hariharan Thiagarajan Lucas-Rathbone Professor of Kansas State University Engineering Research Associates Kansas State University Kansas State University

In collaboration with Adventium Labs, SEI, and Collins Aerospace

This material is based on research sponsored by the Department of Homeland Security (DHS) Science and Technology Directorate, Homeland Security Advanced Research Projects Agency (HSARPA), Cyber Security Division (DHS S&T/HSARPA/CDS) BAA HSHQDC- 14-R-B0005, the Government of Israel and the National Cyber Bu- reau in the Government of Israel via contract number D16PC00057, as well as the US National Science Foundation FDA Scholar-in-Residence Program. DARPA CASE Approach

DARPA CASE provides tools to develop cyber-resiliency requirements, refactor/transform system architectures, and generate code/builds of modified systems that achieve cyber-resiliency

n Capture requirements for cyber-resiliency

n Analyze design

n Transform design Transform Control non-interference by allocating components to Architecture different partitions in n Verify new design against requirements

n Build / Deploy

On DARPA CASE, KSU is partnered with Adventium Labs, Collins Aerospace, Data61 (SeL4 verified microkernel) Wrap legacy untrusted Insert attestation managers component in a VM in to ensure data is coming micro-kernel partition AADL Tool Expo - Oct 2019 from a trusted source. 2 Deeply Integrate Models and Programming Across Multiple Levels of Abstraction

System Modeling and Analysis (AADL)

Code Generation -- Slang + AADL Run-Time Reference Implementation

AADL OSATE Source Code, Simulation, Analysis, Verification Analyses - Information Flow - Functional Integration Constraints (component contracts - Scheduleability - …

Semantic Consistency Deployment on Embedded/Distributed Platforms Micro-kernels & OS Slang – Subset of Scala for critical systems • SeL4 • Minex 3 (enhanced) • Xen • Linux • FreeRTOS Code Generation, .g., • C + Platform Run-Time System (primitives for

Analysis and verification results moved up and down abstraction layers controlling communication between partitions in a partitioning architecture) Partitioned Architectures • C compatible with CompCERT verified compiler

AADL Tool Expo - Oct 2019 3 Example Domains

Medical Devices (US Dept of Homeland Security) n Targetting development and

Code deployed using verification of embedded Genode OS framework using Xen systems and SeL4 microkernel n Emphasizing platform development on using separation kernel and Building Controls (US Dept of Homeland Security) hypervisor technology

Code deployed using n Introduce rigorous use of enhanced 3 micro-kernel modeling and abstractions

Containment labs for critical agriculture without significant disruption experiments of workflows UxAS – Unmanned (AFRL, DARPA) NASA/JPL

Code deployed on machine-verified micro-kernel SEL4

Unmanned Systems Autonomy Services AADL Tool Expo - Oct 2019 4 AADL Computational Model

Developer configures computational AADL AADL Port & Connection model Property Options Property Options Periodic Event Sporadic Data Hybrid Temporal … Separation …

Selected thread Implied API Selected pattern Pattern for communication pattern application code to access AADL Run-Time Services

AADL Tool Expo - Oct 2019 5 HAMR Code Generation

Code gen for Application

Code gen for Code gen for Component & Communication Threading Infrastructure Infrastructure Application Code System Development Build

Application Application Auto-Generated Auto-Generated Application Code Code Run-Time Run-Time Code Communication Communication Infrastructure Infrastructure Auto-generated Code for Platform Auto-generated Code for Platform Auto-generated Component Infrastructure Component Infrastructure Code for Platform Code for Platform Component Infrastructure Code for Platform

Platform configuration information AADL Tool Expo - Oct 2019 6 HAMR Code Generation

Use Case: Example HAMR instantiation for C-based development on SeL4 microkernel (e.g., DARPA CASE)

-

Platform independent C code generation for AADL RT APIs

Code generation pathways for SeL4

SeL4 Application code in Interpartition C -- Platform- Communication independent in C because it only talks Component Infrastucture to AADL RT APIs in C, talking to SeL4 communication mechanisms The “platform independent” story above applies to application logic, not hardware based I/O e.g., for AADL Tool Expo - Oct 2019 sensors, actuators. 7 HAMR Code Generation

