emulink: a graphical modelling environment for pvs
DESCRIPTION
Emulink is graphical tool that allows software engineers to create PVS specifications starting from a StateCharts based diagram.TRANSCRIPT
![Page 1: Emulink: A graphical modelling environment for PVS](https://reader033.vdocuments.us/reader033/viewer/2022052303/54b6f00b4a7959fd508b4692/html5/thumbnails/1.jpg)
Emulink: a modelling graphical environment for PVS
Candidate: Enrico D'Urso
Supervisors: Prof. Cinzia Bernardeschi; Prof. Andrea Domenici
In collaboration with Queen Mary University Of London
![Page 2: Emulink: A graphical modelling environment for PVS](https://reader033.vdocuments.us/reader033/viewer/2022052303/54b6f00b4a7959fd508b4692/html5/thumbnails/2.jpg)
Outline● Motivation ● Development of Emulink
– The graphical modelling language (Emucharts)
– Model visualisation and animation
● Case study– Demonstration of a software design error in a
commercial medical device
![Page 3: Emulink: A graphical modelling environment for PVS](https://reader033.vdocuments.us/reader033/viewer/2022052303/54b6f00b4a7959fd508b4692/html5/thumbnails/3.jpg)
Motivation (1)
Software: first failure cause of computing systems
– 10-200 faults / KLOC created during development
0.01-10 faults / KLOC residual
✔ Proof✔ Model-checking✔ Testing
![Page 4: Emulink: A graphical modelling environment for PVS](https://reader033.vdocuments.us/reader033/viewer/2022052303/54b6f00b4a7959fd508b4692/html5/thumbnails/4.jpg)
Motivation (2)
Safety cannot rely only on testing.Testing shows the presence, not the absence of bugs. ( Edsger Wybe Dijkstra )
International safety standards such as IEC 61508 highly recommend the use of formal methods in the development of safety critical or safety related components
Verification based on formal methods tools can significantly reduce the number of design errors
![Page 5: Emulink: A graphical modelling environment for PVS](https://reader033.vdocuments.us/reader033/viewer/2022052303/54b6f00b4a7959fd508b4692/html5/thumbnails/5.jpg)
Motivation (3)
Formal methods tools have a steep learning curve– Specialized mathematically based modelling languages
– Complex analysis techniques– Not yet mature for widespread use in industry
Several manufacturers do not use formal verification tools routinely despite of the potential advantages– As a consequence, design errors are usually identified too late in
the design process, or even after system deployment
![Page 6: Emulink: A graphical modelling environment for PVS](https://reader033.vdocuments.us/reader033/viewer/2022052303/54b6f00b4a7959fd508b4692/html5/thumbnails/6.jpg)
The focus of this thesis
● Develop a graphical tool to simplify the use of PVS, a state-of-the-art formal verification tool
● PVS (Prototype Verification System)– Part of the NASA Langley Verification Tools
– Extensive libraries of mathematical theories
![Page 7: Emulink: A graphical modelling environment for PVS](https://reader033.vdocuments.us/reader033/viewer/2022052303/54b6f00b4a7959fd508b4692/html5/thumbnails/7.jpg)
PVS languagePurely declarative logical language(system: set of functions)
HA : THEORYBEGIN x,y : VAR bool HA(x,y) : [bool, bool] = ((x AND y) , % carry (x XOR y)) % sum % convert Boolean to natural b2n(x) : nat = IF x THEN 1 ELSE 0 ENDIF HA_corr : THEOREM % correctness LET (carry, sum) = HA(x, y) IN b2n(sum) + 2*b2n(carry) = b2n(x) + b2n(y)END HA
![Page 8: Emulink: A graphical modelling environment for PVS](https://reader033.vdocuments.us/reader033/viewer/2022052303/54b6f00b4a7959fd508b4692/html5/thumbnails/8.jpg)
The intuition
Software engineers are familiar with graphical modelling languages such as Statecharts.
