Towards Verified Systems
Total Page:16
File Type:pdf, Size:1020Kb
TOWARDS VERIFIED SYSTEMS edited by Jonathan Bowen TOWARDS VERIFIED SYSTEMS edited by Jonathan Bow en safemos i This page delib erately left blank for publisher's use ii This page delib erately left blank for publisher's use iii This page delib erately left blank for publisher's use iv This page delib erately left blank for publisher's use Contents Foreword xvii Preface xix Contact Addresses xxiii I Intro duction 1 1 Safety-Critical Systems and Formal Metho ds 3 1.1 A Brief Historical Persp ective ::::::::::::::::::::::::: 3 1.2 Safety-critical Computer Systems ::::::::::::::::::::::: 5 1.2.1 Dep endable computer systems :: :: :: :: :: ::: :: :: :: :: 6 1.2.2 Formal metho ds ::::::::::::::::::::::::::::: 7 1.2.3 The cost of software safety ::::::::::::::::::::::: 9 1.3 Industrial-scale Examples of Use :: ::: :: :: :: :: ::: :: :: :: :: 11 1.3.1 Aviation ::::::::::::::::::::::::::::::::: 12 1.3.2 Railway systems :: :: :: ::: :: :: :: :: ::: :: :: :: :: 13 1.3.3 Nuclear p ower plants :: :: ::: :: :: :: :: ::: :: :: :: :: 13 1.3.4 Medical systems ::::::::::::::::::::::::::::: 14 1.3.5 Ammunition control :: :: ::: :: :: :: :: ::: :: :: :: :: 16 1.3.6 Emb edded micropro cessors ::::::::::::::::::::::: 17 1.4 Areas of Application of Formal Metho ds :: :: :: :: ::: :: :: :: :: 18 1.4.1 Requirements capture ::::::::::::::::::::::::: 19 1.4.2 Design : ::: :: :: :: :: ::: :: :: :: :: ::: :: :: :: :: 19 1.4.3 Compilation ::::::::::::::::::::::::::::::: 20 1.4.4 Programmable hardware :: ::: :: :: :: :: ::: :: :: :: :: 21 1.4.5 Do cumentation ::::::::::::::::::::::::::::: 21 1.4.6 Human-computer interface ::::::::::::::::::::::: 21 1.4.7 Ob ject-oriented metho ds :: ::: :: :: :: :: ::: :: :: :: :: 22 1.4.8 Arti cial intelligence :: :: ::: :: :: :: :: ::: :: :: :: :: 22 1.4.9 Static analysis :: :: :: :: ::: :: :: :: :: ::: :: :: :: :: 22 1.5 Safety Standards :: :: :: :: :: ::: :: :: :: :: ::: :: :: :: :: 22 1.5.1 Formal metho ds in standards ::::::::::::::::::::: 23 1.5.2 Education, certi cation and legislation : :: :: ::: :: :: :: :: 27 1.6 Discussion : :: ::: :: :: :: :: ::: :: :: :: :: ::: :: :: :: :: 29 v vi CONTENTS 1.6.1 Formal metho ds research : :: ::: :: :: :: :: ::: :: :: :: : 30 1.6.2 Formal metho ds technology : ::: :: :: :: :: ::: :: :: :: : 31 1.6.3 Education and accreditation : ::: :: :: :: :: ::: :: :: :: : 31 1.6.4 Standards ::: :: :: :: :: ::: :: :: :: :: ::: :: :: :: : 32 2 Overview of the Pro ject 35 2.1 The SAFEMOS Pro ject : :: :: :: ::: :: :: :: :: ::: :: :: :: : 35 2.1.1 The SAFEMOS tower :: :: ::: :: :: :: :: ::: :: :: :: : 37 2.2 System Mo delling ::: :: :: :: :: ::: :: :: :: :: ::: :: :: :: : 38 2.2.1 Timed transition systems : :: ::: :: :: :: :: ::: :: :: :: : 38 2.3 Software Development and Compilation :: :: :: :: :: ::: :: :: :: : 38 2.3.1 State transition assertions :: ::: :: :: :: :: ::: :: :: :: : 38 2.3.2 A real-time programming language :: :: :: :: ::: :: :: :: : 39 2.3.3 Program compilation : :: :: ::: :: :: :: :: ::: :: :: :: : 39 2.4 Hardware Design and Compilation : ::: :: :: :: :: ::: :: :: :: : 41 2.4.1 Micropro cessor design metho ds :: :: :: :: :: ::: :: :: :: : 41 2.4.2 