Use Case: Example HAMR instantiation for C-based development on Linux (e.g., DARPA CASE)

-

Platform independent C code generation for AADL RT APIs

Code generation pathways for Linux

Linux inter- Application code in C -- Platform- communication independent in C because it only talks Component Infrastucture to AADL RT APIs in C, talking to Linux inter-proocess communication The “platform independent” story above applies to application logic, not hardware based I/O e.g., for AADL Tool Expo - Oct 2019 sensors, actuators. 8 HAMR Code Generation

Use Case: High-Assurance Development in Slang, with a C-based deployment

System Modeling and Analysis …in AADL AADL to Slang Code Generation

Source Code, Simulation, Analysis, Verification …in Slang – a safety- critical subset of Scala Slang to C Code Generation

Deployment on Embedded/Distributed Platforms

…ie.g., in C with platform infrastructure

AADL Tool Expo - Oct 2019 9 HAMR Run-time Reference Implementation

The Slang-based infrastructure of AADL run-time provides a reference implementation

System Modeling and Analysis …in AADL

Reference Implementation for AADL Computational Model in Slang n HAMR AADL reference implementation is analogous to an abstract machine for analyzeable real-time embedded computation n Because Slang (subset of Scala) is a JVM-based language it is easy to integrate with Java resources to obtain a simulation, visualization, and run-time verification environment for AADL-derived applications

n Sensor, actuator, UI elements not a part of core application logic can be mocked up in Java or Scala AADL Tool Expo - Oct 2019 10 High Assurance High-Level Development in Slang (subset of Scala) In addition to supporting C development, we also support “higher- level” development in Slang (subset of Scala) which supports integration with Java n Slang -- A verifiable subset of a modern — Scala

n imperative OO & FP: generics, pattern matching, higher-order functions, etc.

n benefits: existing Java ecosystems and talent pools, available (customizable) industrial tool support, including compiler toolchain & IDEs

n … yet able to generate code suitable for safety/security-critical embedded systems n (Currently) supports two memory models:

n SPARK/Ada-like (static memory allocation): targeted for embedded systems

n Swift-like (DAG, immutable sharing, automatic reference counting): targeted for large-application development

n including for developing Sireum/Slang itself!

AADL Tool Expo - Oct 2019 11 Slang-to-C Translations n C Standard: C99, Compilers: CompCert (proven correct C compiler), clang, gcc n OS/platforms: macOS, Linux, Windows, and others (opportunity-based) n Memory models: static alloc. (done); ref-counting & full tracing-GC (future) n Platform Backends

n Conventional C applications running on Linux, Windows, macOS

n SeL4 (part of Rockwell Collins, Adventium, Data61 team on DARPA CASE)

n Experimental translations for…

n Genode framework

n enhanced for separation (DHS CPSSec project)

n FreeRTOS

AADL Tool Expo - Oct 2019 12 Abstraction Levels – AADL State Machines

The simulation has a dynamic visualization of the BLESS/BA state machines of each AADL thread AADL State Machine Specifications

Simulation

Compilation to, e.g., C

Army SBIR ”GUMBO” Adventium/KSU

AADL Tool Expo - Oct 2019 13 Component Implementations in Slang

handle …Slang can be used to implement component business logic (corresponding to event handlers for incoming interface events)

AADL Tool Expo - Oct 2019 14 Component Implementations in Slang

…Slang implementations include calls to publish events on output ports and get/set values of data Get Send ports Reading a value from the currentTemp data port (behind the scenes mapped to generic AADL RT service GetValue)

Sending an event (with ‘cmd’ payload) out the fanCmd port (behind the scenes mapped to generic AADL RT service PutValue)

AADL Tool Expo - Oct 2019 15 SEI ISSEHAMR FY’19 Run-time Monitoring & Visualization

The HAMR Debugging infrastructure provides hooks for registering call-back methods that get invoked where there is an action on an output port or input port, or when the value of a application component local variable changes.