PVS specifications would be more accessible if they were presented using a graphical language similar to Statecharts
![Page 9: Emulink: A graphical modelling environment for PVS](https://reader033.vdocuments.us/reader033/viewer/2022052303/54b6f00b4a7959fd508b4692/html5/thumbnails/9.jpg)
Statecharts: an example
![Page 10: Emulink: A graphical modelling environment for PVS](https://reader033.vdocuments.us/reader033/viewer/2022052303/54b6f00b4a7959fd508b4692/html5/thumbnails/10.jpg)
Emulink: a graphical modelling environment for PVS
Graphical modelling tool for emulating statecharts in PVS:– Emucharts (essential subset of Statechart constructs)
– Automatic generation of PVS models
– Animation of PVS models during simulations (useful when debugging PVS models)
– Visualisation of existing annotated PVS models
![Page 11: Emulink: A graphical modelling environment for PVS](https://reader033.vdocuments.us/reader033/viewer/2022052303/54b6f00b4a7959fd508b4692/html5/thumbnails/11.jpg)
Emucharts editor
![Page 12: Emulink: A graphical modelling environment for PVS](https://reader033.vdocuments.us/reader033/viewer/2022052303/54b6f00b4a7959fd508b4692/html5/thumbnails/12.jpg)
Constructs currently supported
● StatesStates● Transition● Self transition● Default transition● Transition Condition● Transition Action
![Page 13: Emulink: A graphical modelling environment for PVS](https://reader033.vdocuments.us/reader033/viewer/2022052303/54b6f00b4a7959fd508b4692/html5/thumbnails/13.jpg)
Constructs currently supported
● States● TransitionTransition● Self transition● Default transition● Transition Condition● Transition Action
![Page 14: Emulink: A graphical modelling environment for PVS](https://reader033.vdocuments.us/reader033/viewer/2022052303/54b6f00b4a7959fd508b4692/html5/thumbnails/14.jpg)
Constructs currently supported
● States● Transition● Self transitionSelf transition● Default transition● Transition Condition● Transition Action
![Page 15: Emulink: A graphical modelling environment for PVS](https://reader033.vdocuments.us/reader033/viewer/2022052303/54b6f00b4a7959fd508b4692/html5/thumbnails/15.jpg)
Constructs currently supported
● States● Transition● Self transition● Default transitionDefault transition● Transition Condition● Transition Action
![Page 16: Emulink: A graphical modelling environment for PVS](https://reader033.vdocuments.us/reader033/viewer/2022052303/54b6f00b4a7959fd508b4692/html5/thumbnails/16.jpg)
Constructs currently supported
● States● Transition● Self transition● Default transition● Transition ConditionTransition Condition● Transition Action
![Page 17: Emulink: A graphical modelling environment for PVS](https://reader033.vdocuments.us/reader033/viewer/2022052303/54b6f00b4a7959fd508b4692/html5/thumbnails/17.jpg)
Constructs currently supported
● States● Transition● Self transition● Default transition● Transition Condition● Transition ActionTransition Action
![Page 18: Emulink: A graphical modelling environment for PVS](https://reader033.vdocuments.us/reader033/viewer/2022052303/54b6f00b4a7959fd508b4692/html5/thumbnails/18.jpg)
Interface simulation
PVSio is an extension that enables PVS specifications to be executed
![Page 19: Emulink: A graphical modelling environment for PVS](https://reader033.vdocuments.us/reader033/viewer/2022052303/54b6f00b4a7959fd508b4692/html5/thumbnails/19.jpg)
Emulink: Emucharts animation During the simulation the diagram is animated, highlighting states and transitions
![Page 20: Emulink: A graphical modelling environment for PVS](https://reader033.vdocuments.us/reader033/viewer/2022052303/54b6f00b4a7959fd508b4692/html5/thumbnails/20.jpg)
Case study
Infusion pumps are devices in use in hospitals to deliver medications or nutrients to patients at controlled rates and precise volumes
Safety requirement: No over- or under-treatment
![Page 21: Emulink: A graphical modelling environment for PVS](https://reader033.vdocuments.us/reader033/viewer/2022052303/54b6f00b4a7959fd508b4692/html5/thumbnails/21.jpg)
Modelling and simulation of the device
Device Source Code
Emulink ModelPVS specification
Device interface animation
PVSio
![Page 22: Emulink: A graphical modelling environment for PVS](https://reader033.vdocuments.us/reader033/viewer/2022052303/54b6f00b4a7959fd508b4692/html5/thumbnails/22.jpg)
A critical interface failure
User types 102.3 units
Pump inoculates 1023 units without any warning
For doses above 100 units:
![Page 23: Emulink: A graphical modelling environment for PVS](https://reader033.vdocuments.us/reader033/viewer/2022052303/54b6f00b4a7959fd508b4692/html5/thumbnails/23.jpg)
Emulink helps pinpoint the design fault
![Page 24: Emulink: A graphical modelling environment for PVS](https://reader033.vdocuments.us/reader033/viewer/2022052303/54b6f00b4a7959fd508b4692/html5/thumbnails/24.jpg)
Conclusions
A graphical tool has been developed to semplify the adoption of formal methods in software development.
The utility of the tool has been demonstrated using a case study based on a real medical device.
Emulink is part of PVSio-web, a graphical frontend for the PVS formal verification tool.
Future work:Extension of the statecharts subset notation supported; Use of the tool in different domains.