Hardware compilation :: :: ::: :: :: :: :: ::: :: :: :: : 41 2.5 Other SAFEMOS Pro ject Work : :: ::: :: :: :: :: ::: :: :: :: : 42 2.5.1 Symb olic execution :: :: :: ::: :: :: :: :: ::: :: :: :: : 42 2.5.2 Assembler veri cation :: :: ::: :: :: :: :: ::: :: :: :: : 44 2.5.3 Machine semantics using Z :: ::: :: :: :: :: ::: :: :: :: : 45 2.6 Related Work :: ::: :: :: :: :: ::: :: :: :: :: ::: :: :: :: : 46 2.7 Conclusion :: :: ::: :: :: :: :: ::: :: :: :: :: ::: :: :: :: : 46 II To ols and Mo dels 47 3 The HOL Logic and System 49 3.1 Intro duction : :: ::: :: :: :: :: ::: :: :: :: :: ::: :: :: :: : 49 3.2 The HOL Logic : ::: :: :: :: :: ::: :: :: :: :: ::: :: :: :: : 50 3.2.1 Typ es :: ::: :: :: :: :: ::: :: :: :: :: ::: :: :: :: : 50 3.2.2 Terms :: ::: :: :: :: :: ::: :: :: :: :: ::: :: :: :: : 51 3.2.3 Standard notions : :: :: :: ::: :: :: :: :: ::: :: :: :: : 52 3.2.4 Sequents : ::: :: :: :: :: ::: :: :: :: :: ::: :: :: :: : 53 3.2.5 Semantics ::: :: :: :: :: ::: :: :: :: :: ::: :: :: :: : 54 3.2.6 Deductive systems :: :: :: ::: :: :: :: :: ::: :: :: :: : 56 3.2.7 Theories : ::: :: :: :: :: ::: :: :: :: :: ::: :: :: :: : 58 3.2.8 Built-in theories and notations ::: :: :: :: :: ::: :: :: :: : 61 3.2.9 Consistency :: :: :: :: :: ::: :: :: :: :: ::: :: :: :: : 62 3.2.10 Extensions of theories :: :: ::: :: :: :: :: ::: :: :: :: : 62 3.3 The HOL System ::: :: :: :: :: ::: :: :: :: :: ::: :: :: :: : 67 3.3.1 The history of HOL :: :: :: ::: :: :: :: :: ::: :: :: :: : 68 3.3.2 Overview of the theorem-proving infrastructure : ::: :: :: :: : 68 3.3.3 Getting and using HOL : :: ::: :: :: :: :: ::: :: :: :: : 70 4 Timed Transition Systems 71 CONTENTS vii 4.1 Intro duction to TTSs and HOL :: ::: :: :: :: :: ::: :: :: :: :: 71 4.2 Example: A Trac Light Controller ::: :: :: :: :: ::: :: :: :: :: 73 4.2.1 System description ::::::::::::::::::::::::::: 73 4.2.2 System requirements :: :: ::: :: :: :: :: ::: :: :: :: :: 75 4.3 A Real-Time Temp oral Logic ::::::::::::::::::::::::: 75 4.3.1 Variables, expressions and equality :::::::::::::::::: 77 4.3.2 Bo olean op erators :: :: :: ::: :: :: :: :: ::: :: :: :: :: 77 4.3.3 Next ::::::::::::::::::::::::::::::::::: 77 4.3.4 Previous ::::::::::::::::::::::::::::::::: 77 4.3.5 Eventually :: :: :: :: :: ::: :: :: :: :: ::: :: :: :: :: 77 4.3.6 Always : ::: :: :: :: :: ::: :: :: :: :: ::: :: :: :: :: 77 4.3.7 Unless : ::: :: :: :: :: ::: :: :: :: :: ::: :: :: :: :: 78 4.3.8 Example ::::::::::::::::::::::::::::::::: 78 4.4 Timed Transition Systems ::::::::::::::::::::::::::: 78 4.4.1 Timed transitions :: :: :: ::: :: :: :: :: ::: :: :: :: :: 78 4.4.2 Computations :: :: :: :: ::: :: :: :: :: ::: :: :: :: :: 79 4.4.3 Requirements of computations :: :: :: :: :: ::: :: :: :: :: 80 4.5 Timed Transition Diagrams :: :: ::: :: :: :: :: ::: :: :: :: :: 80 4.5.1 TTD representation ::::::::::::::::::::::::::: 80 4.5.2 Semantics of TTDs ::::::::::::::::::::::::::: 81 4.5.3 Example ::::::::::::::::::::::::::::::::: 82 4.6 Veri cation ::::::::::::::::::::::::::::::::::: 83 4.6.1 Pro of rules :: :: :: :: :: ::: :: :: :: :: ::: :: :: :: :: 83 4.6.2 Single step rules ::::::::::::::::::::::::::::: 84 4.6.3 TTD rules :: :: :: :: :: ::: :: :: :: :: ::: :: :: :: :: 