Automating the implementation of Kalman filter algorithms

Proceedings of the 5th International Conference on Generative Programming and Component Engineering

2006

Code generators for realistic application domains are not directly verifiable in practice. In the certifiable code generation approach the generator is extended to generate logical annotations (i.e., preand postconditions and loop invariants) along with the programs, allowing fully automated program proofs of different safety properties. However, this requires access to the generator sources, and remains difficult to implement and maintain because the annotations are cross-cutting concerns, both on the object-level (i.e., in the generated code) and on the meta-level (i.e., in the generator).Here we describe a new generic post-generation annotation inference algorithm that circumvents these problems. We exploit the fact that the output of a code generator is highly idiomatic, so that patterns can be used to describe all code constructs that require annotations. The patterns are specific to the idioms of the targeted code generator and to the safety property to be shown, but the algorithm itself remains generic. It is based on a pattern matcher used to identify instances of the idioms and build a propertyspecific abstracted control flow graph, and a graph traversal that follows the paths from the use nodes backwards to all corresponding definitions, annotating the statements along these paths. This core is instantiated for two generators and successfully applied to automatically certify initialization safety for a range of generated programs.

Section: Autobayesmentioning

confidence: 99%

“…This is achieved by embedding annotation templates into the code templates, which are then instantiated and refined in parallel by the generator. We have successfully used this approach to certify a variety of safety properties for code generated by the AUTOBAYES [13] and AUTOFILTER [28] systems. However, it has two major disadvantages.…”

mentioning

confidence: 99%

A generic annotation inference algorithm for the safety certification of automatically generated code

Proceedings of the 5th International Conference on Generative Programming and Component Engineering

2006

“…In particular, we have evaluated AUTOCERT using C code generated by the Real-Time Workshop code generator. Based on the extensions described here, we have been able to certify frame and initialization safety for code generated from Simulink and Embedded Matlab models, as well as several safety properties for a variety of programs generated by our AUTOBAYES [13] and AUTOFILTER [27] generators.…”

Section: Figure 1 Idiomatic Matrix Initializations In Real-time Workmentioning

confidence: 99%

Generating customized verifiers for automatically generated code

Proceedings of the 7th International Conference on Generative Programming and Component Engineering

2008

Program verification using Hoare-style techniques requires many logical annotations. We have previously developed a generic annotation inference algorithm that weaves in all annotations required to certify safety properties for automatically generated code. It uses patterns to capture generator-and property-specific code idioms and property-specific meta-program fragments to construct the annotations. The algorithm is customized by specifying the code patterns and integrating them with the meta-program fragments for annotation construction. However, this is difficult since it involves tedious and error-prone low-level term manipulations.Here, we describe an approach that automates this customization task using generative techniques. It uses a small annotation schema compiler that takes a collection of high-level declarative annotation schemas tailored towards a specific code generator and safety property, and generates all customized analysis functions and glue code required for interfacing with the generic algorithm core, thus effectively creating a customized annotation inference algorithm. The compiler raises the level of abstraction and simplifies schema development and maintenance. It also takes care of some more routine aspects of formulating patterns and schemas, in particular handling of irrelevant program fragments and irrelevant variance in the program structure, which reduces the size, complexity, and number of different patterns and annotation schemas required. The improvements described here make it easier and faster to customize the system to a new safety property or a new generator, and we demonstrate this by customizing it to certify frame safety of space flight navigation code that was automatically generated from Simulink models by MathWorks' Real-Time Workshop.

“…So far, we have developed the overall structure of the generic program safety case and instantiated it manually. The example shown here uses code generated by our AutoFilter system [28], but the underlying annotation inference algorithm has also been applied to code generated from Matlab models using Real-Time Workshop, and we are confident that the same derivation can be applied there as well. Future work will focus on complementary safety cases that argue the safety of the certification framework itself, in particular the safety of the underlying safety logic (the language semantics and the safety policy) with respect to the safety property (i.e., safety claims) and the safety of other certification components such as the domain theory and the theorem prover.…”

Section: Discussionmentioning

confidence: 99%

“…Figure 1 shows the overall system architecture of our certification approach. In this, the original code generator (in this case, the AutoFilter system [28]) has been extended with the annotation inference subsystem and the standard machinery of Hoare-style verification techniques (i.e., VCG, simplifier, ATP, domain theory, and proof checker) to achieve a fully automated verification of the generated code. The architecture distinguishes between trusted (in grey) and untrusted components (in white) as shown in Figure 1.…”

Section: Formal Software Safety Certificationmentioning

confidence: 99%

Constructing a Safety Case for Automatically Generated Code from Formal Program Verification Information

Basir

Lecture Notes in Computer Science

Abstract. Formal methods can in principle provide the highest levels of assurance of code safety by providing formal proofs as explicit evidence for the assurance claims. However, the proofs are often complex and difficult to relate to the code, in particular if it has been generated automatically. They may also be based on assumptions and reasoning principles that are not justified. This causes concerns about the trustworthiness of the proofs and thus the assurance claims. Here we present an approach to systematically construct safety cases from information collected during a formal verification of the code, in particular from the construction of the logical annotations necessary for a formal, Hoare-style safety certification. Our approach combines a generic argument that is instantiated with respect to the certified safety property (i.e., safety claims) with a detailed, program-specific argument that can be derived systematically because its structure directly follows the course the annotation construction takes through the code. The resulting safety cases make explicit the formal and informal reasoning principles, and reveal the top-level assumptions and external dependencies that must be taken into account. However, the evidence still comes from the formal safety proofs. Our approach is independent of the given safety property and program, and consequently also independent of the underlying code generator. Here, we illustrate it for the AutoFilter system developed at NASA Ames.