System Modeling and Analysis …in AADL

Tapping into the Slang Reference Implementation for execution events and state changes to drive run-time Input port Output State monitoring action port action Change Stream Processing Libraries Visualizations & Run-time monitoring for Call-back methods temporal property for events of interests satisfaction Inspector/Injector Framework AADL Tool Expo - Oct 2019 Event Stream 16 Example Event Stream Filtering

Stream Processing Libraries Input Output State port port Change action action https://akka.io

Call-back methods I’d like to visualize events on for events of interests the temp sensor fault mitigation path Inspector/Injector Framework Event Stream Filtered event stream for temp sensor fault injection path

Get identifiers of ports of interest

Define a filter for a new stream that Define stream selects only those start / end points four ports.

AADL Tool Expo - Oct 2019 17 Event Filtering

Menu of event stream filters – automatically populated from user- defined filter methods defined in framework

Event stream

AADL Tool Expo - Oct 2019 18 Auto-generated Sequence Chart Visualization

Clicking on button here automatically moves from text-based view to sequence chart view

AADL Tool Expo - Oct 2019 19 SEI ISSEHAMR FY’19 Fault Injection and Testing

The HAMR Debugging infrastructure allows one to inject values at an output port or input port. It also allows a component local variable to be directly set/perturbed.

System Modeling and Analysis …in AADL

Injecting faults into the Slang Reference Implementation

Input port Output port State injection injection injection

Requirements, Hazard Analysis, Testing Fault Injector Actions and Test Plans Infrastructure Inspector/Injector Framework AADL Tool Expo - Oct 2019 Fault Injection Scripts 20 Flow, Dependence, and Error Propagation Visualization & Querying

The KSU Awas tool builds scalable interactive visualizations of AADL information flows and error propagations

Results from DoD Phase II SBIR with Adventium Labs Information flow graphs can be dynamically browsed and AADL Tool Expo - Oct 2019 queried with path logic. 21 Information Flow Analysis Foundation Internal dependency graphs upon which analysis is performed are built from architecture connections and intra-component flows as well as EMv2 annotations Markup/Interaction on source code (future – based on past work)

Markup/Interaction on AADL Artifacts (future – based on past work) Internal dependency graph (algorithms work on this)

HTML5 (current)

Interactions and rendered results AADL Tool Expo - Oct 2019 22 Details of Information Flow Rendering

Flows: In this case, intra- component flows are not sources and sinks, but flows of information between inputs and outputs. AADL Tool Expo - Oct 2019 23 Interactive Browsing of Information Flows

Example: In Ground Station / UAV example used on DARPA CASE, ask “how does map information propagation from ground station to UAV and through UAV’s mission computer to produce a waypoint?”

Click on map output port of ground station with “forware propagation” option

Immediately see results of across different subsystems. AADL Tool Expo - Oct 2019 24 Example Representation of AADL EMv2 Error Propagation (Hazard Analysis)

Path of EMv2 error token propagation.

Highlighting of error tokens Visualization of relevant to EMv2 error token given query propagation rules.

In essence, capturing a “causality chain” in hazard AADL Tool Expo - Oct 2019 analysis (e.g. FMEA, STPA) 25 Example Visualization of AADL EMv2 Error Propagation (Hazard Analysis)

Details of intra-component System-level Error Saved (replayable) queries Error Propagation Propagation Paths

AADL Tool Expo - Oct 2019 26 Conclusions n HAMR – Flexible simulation and code generation framework for AADL – capable of supporting multiple languages / platforms

n Continuing to expand platforms supported – let us know if you are interested n Integrated analysis and automated verification capabilities (see demo)

n Significant long-term emphasis on scalable formal verification and certification arguments n Applied on DARPA CASE project to ensure cyber-resiliency using partitioning platforms (e.g., micro-kernels) n Related demos…

n Adventium Labs

n BLESS – Brian Larson / Multitude AADL Tool Expo - Oct 2019 27