85 4.6.4 An example pro of :: :: :: ::: :: :: :: :: ::: :: :: :: :: 87 4.6.5 Other examples ::::::::::::::::::::::::::::: 89 4.7 Discussion : :: ::: :: :: :: :: ::: :: :: :: :: ::: :: :: :: :: 90 III Software 91 5 State Transition Assertions: A Case Study 93 5.1 Intro duction ::::::::::::::::::::::::::::::::::: 93 5.2 An Example: Mult ::::::::::::::::::::::::::::::: 94 5.2.1 Overview :: :: :: :: :: ::: :: :: :: :: ::: :: :: :: :: 94 5.2.2 Informal sp eci cation of Mult ::::::::::::::::::::: 95 5.2.3 MultProg: an implementation of Mult : :: :: ::: :: :: :: :: 96 5.3 A More Detailed Sp eci cation of Mult :::::::::::::::::::: 97 5.4 Determining a Machine from a Program :: :: :: :: ::: :: :: :: :: 97 5.5 State Transition Assertions :::::::::::::::::::::::::::100 5.5.1 Holding states :: :: :: :: ::: :: :: :: :: ::: :: :: :: ::101 5.6 Formal Sp eci cation of Mult :: :: ::: :: :: :: :: ::: :: :: :: ::103 5.7 Correctness of MultProg :: :: :: ::: :: :: :: :: ::: :: :: :: ::104 5.8 Generating Atomic STAs :: :: :: ::: :: :: :: :: ::: :: :: :: ::104 viii CONTENTS 5.9 Laws for Combining STAs :: :: :: ::: :: :: :: :: ::: :: :: :: :107 5.9.1 The consequence rule : :: :: ::: :: :: :: :: ::: :: :: :: :107 5.9.2 The sequencing rule :: :: :: ::: :: :: :: :: ::: :: :: :: :107 5.9.3 Cases rules :: :: :: :: :: ::: :: :: :: :: ::: :: :: :: :108 5.9.4 The wait lo op rule :: :: :: ::: :: :: :: :: ::: :: :: :: :108 5.9.5 The while rule : :: :: :: :: ::: :: :: :: :: ::: :: :: :: :110 5.10 Conclusions : :: ::: :: :: :: :: ::: :: :: :: :: ::: :: :: :: :112 6 A Real-time Programming Language 115 6.1 The SAFE Programming Language : ::: :: :: :: :: ::: :: :: :: :115 6.1.1 Pro cesses ::: :: :: :: :: ::: :: :: :: :: ::: :: :: :: :115 6.1.2 Expressions :: :: :: :: :: ::: :: :: :: :: ::: :: :: :: :116 6.2 Interval Mo del :: ::: :: :: :: :: ::: :: :: :: :: ::: :: :: :: :117 6.2.1 Typ es :: ::: :: :: :: :: ::: :: :: :: :: ::: :: :: :: :117 6.2.2 Variables, registers and p orts ::: :: :: :: :: ::: :: :: :: :117 6.2.3 Interval op erators : :: :: :: ::: :: :: :: :: ::: :: :: :: :118 6.2.4 Ordering of pro cesses : :: :: ::: :: :: :: :: ::: :: :: :: :118 6.3 Interval Semantics :: :: :: :: :: ::: :: :: :: :: ::: :: :: :: :119 6.3.1 Expressions :: :: :: :: :: ::: :: :: :: :: ::: :: :: :: :119 6.3.2 Bo olean op erators : :: :: :: ::: :: :: :: :: ::: :: :: :: :120 6.3.3 Interval length :: :: :: :: ::: :: :: :: :: ::: :: :: :: :120 6.3.4 Stability and assignment : :: ::: :: :: :: :: ::: :: :: :: :121 6.3.5 Sequence : ::: :: :: :: :: ::: :: :: :: :: ::: :: :: :: :122 6.3.6 Conditional :: :: :: :: :: ::: :: :: :: :: ::: :: :: :: :122 6.3.7 While lo op ::: :: :: :: :: ::: :: :: :: :: ::: :: :: :: :122 6.3.8 Lo cal variables :: :: :: :: ::: :: :: :: :: ::: :: :: :: :123 6.4 SAFE Semantics : ::: :: :: :: :: ::: :: :: :: :: ::: :: :: :: :123 6.4.1 Expressions :: :: :: :: :: ::: :: :: :: :: ::: :: :: :: :124 6.4.2 Pro cesses ::: :: :: :: :: ::: :: :: :: :: ::: :: :: :: :124 6.5 Laws : :: :: :: ::: :: :: :: :: ::: :: :: :: :: ::: :: :: :: :125 6.5.1 Ordering : ::: :: :: :: :: ::: :: :: :: :: ::: :: :: :: :125 6.5.2 Bo olean op erators : :: :: :: ::: :: :: :: :: ::: :: :: :: :126 6.5.3 Sequence : ::: :: :: :: :: :::