Automated Annotation of Simulink Generated C Code Based on the Simulink Model
Total Page:16
File Type:pdf, Size:1020Kb
DEGREE PROJECT IN COMPUTER SCIENCE AND ENGINEERING, SECOND CYCLE, 30 CREDITS STOCKHOLM, SWEDEN 2020 Automated Annotation of Simulink Generated C Code Based on the Simulink Model SREEYA BASU ROY KTH ROYAL INSTITUTE OF TECHNOLOGY SCHOOL OF ELECTRICAL ENGINEERING AND COMPUTER SCIENCE Automated Annotation of Simulink Generated C Code Based on the Simulink Model SREEYA BASU ROY Master in Embedded Systems Date: September 25, 2020 Supervisor: Predrag Filipovikj Examiner: Matthias Becker School of Electrical Engineering and Computer Science Host company: Scania CV AB Swedish title: Automatisk Kommentar av Simulink Genererad C kod Baserad på Simulink Modellen iii Abstract There has been a wave of transformation in the automotive industry in recent years, with most vehicular functions being controlled electron- ically instead of mechanically. This has led to an exponential increase in the complexity of software functions in vehicles, making it essential for manufactures to guarantee their correctness. Traditional software testing is reaching its limits, consequently pushing the automotive in- dustry to explore other forms of quality assurance. One such technique that has been gaining momentum over the years is a set of verification techniques based on mathematical logic called formal verification tech- niques. Although formal techniques have not yet been adopted on a large scale, these methods offer systematic and possibly more exhaus- tive verification of the software under test, since their fundamentals are based on the principles of mathematics. In order to be able to apply formal verification, the system under test must be transformed into a formal model, and a set of proper- ties over such models, which can then be verified using some of the well-established formal verification techniques, such as model check- ing or deductive verification. This thesis focuses on formal verification of automatically generated C code based on Simulink models using deductive verification techniques. More specifically, the aim is to ex- plore whether the generated code can be automatically annotated using the underlying Simulink model as an executable specification, thereby making it suitable for verification using state-of-the-art tools. Our in- vestigation of Simulink generated C code shows that the same can be annotated using the corresponding Simulink model as an executable specification. Consequently, we propose an algorithm that automates the annotation generation and their injection into C code for a specific class of Simulink models and code generated under specific conditions. Successful verification would mean that the code satisfies all functional properties of the model irrespective of the code generator used. We validate our approach on a prototype implementation of a Brake-by-Wire (BBW) functionality of heavy load vehicles. Most of the functional properties of the generated code were satisfied. iv Sammanfattning Det har skett en våg av omvandling inom fordonsindustrin i de senas- te åren, där de flesta fordonsfunktioner nu styrs elektroniskt istället för mekaniskt. Detta har lett till en exponentiell ökning i komplexite- ten av programvarufunktioner i fordon, vilket gör det väsentligt för tillverkare att kunna garantera deras korrekthet. Traditionell testning av programvara är nära sina gränser och driver därför bilindustrin att utforska andra former av kvalitetssäkring. En teknik som har fått fart genom åren är en uppsättning verifieringstekniker baserade på matematisk logik som kallas formella verifikationstekniker. Även om formella tekniker ännu inte har införts på en stor skala erbjuder dessa metoder systematisk och möjligen mer genomgripande verifiering av programvaran som testas, eftersom dess grund är baserad på mate- matikens principer. För att kunna tillämpa formell verifiering behöver systemet som testas omvandlas till en formell modell och en upp- sättning egenskaper över sådana modeller, som sedan kan verifieras med hjälp av några väletablerade formella verifieringstekniker, såsom modellkontroll eller deduktiv verifiering. Denna avhandling fokuse- rar på formell verifiering av automatiskt genererad C-kod baserad på Simulink-modeller med hjälp av deduktiva verifieringstekniker. Mer specifikt är syftet att undersöka om den genererade koden automa- tiskt kan antecknas med den underliggande Simulink-modellen som en körbar specifikation, vilket då skulle göra den lämplig för verifiering med toppmoderna verktyg. Vår undersökning av Simulink-genererad C-kod visar att samma sak kan kommenteras när den motsvarande Simulink-modellen används som en körbar specifikation. Följaktligen föreslår vi en algoritm som automatiserar anteckningsgenereringen och dess injektion i C-kod för en specifik klass av Simulink-modeller och kod genererad under specifika förhållanden. Lyckad verifiering skulle betyda att koden uppfyller alla funktionella egenskaper av mo- dellen oavsett vilken kodgenerator som används. Vi validerar vår strategi med en prototypimplementering av en Brake-by-Wire (BBW) -funktionalitet för tunga lastbilar. De mesta funk- tionella egenskaperna för den genererade koden var uppfyllda. v Acknowledgements This thesis is the culmination of seven months of relentless effort and several sleepless nights. Although it bears my name, this work belongs in equal parts to several people and would not have been possible without them. To my parents, sister and grandparents, a big thank you for taking a leap of faith and supporting me in my decision to move halfway across the world. Your unadulterated belief in my abilities has always been a guiding light irrespective of the circumstances. Thank you to Predrag Filipovikj, the supervisor of this work, for trusting me to carry your research forward. Thank you for providing me with an open and safe environment to clarify doubts and for taking out the time to conduct weekly meetings even after we started working remotely. Your detailed feedback on every draft of the report has really raised the bar and helped elevate its standard. It has been a long journey and I hope our results will be of use to you in the future. To the entire EPXS team at Scania CV AB, particularly Marcus Törn- qvist, Mattias Nyberg, Christian Lidström and Dilian Gurov, thank you for your assistance and for providing me with helpful insights during the course of this thesis. Thank you also to the ’Rat Gang’: Darius, Martin, Olle and Sabrina for making lunch and fika breaks ever so enjoyable. A big thank you to all my professors, mentors, peers and friends at KTH for the last two years. This has been a period of insurmountable personal and academic growth and I will cherish this experience for years to come. Lastly, thank you to all my friends back home. It is rare to find special friends who wish you nothing but the best and I consider myself extremely lucky to be able to share my journey with you. Contents 1 Introduction 1 1.1 Overview . .1 1.2 Structure . .2 2 Background 4 2.1 Model-based Development . .4 2.2 MATLAB Simulink . .5 2.3 Software Verification . .6 2.3.1 Formal Verification . .7 2.4 Deductive Verification . .8 2.4.1 Hoare Logic . .8 2.4.2 Design by Contract . .9 2.5 Verification Tools . 10 2.5.1 Frama-C . 11 3 Research Problem 14 3.1 Problem Definition . 14 vi CONTENTS vii 3.2 Goals . 15 3.3 Ethics . 16 4 Research Methods 17 5 Case Study 18 5.1 Industrial Use Case . 18 5.2 Analysis of the Structure of BBW . 18 5.3 Code Generation . 20 5.4 Generated Code Base . 20 6 Proposed Solution 22 7 Annotation of BBW Code Base 31 8 Discussion 48 8.1 Limitations . 50 9 Related Work 51 10 Conclusion 53 A Brake-by-Wire (BBW) 55 Bibliography 57 Chapter 1 Introduction 1.1 Overview The advent of autonomous driving has seen an exponential increase in the complexity of automotive software functions. This has resulted in leading vehicle manufacturers spending a significant portion of time in developing real-time safety critical code as well as assuring its cor- rectness. For complex and safety-critical functions, it becomes ever challenging to guarantee their correctness at all times using traditional verification techniques such as software testing and peer-reviews. Con- sequently, this has helped propel formal techniques to the forefront. Formal methods use the underlying principles of mathematics to prove properties of the system under test, thus making it a more reliable and accurate mode of verification. Being a manufacturer of trucks and buses recognized on a global scale, Scania is actively involved in verifying the functional correctness of their developed code and also ensuring that it adheres to safety stan- dards such as the ISO 26262 [1], which recommends formal verification of all safety critical code. Recent years have seen the rise of model based forms of software de- velopment [2], where code is generated automatically with the help of advanced tools (such as Embedded Coder [3]) as compared to develop- 1 2 CHAPTER 1. INTRODUCTION ers writing code from scratch. These tools or autocoders are assumed to generate code that functionally satisfies all properties of the model. Being at the threshold of transformative changes in the automotive industry, it has never been more important for vehicle manufacturers to be able to guarantee safety on roads. This serves as the key motivation for this thesis which focuses on ensuring the functional correctness of the code with respect to its input modelling language. Our research is centred around verifying that the generated code implements and only implements properties of the input Simulink model. In order to do so, certain changes or annotations (section 2.5) need to be introduced into the generated code. Our initial assumption is that the input-output mapping function of each block from the stan- dard Simulink library can be represented by a unique contract spec- ification (section 2.4.2). The contracts are written as annotations and injected into appropriate control points in the generated code. The annotated code can then be verified using state-of-the-art formal verifi- cation tools. Successful verification means that the contracts extracted from the model are fulfilled by the generated code as well.